How to choose an MDM and install it: Intune, Jamf, Kandji compared

Last updated: 2026-10-15

To choose an MDM, start from your device mix, not from feature lists. A Windows-heavy company already on Microsoft 365 usually lands on Intune; an Apple-first company picks Jamf or Kandji (now Iru); a large, multi-OS or frontline fleet looks at Workspace ONE. Then check zero-touch enrollment, security policies, compliance evidence and admin time. If you would rather not run the tool yourself, an MDM for businesses delivered as a managed service is the alternative.

Quick verdict

• Choose Microsoft Intune if most devices run Windows and you already pay for Microsoft 365 Business Premium, E3 or E5.

• Choose Jamf if your fleet is mostly Mac, iPhone and iPad and you have an IT admin who wants deep Apple control.

• Choose Kandji (Iru) if you are Apple-first, have a small IT team and want automation out of the box.

• Choose Workspace ONE if you manage thousands of devices across many OSes, including rugged or shared frontline devices.

Features and pricing models checked on vendor websites in October 2026.

How do you choose an MDM in practice?

Choosing an MDM comes down to six questions: which operating systems you must manage, how devices get enrolled, which security policies you need to enforce, which identity provider you use, what evidence your auditors expect, and who will run the tool day to day. Answer them in that order and the shortlist usually shrinks to one or two vendors.

The criteria below are the ones IT managers raise most often when they compare MDM tools for a company of 50 to 500 employees. Each one applies to all four vendors in the table above. This page is about selecting and installing an MDM; for the definition and how mobile device management works, see our MDM guide.

Which operating systems does your fleet run?

Start with an inventory: number of Macs, Windows PCs, iPhones, Android phones, tablets and Linux workstations, and the trend over the next two years. A single-platform MDM is fine for a homogeneous fleet. As soon as two OSes coexist at scale, you either pick a multi-platform tool or run two tools side by side.

Running two tools is a legitimate choice. Yousign, a French e-signature scale-up and Fleet customer, uses Jamf for its Apple devices and Microsoft Intune for its PCs: each OS is managed by the tool built for it, at the cost of two consoles and two sets of policies.

Does it support zero-touch enrollment?

Zero-touch enrollment means a new device enrolls itself in the MDM the first time it connects to the internet, without IT touching it. On Apple devices this relies on Automated Device Enrollment (ADE) through Apple Business Manager; on Windows, on Windows Autopilot; on Android, on Android Enterprise zero-touch. All four vendors support Apple ADE; only Intune and Workspace ONE cover Windows Autopilot natively.

Zero-touch is what makes remote onboarding scale. Without it, every laptop has to be configured by hand before shipping, or the employee has to install a profile themselves. Our step-by-step guides cover Apple zero-touch enrollment and Windows zero-touch with Entra ID.

Which security policies can you enforce?

Every serious MDM covers the baseline: disk encryption (FileVault, BitLocker), password and screen-lock rules, OS update enforcement, app deployment, and remote lock and wipe. The differences sit in the details: how quickly new OS releases are supported, ready-made security baselines such as CIS benchmarks (built into Kandji's templates), and whether the tool supports Apple's declarative device management, which Apple is making the standard way to manage software updates.

Check also what happens when a device is out of compliance. Intune can block access to Microsoft 365 through Conditional Access; Apple-first tools rely on integrations with your identity provider to do the same.

Does it fit your identity provider?

Your MDM should follow your identity provider, not the other way round. Intune is built on Microsoft Entra ID, which makes it the natural choice for a company that already logs in with Microsoft accounts. Jamf, Kandji and Workspace ONE integrate with Entra ID, Okta and Google Workspace, so they work in any environment, but each integration is one more configuration to maintain.

Will it give you audit evidence for ISO 27001 or SOC 2?

ISO 27001:2022 includes a control on user endpoint devices (Annex A 8.1), and SOC 2 auditors ask how laptops are encrypted, patched and wiped. An MDM is where that evidence comes from: a compliance report per device, an encryption status, an OS version, an offboarding log. Before signing, ask each vendor for a sample compliance export and check that it answers your auditor's questions, not just the vendor's dashboard.

Who will run it, and how much time will it take?

The tool is rarely the bottleneck; the admin time is. Intune and Workspace ONE are powerful but expect a trained administrator, especially for Macs on Intune. Jamf rewards Apple expertise. Kandji (Iru) is designed for lean IT teams with pre-built automations. In a company where IT is handled by an office manager or a founder, the realistic question is whether to run an MDM at all, or to use a managed one.

Count also the yearly upkeep that vendors don't put on the pricing page: renewing the Apple push certificate and the ADE token, updating policies after each major OS release, and reviewing non-compliant devices.

Intune vs Jamf: which one for a mixed Mac and Windows fleet?

Intune vs Jamf is the most common comparison in mixed fleets. Intune covers Windows, macOS, mobile and Linux in a single console and is often already licensed through Microsoft 365. Jamf covers Apple devices only (plus Android through Jamf for Mobile) but goes deeper on macOS and iOS. The tipping point is usually the share of Macs and the presence of a Mac admin.

Jamf vs Intune is not always an either-or. As in the Yousign example above, many scale-ups run Intune for Windows and Jamf or Kandji for Apple, connected to the same identity provider.

Kandji (Iru) and Workspace ONE: when do they make sense?

Kandji, renamed Iru in late 2025, targets Apple-first companies with small IT teams: pre-built security templates, automatic app patching (Auto Apps) and zero-touch Apple deployment, now extended to Windows and Android. Workspace ONE, sold by Omnissa since the VMware end-user computing business was spun off, targets large organisations that manage many OSes, rugged devices and shared frontline devices.

In short: Kandji (Iru) competes with Jamf on Apple-first fleets and wins on ease of use; Workspace ONE competes with Intune on large mixed fleets and wins on breadth of platforms. For a 50 to 500 employee company without frontline devices, Workspace ONE is usually more than needed.

How we compared

The four tools were compared on the six criteria above for a reference scenario: a company of 100 to 300 employees, mostly remote or hybrid, with a mix of Mac and Windows laptops and company phones, in several countries. Sources are the vendors' product, pricing and documentation pages, checked in October 2026. Prices are not published by Jamf, Kandji (Iru) or Omnissa and are therefore not compared in figures.

What do you need before installing an MDM?

Before installing an MDM, prepare four prerequisites: an Apple Business Manager account (requires a D-U-N-S number) for Apple zero-touch, a Microsoft Entra ID tenant for Windows Autopilot and Intune, an Apple Push Notification service (APNs) certificate to let the MDM talk to Apple devices, and a managed Google Play binding for Android Enterprise. Missing one of them is the most common cause of a stalled rollout.

• Apple Business Manager: free, but the account validation can take several days. Ask your reseller or leasing provider to link your devices to it so new Macs and iPhones appear automatically.

• Microsoft Entra ID: required by Intune; automatic Windows enrollment needs Entra ID P1, included in Microsoft 365 Business Premium. For Autopilot, devices must be registered by the reseller or with their hardware hash.

• APNs certificate and ADE token: both are valid for one year. Use a shared company Apple Account, not a personal one, or you will lose access when the admin leaves.

• Android Enterprise: link the MDM to a managed Google Play account before enrolling Android phones.

Our overview of Apple Business Manager explains the account setup in detail.

How do you install an MDM step by step?

Installing an MDM takes five steps: connect the prerequisites, define policies by employee group, pilot on a few devices, enroll the existing fleet, then switch new devices to zero-touch. For a 100 to 300 device fleet, a realistic plan is two to four weeks from setup to full enrollment, most of it spent on the pilot and on getting existing users to enroll.

1. Connect the MDM: upload the APNs certificate, link Apple Business Manager (ADE token), connect Entra ID or your identity provider, and bind Android Enterprise if needed.

2. Define policies and groups: encryption, password, OS updates, Wi-Fi and VPN profiles, and the app catalogue per team (engineering, sales, finance). Start from a security baseline rather than a blank page.

3. Pilot on 5 to 10 devices: include at least one device per OS and one person outside IT. Test onboarding, a remote lock, an app install and an OS update.

4. Enroll the existing fleet: devices already in Apple Business Manager can be assigned to the MDM; others enroll through a user-initiated profile or a reset. Communicate a deadline and what the company can and cannot see on the device.

5. Switch to zero-touch for new devices: from now on, every new laptop is assigned to the MDM in Apple Business Manager or Autopilot before shipping, and is configured on first boot.

If you are migrating from another MDM, macOS 26 and iOS 26 let you reassign devices to a new MDM in Apple Business Manager with a deadline, without wiping them. This removes one of the main reasons companies stayed locked into a tool they no longer wanted.

MDM selection and rollout checklist

Get devices enrolled before they ship with Fleet

Choosing an MDM is half the job. The other half is running it: linking every new Mac to Apple Business Manager, registering Windows laptops for zero-touch, renewing the APNs certificate every year and chasing devices that drift out of compliance before an ISO 27001 audit. A strong IT team can do all of this, but in a fast-growing company each step competes with everything else on the roadmap.

Fleet handles device management end to end in one platform, across 150+ countries, from the order to the return of the device:

• Enrolled before delivery: devices arrive pre-configured through zero-touch enrollment (Apple Business Manager or your MDM), so employees are operational from day one.

• Security policies applied: Fleet MDM applies your security policies, with remote enroll, configure and wipe; Fleet's security partners are ISO 27001 and SOC 2 certified.

• Compliance in one view: every device, OS version and compliance status tracked in the Cockpit dashboard.

• Delivery in 3 to 5 working days: devices shipped to employees in 150+ countries, ready to use.

• Support under 2 hours: a support team that answers in under 2 hours when a device needs attention.

Fleet already equips over 100,000 users from 1,500 companies. Book a demo and see how Fleet gets every new laptop secured and enrolled before it reaches your employee.

FAQ

What is the best MDM for a small business?

There is no single best MDM: it depends on the device mix. A Windows-first small business already on Microsoft 365 Business Premium usually gets the most value from Intune, which is included in that plan. An Apple-first small business with no dedicated admin often finds Kandji (Iru) or Jamf Now easier to run.

Can Intune manage Macs as well as Jamf?

Intune can manage Macs: enrollment through Apple Business Manager, FileVault, configuration profiles, app deployment and compliance. Jamf goes further on Apple-specific features and usually supports new Apple OS releases faster. Companies with a large Mac share or advanced Mac requirements often keep a dedicated Apple MDM.

Do I need Apple Business Manager to use an MDM?

No, but you need it for zero-touch. Without Apple Business Manager, Apple devices can only be enrolled manually by the user, and the MDM profile can be removed more easily. With it, devices purchased through an authorised channel enroll automatically on first boot.

How long does it take to deploy an MDM?

For a company of 100 to 300 devices, plan two to four weeks: a few days for prerequisites such as Apple Business Manager validation, one week of pilot, then one to two weeks to enroll the existing fleet. New devices enrolled through zero-touch are ready on first boot.

Can an employer see personal data through an MDM?

On a company-owned device, the MDM sees device information such as model, OS version, installed apps and compliance status, not personal messages or photos. On a personal device enrolled through BYOD user enrollment, the company only manages a separate work space. Employees should be told in writing what is collected.

Conclusion

The right MDM is the one that matches your device mix, your identity provider and the time your team can give it: Intune for Windows-first fleets in Microsoft 365, Jamf or Kandji (Iru) for Apple-first fleets, Workspace ONE for large multi-OS estates. Prepare the prerequisites before choosing, pilot before enrolling everyone, and plan the yearly upkeep from the start.