Endpoint Security
6 MDM Tools for Device Management and Endpoint Security in 2026
Enroll the laptop so you can wipe it. An EDR sensor cannot manage a machine that was never a company machine.
Expertise: Endpoint Security · Level: Intermediate · 6 min read
The contractor’s Mac was never enrolled, so the EDR sensor cannot wipe it. NIST SP 800-124 Rev. 2 (May 2023) says remote wipe only works after a profile or agent is installed, before enterprise data is even supposed to sit on the device. Device loss and theft is the threat that section is written for.
EDR on machines that already checked in is not that enrollment. In production the miss is a BYOD Mac that still has the Slack token after the contractor leaves. Apple-first fleets, Microsoft estates, and an osquery-shaped inventory you host are different enrollment stories.
Process telemetry stays on EDR tools. Wipe, encrypt, and retire only work after the machine is a company machine. Start with the fleet you actually buy, then enroll it, then ask the host a question.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether the product is Apple-first or a cross-OS fleet, whether you operate it, whether wipe and restrict are documented, and whether BYOD is treated as consent.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| Fleet | Open osquery fleet you can host | osquery fleet · MIT core / premium · self-host or cloud |
| MicroMDM | Open Apple MDM server you operate | Apple MDM protocol · MIT · you host it |
| Kandji | Mac commercial with opinions | Blueprints · commercial · Apple-first |
| Jamf | The known Mac estate | Known Mac MDM · commercial · school and enterprise SKUs |
| Microsoft Intune | The button if the directory is already Entra | Windows and more · Microsoft terms · same Entra tenant |
| Mosyle | Apple business and education neighbor | Apple business and school · commercial · profiles on the public docs |
Fleet
Best for open osquery fleet you can host
Fleet is osquery plus MDM on the public docs. You can host it. The EDR-adjacent story is SQL on the host. Overlap with detection-as-code is declared.
When you already believe the host is tables, this is the open fleet. You staff it. Apple MDM still needs Apple business bits. It is not a wipe-only toy.
Key features
- osquery at fleet scale
- MDM on the public docs
- Self-host or Fleet Cloud
- MIT core
Why we like it
Fleet next to osquery is how you ask the host and still enroll the machine, without a second MDM console.
Limits
You staff it. Apple MDM still needs Apple business bits. Not a wipe-only toy.
MicroMDM
Best for open Apple MDM server you operate
MicroMDM is a server that speaks Apple MDM. You bring the APNs cert and the devices you own.
When the hole is an Apple server you can read, this is the open Apple server. You staff PKI. It is not Windows. It is not a pretty Mac App Store.
Key features
- Apple MDM protocol
- You host it
- MIT
- SCEP neighbor projects
Why we like it
An open server you operate is the pick when the Mac fleet should not depend on a logo.
Limits
You staff PKI. Not Windows. Not a pretty Mac App Store.
Kandji
Best for mac commercial with opinions
Kandji sells Apple device management with blueprints. The pitch is less XML than classic Jamf for a small Mac fleet.
A lot of startups already live here, so we list it so Jamf is not the only logo. It is Apple-shaped.
Key features
- Blueprints they sell
- Apple-first
- Compliance stories
- Commercial
Why we like it
Opinions on a small Mac fleet are useful when classic XML was the reason nobody finished enrollment.
Limits
Commercial. Apple-shaped.
Jamf
Best for the known Mac estate
Jamf Pro is the name procurement already wrote. Profiles, apps, a long operator memory.
If the Mac fleet is already Jamf, do not start over for a blog post. Cost and complexity are the catch. Windows is someone else’s problem.
Key features
- Known Mac MDM
- App install on the public docs
- School and enterprise SKUs
- Commercial
Why we like it
The estate you already staff is the Mac desk you already staff.
Limits
Commercial. Complexity. Windows is someone else’s problem.
Microsoft Intune
Best for the button if the directory is already Entra
Intune is MDM and MAM on the Microsoft estate. Windows first, Apple and Android on the public docs. License sits next to Entra.
A lot of fleets are already here, so a second Mac-only MDM is sometimes vanity. Apple depth versus Jamf is the catch.
Key features
- Windows and more
- Same Entra tenant
- Compliance policies
- Microsoft docs
Why we like it
Honesty. The directory you already have is often the fleet.
Limits
SKU maze. Apple depth versus Jamf.
Mosyle
Best for apple business and education neighbor
Mosyle sells Apple MDM for business and school. A common cheaper-than-Jamf story on small fleets.
Second Apple commercial so the list is not a two-logo page. Public pages are not a lab. It is Apple-shaped.
Key features
- Apple-first
- Business and education
- Profiles on the public docs
- Commercial
Why we like it
A smaller Apple commercial is useful when Jamf felt like an estate you do not have.
Limits
Commercial. Apple-shaped. Public pages are not a lab.
What we left out
- Omnissa Workspace ONE. Large shops already file devices on the old VMware estate. Public pricing is quote-only and Workspace ONE is the fleet desk, not a UEM bake-off.
- JumpCloud. People want MDM next to the directory they already bought. It failed the focused-MDM check. The directory is the product.
MDM threads treat the lost laptop as the real exam. This is not a personal-device surveillance kit.
Questions before you buy
If a first-party page cannot answer these, keep shopping.
- Can I list every Mac and Windows box that still has a company cert?
- Do we need Apple depth, directory gravity, or an open fleet we host?
- What happens to wipe if the laptop is already offline?
Enroll the fleet. Then ask the host a question. BYOD without a written program is how you silently profile a personal phone.
FAQs
Does MDM replace EDR?
No. MDM decides the fleet. EDR asks the host. Those are different jobs. Open the matching list for the other one.
Can I MDM a phone I do not own?
Not without a written program. BYOD is consent, not a silent profile.
Jamf or Intune?
Mac depth versus directory gravity. Read both. Order is editorial.
Is this a scored bake-off?
No.
