What enrollment is, how an MDM is implemented on new and already-in-use equipment, and what a company gains when its devices become managed. A guide for IT, Ops, and founders of distributed teams.
Most remote teams have staff distributed across different countries working with the company laptop. Laptops delivered so that people can carry out their activities, and an aspect they do not usually anticipate: security.
IT has no way of acting on those machines remotely, cannot lock them if someone leaves, cannot ensure they have an encrypted drive, does not know if security updates are up to date.
The problem is that these computers never entered a management system. They are boxes with company information inside, scattered across the region, which rely on each collaborator doing things right on their own.
That is where two concepts come in that are usually mentioned together and should be sorted out: the MDM, which is the tool that allows devices to be managed remotely, and enrollment, which is the step by which a device enters that system. This article explains how that step works and what it enables once it is done.
What is device enrollment
Enrolling a device means incorporating it into a management system (the MDM) in order to manage it remotely. The configurations, policies, and applications corresponding to each position are defined beforehand in the MDM console. Once the device is enrolled, it receives all of that automatically, including any changes applied later on, without needing to be configured separately. Once enrollment is finished, the device is ready to work and, additionally, under the company's control.
It is the gateway to everything else. Without an enrolled device, the MDM has nothing to act upon. That is why enrollment is not just a procedure: it is the foundation of hardware management.
The MDM is the layer on top. If you want to delve deeper into what it is and what it solves, we discuss it in What is mobile device management (MDM)? and in MDM and asset management. Here we focus on the step that makes them possible.
How devices are enrolled: new ones and those already in use
There are different ways to do this depending on the case, and the main difference lies between a new device and one that is already in someone's hands.
For a new device, the ideal scenario is for it to be associated with the system before reaching the collaborator, so that enrollment happens automatically during the initial setup: the user turns it on and the computer configures itself, with its applications and policies applied from the very first moment. On Apple, for example, this is done through ABM/ADE (Apple Business Manager / Automated Device Enrollment). It is the cleanest scenario, because there is no manual step involved and onboarding starts without friction. When the company does not yet have ABM configured, or when there is no possibility of providing in-person support where the collaborator is, enrollment is done remotely and with the user's participation, which is the most common process.
But most companies that need an MDM already have a fleet: dozens of distributed devices, purchased at different times and through different channels, that were never managed. In that case, enrollment is done on devices that are already in use, remotely and gradually (without stopping operations) until the entire fleet is under management. It is a longer process than setting up a new device, and it should be done in an orderly fashion without interrupting the collaborator's work.
In both scenarios, the principle is the same: the device is incorporated into the system without the collaborator losing what they had or having to resolve anything technical on their own.
What can be done once devices are enrolled
With enrolled devices, the company no longer depends on the goodwill of each employee and is able to act on their hardware remotely. This is what an MDM specifically enables, in terms of business value:
Remote locking during offboarding. When a person leaves the company, the device can be locked remotely and the information remains protected, even if the return is delayed or never happens. It is the other half of an orderly offboarding.
Disk encryption. If a device is lost, stolen, or not recovered, the data is not exposed. Without the key, no one can access the company's information.
Standardization by job profile. A development team, a design team, and an administration team do not need the same configuration. The MDM allows each profile to receive its applications and policies consistently.
Security policies. Rules such as port control or firewalls are applied uniformly to the entire fleet, with specific exceptions when a technical team needs them to work.
Updates with criteria. Keeping applications up to date closes security gaps, but applying every update as soon as it comes out can disrupt a team's work. Management allows you to decide what gets updated and when, waiting on critical applications before pushing a change.
Visibility of the device's technical status. You can find out if a device is reporting, if the disk is saturated, or if the battery is no longer performing. This information helps anticipate problems and, over time, to buy better: knowing what equipment each role actually needs instead of estimating by eye.
An important point about the latter: what is managed is the technical and security status of the device, not the person's activity. The MDM is not an employee surveillance tool; it is a tool for the company to keep its own hardware secure and organized.
MDM as a service: the four steps and the two operation models
Implementing an MDM is not about buying a license and managing on your own. At First Plug we carry it out through a process that follows four steps:
Diagnosis. Understanding why the company needs MDM. Not all arrive for the same reason: some want to be able to act during offboarding, others need encryption and security policies, others have an audit coming up. The goal defines everything that follows.
Platform selection. There are several MDM solutions on the market, each more suitable for different sizes and needs. The decision depends on the diagnosis, not the other way around.
Implementation. Enrollment of devices, both new and existing, with the agreed configuration and policies.
Operation. The day-to-day: verifying that devices continue to report, resolving incidents, applying changes when necessary.
Regarding that last step, there are two possible models, and the choice is made according to the company's IT team. In one, First Plug assumes the daily operation and the IT department gets rid of a task that is not its focus. In the other, First Plug configures and implements everything, and then hands over the operation to the internal IT team so they can manage it with their own people. Both options are valid; it depends on how much the company wants to solve on its own.
Beyond the operation, First Plug can also intervene solely as a consultancy. There are clients who seek us out specifically for the diagnosis and platform selection, and there we act as a bridge to provide the MDM licensing that best fits their case, without them needing to outsource the operation as well.
This service is part of the same hardware lifecycle management that First Plug operates with its own infrastructure in LATAM: the same provider that knows your fleet, delivers the devices, and coordinates their recovery is the one that leaves them managed. They are not scattered pieces from different places.
MDM and Evidence for ISO 27001 and SOC 2
When a company goes for a certification like ISO/IEC 27001 or a SOC 2 audit, MDM becomes a very helpful tool. It is not a requirement of those standards, because you can get certified without MDM, but without it the process becomes much more complex: these standards do not just ask for the equipment to be secure, they ask to be able to prove it, and that evidence comes from the continuous management of the device.
The MDM allows showing, device by device, that the disk is encrypted, that the security policies are applied, and that the configurations comply with what the standard requires. This evidence is what the auditor needs to see. We did this work with a company that needed to organize its fleet and move towards a certification: without the management layer provided by the MDM, organizing the fleet and generating those tests systematically would have been much more difficult.
Frequently Asked Questions
Do you have to format the computer to enroll it?
No. Enrollment is done remotely and does not delete what the collaborator already has on the computer. The computer becomes integrated into the management system without losing its information or disrupting work.
Can enrollment be done entirely remotely?
Yes. In the vast majority of cases, the computer does not need to go through an office, nor does it need to be handled by technical staff in person. It is coordinated remotely, both for new computers and for those already in use.
Does it only work on Apple computers?
No. You can manage both macOS and Windows, as well as iOS and Android mobile devices. The management level and policies adapt to each system.
What does the company see on a collaborator's computer?
The company sees the technical status of the device and compliance with security policies: whether it is encrypted, whether it reports, whether it is updated. It does not access the personal content of the individual. MDM manages the company's hardware, not the collaborator's activity.
Is it useful for certifications like ISO 27001 or SOC 2?
Yes. In fact, it is one of the most common reasons a company implements an MDM: it allows generating and showing the configuration and security evidence required by audits.
Conclusion
Equipping a remote company well and securing the data distributed across all those laptops can only be ensured when that equipment is enrolled, managed, and protected, and the company can act on it wherever it is. Enrollment is the step that separates a fleet that is controlled from one that is only expected to work.
If a key person were to leave your company tomorrow, how long would it take your IT team to lock their computer and protect the information inside? If the answer is not clear, the problem probably isn't that computer, but that it is not yet under management.
At First Plug, we can help you organize that front: write to us for a quote and we'll look at your specific case.
You might also be interested in…
