A mobile device management (MDM) licence gives you the controls to manage a fleet. It doesn’t give you anyone to run them. Profiles, updates, enrolment problems and compliance alerts all need a person, and when nobody owns that work, devices look compliant in the console while failing on the floor.
This guide covers what MDM software does well, what the licence leaves to you, what MDM administration involves week to week, and how to decide between running it in-house and using MDM as a Service (MDMaaS) in Canada.
Definition
Mobile device management (MDM) is software that enrols, configures, secures and monitors an organization’s mobile devices from a central console. It sets the rules for phones, tablets and rugged handhelds. MDM administration is the ongoing work of keeping those rules accurate, current and enforced.
Key takeaways
- The licence is the tool, not the job. Someone still has to build profiles, test updates, fix enrolment problems and act on compliance alerts.
- Policy drifts without an owner. Distributed fleets accumulate exceptions, stale apps and devices that quietly drop out of management.
- Rugged fleets need more administration. Dedicated mode, scanner settings and slower update cycles add work smartphones don’t.
- MDM as a Service is a staffing decision. Certified administrators run your existing platform, so you keep the tool and hand off the daily work.
- MDM supports compliance, it doesn’t create it. PIPEDA accountability still sits with you.
What mobile device management software does well
MDM software is good at enforcing rules at scale. Once a device is enrolled, the platform can push settings, install and update apps, enforce passcodes and encryption, report compliance, and lock or wipe the device remotely.
The Canadian Centre for Cyber Security’s guidance on mobile device deployments lists those capabilities, including encryption, automatic security patching and app allow and block lists. MDM is also one component of the broader enterprise mobility management (EMM) platforms most vendors now sell.
None of that is in question. The question is who configures it, keeps it current and responds when it reports a problem.
What an MDM licence doesn’t cover
The licence covers the software. These seven areas of work come with it, and none of them do themselves.
Day-to-day platform administration
Someone has to build and maintain profiles by role, approve and push apps, manage certificates, handle enrolment requests and keep the console tidy. In most organizations this lands on one or two people who also have other jobs.
Policy drift across sites and provinces
Every exception made for one store, depot or ward adds a little drift. Over time, devices in different locations end up running different settings, and the console no longer reflects how the fleet actually behaves.
OS and app update testing
MDM can push an update to every device at once. It can’t tell you whether your scanning, dispatch or clinical app will still work afterwards.
Here’s what actually happens without testing. An update reaches the whole fleet, a line-of-business app breaks on one model, and workers lose a shift while it’s rolled back.
Enrolment exceptions and devices that drop out
Devices get reset, swapped between sites or replaced in a hurry, and some never re-enrol. They keep working, but outside every policy you’ve set. Finding them means reconciling the console against purchase records and carrier lines.
Rugged device configuration
Rugged handhelds and scanners need settings smartphones don’t, such as scan engine behaviour, programmable buttons, battery management and dedicated app modes. Those settings come from manufacturer configuration tools that have to be maintained alongside the MDM profile.
Compliance reporting someone acts on
MDM reports which devices are out of policy. It doesn’t follow up. A compliance dashboard that nobody reviews weekly is a record of risk, not a control.
The physical work around the device
MDM manages a device once it exists and is enrolled. It doesn’t source it, stage it, ship it, repair it, replace it from a spare pool or wipe and retire it with a certificate. That’s the work managed mobility services cover.
What MDM administration involves week to week
MDM administration is a recurring workload, not a project. This table shows the typical cadence for an enterprise fleet.
| Task | Typical cadence | What goes wrong if it’s skipped |
|---|---|---|
| Enrolment requests and exceptions | Daily | New and replacement devices sit unmanaged |
| Compliance review and follow-up | Weekly | Out-of-policy devices keep reaching business systems |
| App updates and configuration | As vendors release | Mixed app versions and broken workflows |
| OS update testing and staged release | Each OS release, by device model | Outages, or devices left unpatched |
| Certificate and profile renewals | Before each expiry | Wi-Fi, VPN or email stops working across a site |
| Inventory reconciliation | Monthly | Devices outside management, lines with no device |
| Policy review | Quarterly | Drift and exceptions nobody remembers approving |
| Configuration documentation | With every change | Knowledge leaves when an admin does |
Just know that the cadence rises with device variety. A fleet with three device models and two operating systems needs three or four times the update testing of a single-model fleet.
Mobile device management for rugged and frontline devices
Frontline fleets put more weight on MDM administration, not less. Scanners, handhelds and vehicle-mounted devices are shared across shifts, locked to a few apps and expected to work every minute of every shift.
Most of these devices run in dedicated mode, which Android Enterprise describes as company-owned devices used for a single purpose, with lock task mode so workers can’t exit the approved apps. Getting that right means maintaining kiosk settings, app allow lists and recovery steps for each device type.
Rugged devices also tend to get OS updates later than consumer devices, and each model may need its own testing. Our guides to rugged mobile computing and the challenges of managing rugged devices cover what’s different about these fleets.
How to keep MDM policies consistent across a distributed fleet
Consistency across dozens of stores, depots or care sites comes from structure, not effort. Four practices do most of the work.
Build policy in layers
Set one security baseline for every device, then add role-based profiles (driver, associate, nurse) and only then site-specific settings. Exceptions should live in the top layer, where they’re visible.
Put every change through change control
Record who changed what, why and when, and test changes on a small group before releasing them fleet-wide. That record is also what lets a new admin understand the platform.
Review compliance on a schedule
Pick a weekly slot, review out-of-policy devices by site and assign follow-up. Conditional access can block non-compliant devices automatically, but someone still has to fix them.
Reconcile the console against reality
Match the MDM inventory against purchase records and carrier lines every month. Devices that should be enrolled but aren’t are the biggest blind spot in most distributed fleets.
In-house or outsourced MDM administration
You can run MDM in-house, share it with a provider or hand the daily work to one. The right answer depends on fleet size, device variety and how much MDM knowledge sits with one person.
| Model | Who does the work | Fits best when | Watch out for |
|---|---|---|---|
| In-house | Your admins | The fleet is uniform and an experienced admin has capacity | Key-person risk and deferred updates |
| Co-managed | You own policy, a provider handles daily administration | You want to keep security decisions but not the workload | Unclear ownership unless roles are written down |
| MDM as a Service | A provider’s certified administrators, to your policy | The fleet is distributed, mixed and frontline-critical | Weak reporting or exit terms |
The common trigger is the same across industries. MDM knowledge sits with one person, updates keep getting deferred, and nobody can say with confidence how many devices are actually under management. The MDM as a Service guide explains how the model works.
Retail store devices
National retailers run handhelds, point-of-sale devices and printers across dozens or hundreds of stores, with seasonal staff and peak trading freezes. Outsourced administration fits best when store devices drift between locations and IT can’t keep policies consistent centrally.
Hospital and clinical devices
Hospitals need clinical devices that are secure, compliant with health privacy law and available on every shift. Outsourcing fits best when the MDM team is small, devices span several care sites and nobody has a single view of compliance across them.
Transportation and logistics driver devices
Driver and field devices operate across provinces, often in vehicles, and fall out of compliance between depot visits. Outsourcing fits best when hundreds of devices need consistent security policies and IT is too stretched to chase non-compliant ones.
What to look for in an MDM as a Service provider in Canada
An MDM as a Service provider should prove it can run your platform, not just that it knows the software. These are the checks that separate providers.
- Certified administrators on your platform today. Ask for headcount per platform and their certifications.
- Experience with fleets like yours. Rugged, shared and dedicated devices need different skills than office smartphones.
- A documented change and update process. Ask how OS releases are tested by device model before release.
- Compliance reporting you can see. A live dashboard and a scheduled review, not a report on request.
- A worked answer to a real problem. Describe a policy conflict from your fleet and ask how they’d fix it.
- Named escalation for security incidents. Who responds to a lost device at 2 a.m., and how fast.
- Support for Canadian obligations. Data-handling terms, Quebec requirements and French-language support where you need it.
- Clear exit terms. Configuration documentation and admin access returned to you when the contract ends.
For the wider provider evaluation, including staging, repair and decommissioning, see our guide to evaluating managed mobility service providers.
Mobile device management and Canadian privacy obligations
MDM supports privacy compliance, but it doesn’t make you compliant. Under PIPEDA, the Privacy Commissioner’s accountability principle keeps you responsible for personal information, including information a provider handles for you.
For personal devices, the Commissioner’s guidance on BYOD programs recommends a privacy impact assessment, a clear monitoring policy and separating work data from personal data. Quebec’s Law 25 and Ontario’s PHIPA add their own requirements, covered in our guides to PIPEDA, Law 25 and PHIPA compliance for MDM.
These are planning considerations, not legal advice. Confirm specific obligations with your legal and privacy teams.
Where PiiComm fits in mobile device management
PiiComm is Canada’s largest pure-play managed mobility services provider. Through MDM as a Service, our certified technicians administer your existing MDM, EMM or UEM platform, including profiles, updates, enrolment and compliance follow-up, to the policy you set.
The physical work MDM can’t do is handled in-house, in Canada. Our own technicians stage, repair and securely retire devices in our own Canadian facility, so the console and the floor are run by the same team.
We’re a strong fit for organizations running distributed frontline fleets of handhelds, scanners, tablets and phones. We’re not the right choice if you only need MDM software, or if your fleet is small and uniform enough that one admin runs it comfortably.
Questions we hear about mobile device management
What is mobile device management (MDM)?
Mobile device management (MDM) is software that enrols, configures, secures and monitors an organization’s mobile devices from a central console. It pushes settings and apps, enforces passcodes and encryption, reports compliance and can lock or wipe devices remotely. MDM is usually one component of an enterprise mobility management or unified endpoint management platform.
What doesn’t an MDM licence include?
An MDM licence includes the software, not the people to run it. It doesn’t include day-to-day administration, OS and app update testing, fixing enrolment exceptions, following up on compliance alerts, rugged device configuration or documentation. It also doesn’t cover physical work such as staging, repair, spare devices and certified retirement.
What is MDM as a Service?
MDM as a Service (MDMaaS) is a managed service where a provider’s certified administrators run your MDM, EMM or UEM platform for you. They maintain profiles, test and release updates, handle enrolment problems and follow up on compliance, to the policy you set. You keep the platform and the decisions, and hand off the daily work.
Should a national retailer manage MDM in-house or outsource it?
A retailer with a uniform fleet, a few locations and an experienced admin can manage MDM in-house. Retailers with devices across dozens or hundreds of stores, seasonal staff and policies that drift between locations usually do better with MDM as a Service or a co-managed model, because consistency across stores needs daily attention.
Should a Canadian hospital manage mobile device security in-house or outsource MDM?
A hospital can keep MDM in-house if its team has capacity and a single view of compliance across care sites. Outsourcing fits better when the MDM team is small, clinical devices span several sites and updates or compliance gaps affect patient care. Either way, the hospital stays accountable under PIPEDA and provincial health privacy law.
What should a transportation and logistics company look for in an MDM as a Service provider?
Look for certified administrators who run rugged and vehicle-mounted fleets today, a tested process for OS updates by device model, compliance reporting by depot or region, named escalation for lost devices, and support for drivers operating across provinces. Ask how they’d bring non-compliant driver devices back into policy between depot visits.
How do you keep MDM policies consistent across many locations?
Build policy in layers, with one security baseline, then role-based profiles, then site exceptions. Put every change through change control and test it on a small group first. Review compliance weekly by site and reconcile the MDM inventory against purchase and carrier records every month to find devices that dropped out of management.
Can MDM software manage rugged devices?
Yes. MDM platforms can manage rugged handhelds and scanners, usually in dedicated mode with lock task settings, alongside manufacturer configuration tools for scanner settings, buttons and batteries. Rugged fleets need more administration than smartphones, because each model may need its own update testing and configuration.
Does MDM software make an organization PIPEDA compliant?
No. MDM provides controls that support compliance, such as encryption, remote wipe and access restrictions, but PIPEDA accountability stays with the organization. You still need policies, a clear approach to personal devices, documented handling during repair and retirement, and a breach response process. Confirm specific obligations with your legal team.
Closing the gap between the console and the floor
Your MDM licence gives you the controls. Whether they protect the fleet depends on who runs them every day.
If your platform needs more attention than your team can give it, talk to one of our mobility specialists about MDM as a Service.
References
- Canadian Centre for Cyber Security, Security considerations for mobile device deployments (ITSAP.70.002). Deployment models and management capabilities.
- Google for Developers, Dedicated device (Android Enterprise). Single-purpose company-owned devices and lock task mode.
- Office of the Privacy Commissioner of Canada, PIPEDA Fair Information Principle 1, Accountability (2020). Accountability for information handled by third parties.
- Office of the Privacy Commissioner of Canada, Is a BYOD program the right choice for your organization? (modified 2025). BYOD privacy recommendations.