Windows MDM

How it works

Microsoft added a native MDM client to Windows Phone first, then to Windows 10 in 2015. The device enrolls through Settings (Access work or school) or, for company hardware, through Windows Autopilot at first boot. From then on it syncs with the server over OMA-DM, an HTTPS exchange of SyncML messages, and receives settings expressed as configuration service providers: the Policy CSP for hundreds of restrictions, BitLocker CSP for encryption, Update CSP for patch deadlines, EnterpriseModernAppManagement and Win32 packaging for apps.

Group policy, the tool Windows admins grew up with, needs an Active Directory domain and a device that sees it regularly. MDM needs a network connection, any network. That's the whole shift: a laptop at home on the employee's Wi-Fi is as managed as one in the office.

Not every group policy setting has an MDM equivalent, although the gap has narrowed since 2020. Scripts, custom registry changes and legacy line-of-business installers still need either PowerShell delivered by the MDM or a Win32 package.

Windows 10 reached end of support on October 14, 2025, so a managed fleet in 2026 is a Windows 11 fleet, with extended security updates as a paid bridge for the stragglers.

Why it matters for a fleet

The laptop is where the sensitive documents sit. A stolen phone exposes mail; a stolen laptop without BitLocker exposes the finance share. Windows MDM gives you encryption enforced, the recovery key escrowed in the console, and proof of both for the auditor.

The comparison is unavoidable: Intune is Microsoft's own MDM and knows Windows better than anyone, especially with Entra ID and Microsoft 365. If your organization is all-in on Microsoft, that's the default. If your estate is 800 phones and tablets with 80 laptops on the side, a second console for those 80 costs more in attention than it returns, and a mixed-platform MDM with the essentials (enrollment, BitLocker, updates, apps, compliance) is the pragmatic choice.

How Appaloosa handles it

Appaloosa manages Windows PCs alongside iOS, Android and macOS: enrollment through Windows Autopilot or from Settings, BitLocker enforced with recovery keys escrowed, update policies, app deployment, and compliance evaluated continuously on OS version, encryption and last check-in, with a remote wipe when a laptop goes missing. One inventory for the whole estate, hosted in France on SecNumCloud-qualified infrastructure. The Windows feature set is on the Windows MDM page.