My way through the MDM-​jungle

9.1.2017 - David Walter

A lot of compa­nies need a Mobile Device Manage­ment (MDM) sooner or later. And so did we.But which one is the right one?The MDM Market is over­crowded. There are about 30 diffe­rent solu­tions out there which all do the same things. I worked my may through them and share my expe­ri­ence with the best ones with you.

My way through the MDM-jungle teaser

All do setting profiles and restric­tions, share some files, instal­ling apps and wiping data remo­tely in case some­thing goes wrong.

But deci­ding on a good one is tedious. There are some buyers guides with very nice sentences in it like:

“This MDM offers EMM, BYOD, MAM, MEM, MBM, MCM, ACE, Mobile Secu­rity, App Wrap­ping, SDK, Iden­tity Manage­ment, Container Manage­ment, Telecom Manage­ment, Multi­user Manage­ment.”

I couldn’t make much sense of those letters this to I started goog­ling to deci­pher all those acro­nyms. You can find the result of this sear­ching at the bottom of this page. While doing so I came to the conclu­sion that these therms are too broad. Diffe­rent MDM provi­ders under­stand diffe­rent things under the same acronym. So they become even more unhel­pful.

So this meant a shift in stra­tegy. With diffe­rent review sites I narrowed down the MDM selec­tion to the better half of them. What I also found was that basi­cally all of them support: BYOD,COPE,COBO and cloud- and on-​premise-hosting. Suppor­ting all this things was a major selling point in the past but is now stan­dard. So you can switch your MDM-​strategy also later on without having to change your MDM.

Then my journey in the MDM-​jungle began by testing them one by one. Almost all of them offer a 30 day trial version, which is more or less cumber­some to get. Some you can just down­load, some need regis­tering and some of them let you enter a phone number and then let you wait (some­times multiple days!?) for them to call you and then send you a email with the down­load link.

During testing if found that all of them handle basic MDM func­tio­na­lity good.

But there are some mayor diffe­rences in special features , the apps they provide and the usabi­lity of their dash­boards.

Those things are also partly personal prefe­rences and can only be answered for you if you try them yourself. So I ordered the best quarter of all MDMs into four cate­go­ries which should help you as a star­ting point for your own evalua­tion:

Just-​works , Best Price/Value , Open-​source and Security-​focused

One MDM of each cate­gory is presented in more detail. At the end there is a little compa­rison of the special features of the presented MDMs.

Just-​works - AirWatch from VMWare

AirWatch Dasboard

AirWatch is one of the big names in the MDM depart­ment, one could call them the silver­back of the MDMs. They offer a very nice control panel and airwatch runs on every opera­ting system from iOS to Android, over Black­berry and even Symbian. All desktop opera­ting systems are supported as well (inclu­ding Chrome­books). Their enroll­ment process is fast and easy to do.

They supply their solu­tion with some produc­ti­vity apps. There are secure and synchro­nized E-mail, calendar, contacts, file manage­ment, and chat-​apps. You can put apps of your choice in their app catalog and let your users down­load them. Self-​developed apps can be wrapped with their app wrapper and also run in the encrypted container.

Airwatch can be hosted on-​premise or in the VMWare cloud.

Key Features

  • True all plat­forms solu­tion - With AirWatch’s ability to run on effec­tively every opera­ting system out there enables you to allow BYOD without any worries. Every device and opera­ting system can still be managed with ease from one central admi­nis­trator panel.

  • Tested and proven - Over the years AirWatch has slowly grown to the market leader. They have been deco­rated a leader of the MDM industry multiple years in row by Gartner, a well known infor­ma­tion tech­no­logy rese­arch and advi­sory company. A lot of compa­nies trust and use VMWare’s AirWatch.

  • Inte­gra­tion of third party services - You probably have already some IT infra­st­ruc­ture. With AirWatch its possible to inte­grate exis­ting solu­tions like Micro­soft 365, Dropbox, Cisco or Xamarin into one managed system.

  • See all of their features at their website.

All in all AirWatch is a very solid and exten­sive solu­tion which can simplify your IT manage­ment greatly. If you need some­thing that just works AirWatch surely is a good candi­date. But their service comes at a price. They are defi­ni­tely not the chea­pest MDM around.

A close runner-​up in this cate­gory is Mobile Iron and defi­ni­tely worth a look. They have a good compre­hen­sive expl­a­na­tion how MDMs work on their website.

Best Price/Value - AppTec360 EMM

AppTech360 Dashboard

The price is always a criteria when looking for any solu­tion. But often buying cheap means buying twice. This is defi­ni­tely not the case with AppTec360.

It has all the features needed to get your MDM up and running. Looking at their customer list it’s also proven that it scales well. They don’t offer an exten­sive app setup or other fancy features but ever­ything they do offer works as expected.

They target solid perfor­mance at a very compe­ti­tive price point. They’re a swiss company with servers in Switz­er­land and Germany specia­li­zing in MDM. This is one of the few MDMs which is an all european solu­tion and doesn’t commu­ni­cate to servers oversee. They also offer full on-​premise hosting.

AppTech360 Device

If you want to try it out, you can do this without any hassle in 5 minutes. Their MDM is free for up to 25 devices with on-​premise hosting. For a small busi­ness this is great, because you get all features, not just a lite-​version. They have both, a monthly subscrip­tion model and a one-​time-purchase model with on premise hosting. They pricing model is very modular, support for example costs extra. See details here.

Key Features

  • Clean and tidy hand­ling - Their dash­board is very orga­nized, the menus are logical. You can find anything you need in a timely manner. It looks like an MDM-​iTunes. You can see it in action in this video.

  • Content Box - Their mobile content manage­ment offers an app in which your employees can access your company data secu­rely and easily. But this feature costs extra.

  • Universal Gateway - Their “Zero Touch Authen­ti­ca­tion” enables you to set up emails without any inter­ac­tion on the device itself. They also have features like a guest mode and so on.

  • Extre­mely compe­ti­tive Prize - Their solu­tion costs 3-6 times less per device than their compe­ti­tors. If you’re content with a clean and effec­tive MDM without any clutter you’re good to go.

  • All features are listed here.

All in all you get a good usabi­lity with focus on core MDM tasks. That all their servers are hosted in Europe also helps against unwanted eyes on your data. Their modular pricing system allows you to only pay for the services you really need.

Open-​Source - WSO2

WSO2 Dashboard

If you are a friend of open source soft­ware WSO2 is the way to go for you. Their Code is 100% open source, you can have complete insight on Github.

Their Enter­prise Mobi­lity Manager (EMM, basi­cally an umbrella therm inclu­ding MDM and more) is build up with modular parts so you can put toge­ther a system perfectly fitted for you needs. As always with open source projects some tech­nical know­ledge is needed to get it up and running.

WSO2 Device

WSO2 is free to use. You can down­load their EMM now. Their busi­ness model revolves around provi­ding trai­nings and 24/7 support. Also cloud hosting is offered by them, but you’re likely to host it yourself if your inte­rested in this kind of MDM. If you want to get a feel for this MDM you best try out their quick start guide which takes about 45 minutes to complete. We made good expe­ri­ences with WSO2’s EMM after some tinke­ring.

Key Features

  • Comple­tely Custo­miz­able - 100% open source also means 100% custo­miz­able. You can have full control over what services are inte­grated and they even offer to develop custom features for you. But all features for normal use where present and worked well in our test.

  • Part of a compre­hen­sive plat­form - EMM is only a small part of WSO2’s product stack. They offer also analy­tics, iden­tity manage­ment and secu­rity, inte­gra­tion, IoT device manage­ment and more. See the complete plat­form here.

  • Free to use - If your IT allows it, you can get a compe­ti­tive EMM for free. Combined with the high custo­miza­tion degree allows you to have a tailor-​made solu­tion. Their custo­mers range from small compa­nies to fortune 500 enter­prises.

  • See a detailed list of all their features here.

If you know what you are doing you probably will get very happy with WSO2’s EMM. As far as we are aware this is the only truly open source MDM avail­able. It does a good job at what it does and is defi­ni­tely worth checking out.

Security-​focused - MaaS360 from Fiber­Link (IBM)

Maas360 Dashboard

Strict secu­rity around corpo­rate data is always a good idea. Security-​focused MDMs let you put your corpo­rate related apps into an encrypted container where they are sepa­rated from other (private) apps but can still commu­ni­cate to one another. (If you’re inte­rested in tech­nical details see these PDFs: Android, iOS)

Actually a good usabi­lity is also very important. Other­wise users are tempted to write pass­words on post-​its or commu­ni­cate over other chan­nels which may be inse­cure. (Effec­tively crea­ting a shadow IT).

Maas360 Device

MaaS360 from the IBM owned company Fiber­link offers contai­ne­riza­tion and a lot of other secu­rity measures still while main­tai­ning good usabi­lity. You can even wrap your self deve­loped apps to put them in the container as well.

Key Features

  • Fully contai­ne­rized MAM (Mobile Appli­ca­tion Manage­ment) - MaaS360 comes with an enter­prise app catalog and offers full contai­ne­riza­tion for enter­prise apps. Contai­ne­riza­tion also means you can wipe your data remo­tely, fully and secu­rely.

  • Mobile Threat Manage­ment - Offers a system to scan and protect your devices against mobile malware in real-​time. Whit this you can gain visi­bi­lity of threats instantly and react before they compro­mise corpo­rate data on the device.

  • Mobile Enter­prise Gateway - Since Fiber­link is owned by IBM they also have a great focus on mobile enter­prise usage. MaaS360 enables colla­bo­ra­tion in accordance to your autho­riza­tion, encryp­tion and contai­ne­riza­tion poli­cies. There is a built in way for distri­bu­ting docu­ments secu­rely to the devices. MaaS360 is compa­tible with other IBM services.

  • lots of other features are visible on the IBM MaaS360 Website

All in all MaaS360 is a versa­tile solu­tion witch offers good secu­rity without sacri­fi­cing usabi­lity and without an overly compli­cated setup. Since they are owned and pushed by IBM they offer regular updates and one can be fairly sure that they will continue this service for the coming years.

Another good solu­tion security-​wise is Citrix’s XenMo­bile. Also with a big focus on secu­rity comes Black­berry’s BES12.

Special Features Compa­rison

Under the basic features for I unter­stand these:

  • Mobile Device Manage­ment (MDM)

  • Mobile Appli­ca­tion Manage­ment (MAM)

  • Mobile Content/Email Manage­ment (MCM/MEM)

  • Policy and Confi­gu­ra­tion Manage­ment.

All presented MDM do those well.

Single-​Sign-On is a very nice feature not mentioned in this post so far. It’s cumber­some to set up, but once you have it you, adding a new user is a breeze. It means coupling all in-app accounts and email and so on to your company login, so a user has to sign-in just once and all the other sign-​ins are handled auto­ma­ti­cally.

So lets now compare our candi­dates

CriteriaAirWatchAppTec360WSO2MaaS360
Time to add a new device3 min5 min10 min5 min
Built-​in AppsMDM-​Client, Mail, Calendar, Contacts, Browser, Chat, File­ma­nagerMDM-​Client, File­ma­nager (optional)MDM-​ClientMDM-​Client, Mail, Calendar, Contacts, Browser
Supported plat­forms (Only mobile plat­forms listed)Android, iOS, Windows, Black­Berry, SymbianAndroid, iOS, WindowsAndroid, iOS, WindowsAndroid, iOS, Windows
API for contai­ne­riza­tionYesNoProbablyYes (but only on apps on which you have source-​code access)
Single-​Sign-On (works only with adapted apps)Yes (Wrap­ping only on Android)NoYesYes
One time purchase option (with on-​premise hosting)Yes (there is still a monthly main­ten­ance cost)YesfreeNo
Prize * per device/month3,5 - 7,5 €1 € (without support)free (support costs per month)3 - 5 € (their support gives you detailed infor­ma­tion)

*Note that prices of MDM are often not public because they vary strongly depen­ding on your confi­gu­ra­tion and the number of devices. They cost usually between 2-6 € per device/month + some­times some initial costs. To get a precise number you have to get in touch with them.

I hope this blog helps you on your own way through the jungle!

Here are links to all mentioned MDMs as a star­ting point:

MDM acro­nyms and therms

Acronym/ThermDescrip­tion
ACEApp Confi­gu­ra­tion for Enter­prise. So you can not only down­load apps for you users but set them up at the same time. Goes into the same direc­tion as Single-​Sign-On.
App Wrap­pingApplying a manage­ment layer to a mobile app that does not change the under­lying appli­ca­tion. Usually needed for contai­ne­riza­tion or Single-​Sign-On.
BYODBring-​Your-Own-Device: Employees to use their own device during work to access corpo­rate data. This device is secured by the your MDM-​solution and keeps corpo­rate data sepa­rated from personal data.
COPECompany Owned, Personal Enabled: Employees obtain a device from their company, but are allowed to use it priva­tely also. From an MDM-​perspective this approach is similar to BYOD, but gives the company more control over what devices in which confi­gu­ra­tion are used.
COBOCompany Owned, Busi­ness only: Employees obtain a device from their company and are not allowed to use it priva­tely at all. This can improve secu­rity because no private use means the devices can be locked down severely.
CYODChoose-​Your-Own-Device: Normally equi­va­lent to a COPE setup. This therm is some­times used if the employee can choose a device from a range of diffe­rent devices offered by the company.
Container Manage­mentA desi­gnated and encrypted area of a device that sepa­rates sensi­tive corpo­rate infor­ma­tion from the owner’s personal data and apps. The container protects the corpo­rate data from malware that may infect the device if an employee were to down­load a corrupted personal app.
Contai­ne­riza­tionAn alter­na­tive to full machine virtua­liza­tion that involves surrounds an appli­ca­tion in a container with its own opera­ting envi­ron­ment. This can improve secu­rity greatly.
DaaSDesktop-​as-a-Service: A cloud service in which the back-​end of a virtual desktop infra­st­ruc­ture (VDI) is hosted by a cloud service provider.
EMMEnter­prise Mobi­lity Manage­ment: The umbrella term for mana­ging and secu­ring mobile devices and all of their compo­n­ents inclu­ding networks, apps connec­tions. Includes an MDM.
Iden­tity Manage­mentThe mana­ging and admi­nis­tra­tion of iden­ti­fying indi­vi­duals and authen­ti­ca­ting their iden­tity across an enter­prise and estab­li­shing bounda­ries based on clea­rance level.
MAMMobile Appli­ca­tions Manage­ment: Basi­cally func­tio­na­lity like instal­ling apps, blocking certain other apps, dele­ting apps and so on. And all this remo­tely.
MBMMobile Brow­sing Manage­ment: Enables secure brow­sing and provides the ability to custo­mize settings like block websites and certain networks.
MCMMobile Content Manage­ment: A system to synchro­nize and distri­bute corpo­rate data to your mobile devices secu­rely. This often means using the file manager app from the MDM. MDM
MEMMobile Email Manage­ment: Maxi­mizes the effi­ci­ency of email and handles high volume email by being highly custo­miz­able
PIMPersonal Infor­ma­tion Manager: A type of appli­ca­tion soft­ware that func­tions as a personal orga­nizer. This tool faci­li­ties the recording, tracking, and manage­ment of certain types of personal infor­ma­tion.
Telecom Manage­mentA stra­tegic goal to create or iden­tify stan­dard inter­faces that would allow a network to be managed consistently across all network element suppliers. This may apply to wire­less commu­ni­ca­tions, cable TV, as well as private and public wired networks.
VDIVirtual Desktop Infra­st­ruc­ture: Hosting a desktop opera­ting system within a virtual machine (VM) running on a centra­lized server. This is a varia­tion on the client/server compu­ting model, some­times referred to as server-​based compu­ting.

Newsletter abonnieren

Kontakt

Smoca AG
Tech­no­park­strasse 2
Gebäude A, 3. Stock
8406 Winter­thur

Letzter Blogein­trag

R wie React - App Entwick­lung A bis ZChristina Canclini - 11.4.2019

Das Webframe­work React wurde von einem Face­book Soft­ware­in­ge­nieur entwi­ckelt und wird seit mehr ...

  • Smoca Facebook
  • Smoca Twitter
  • Smoca LinkedIn
  • Smoca RSS Feed
  • Smoca Spotify