MDM tools that keep the laptop a company laptop (2026)

The EDR list asks the host a question. MDM decides whether that host is allowed to exist. Link EDR for the sensor. This page is inventory, profile, and wipe you already own.

Six fleets. One open osquery desk. One open Apple MDM. Three Apple-first commercials. One Microsoft estate. Public docs. Not a bake-off.

Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

Fleet

Best for open osquery fleet you can host

Fleet · MIT / premium

Fleet is osquery plus MDM they document. You can host it. The EDR-adjacent story is SQL on the host. Overlap with detection-as-code is declared.

Key features

• osquery at fleet scale
• MDM they document
• Self-host or Fleet Cloud
• MIT core

Why we like it

This is the hidden gem when you already believe the host is tables.

Limits

You staff it. Apple MDM still needs Apple business bits. Not a wipe-only toy.

2

MicroMDM

Best for open Apple MDM server you operate

MicroMDM · MIT

MicroMDM is a server that speaks Apple MDM. You bring the APNs cert and the devices you own.

Key features

• Apple MDM protocol
• You host it
• MIT
• SCEP neighbor projects

Why we like it

When the hole is an Apple server you can read, this is the honest core.

Limits

You staff PKI. Not Windows. Not a pretty Mac App Store.

3

Kandji

Best for mac commercial with opinions

Kandji · commercial

Kandji sells Apple device management with blueprints. The pitch is less XML than classic Jamf for a small Mac fleet.

Key features

• Blueprints they sell
• Apple-first
• Compliance stories
• Commercial

Why we like it

A lot of startups already live here. We list it so Jamf is not the only logo.

Limits

Commercial. Apple-shaped. We did not run a tenant.

4

Jamf

Best for the known Mac estate

Jamf · commercial

Jamf Pro is the name procurement already wrote. Profiles, apps, a long operator memory.

Key features

• Known Mac MDM
• App install they document
• School and enterprise SKUs
• Commercial

Why we like it

If the Mac fleet is already Jamf, do not start over for a blog post.

Limits

Cost. Complexity. Windows is someone else’s problem.

5

Microsoft Intune

Best for the button if the directory is already Entra

Microsoft · commercial

Intune is MDM and MAM on the Microsoft estate. Windows first, Apple and Android they document. License sits next to Entra.

Key features

• Windows and more
• Same Entra tenant
• Compliance policies
• Microsoft docs

Why we like it

Honesty. A lot of fleets are already here. A second Mac-only MDM is sometimes vanity.

Limits

SKU maze. Apple depth versus Jamf. We did not run a tenant.

6

Mosyle

Best for apple business and education neighbor

Mosyle · commercial

Mosyle sells Apple MDM for business and school. A common cheaper-than-Jamf story on small fleets.

Key features

• Apple-first
• Business and education
• Profiles they document
• Commercial

Why we like it

Second Apple commercial so the list is not a two-logo page.

Limits

Commercial. Apple-shaped. Public pages are not a lab.

What the internet thinks about MDM tools

MDM threads treat the lost laptop as the real exam. We keep that line. This is not a personal-device surveillance kit.

w0de0 on Hacker News, Feb 2024: “In my experience, Jamf is only the ‘gold standard’ when one has only cursory knowledge of the space.”

Prove Fleet still publishes

Confirm Fleet still publishes. Enroll only devices you own or have written leave to manage.

curl -fsSIL https://fleetdm.com/ | head -n 8

FAQs

Does MDM replace EDR?

No. MDM decides the fleet. EDR asks the host. Link both.

Can I MDM a phone I do not own?

Not without a written program. BYOD is consent, not a silent profile.

Jamf or Intune?

Mac depth versus directory gravity. Read both. Order is editorial.

Is this a scored bake-off?

No.