Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Objective 1.3 (MDM)

Quick reference: the short version of this lesson is the Mobile Device Management cheat sheet, part of Section 1.

Learning objectives

By the end of these notes you should be able to:

Explain what a mobile device manager (MDM) is and why organisations need one.
Compare the BYOD, COPE and CYOD ownership models, and choose one for a scenario.
Explain how partitioning keeps corporate and personal data separate on one phone.
Describe the policies and restrictions an MDM can enforce.
Find device details such as platform, user and IMEI in an MDM console.
Configure over-the-air synchronisation: what syncs, over which network, and when.
Set up business app accounts with per-service synchronisation settings.
Explain the security benefits and privacy boundaries of MDM.

1. What an MDM is

1.1 The problem

An organisation may have hundreds or thousands of phones and tablets. Some are company-owned; others belong to employees. They’re outside the office, easily lost, and each needs the right apps, email settings and security. Configuring them one by one isn’t practical.

1.2 The solution

A mobile device manager (MDM) — also called mobile device management — is specialised software that lets administrators manage all mobile devices centrally, from one place.

An MDM lets you

Examples

Set rules and parameters for how devices are used

Allowed and forbidden apps

Enable or disable device features

Camera, GPS

Separate corporate and personal data

A partitioned work area on a personal phone

Enforce security policies

Screen locks with a PIN or other unlock method; multi-factor authentication

Push configuration

Corporate email settings, applications

See every device

Inventory with device, user and IMEI details

In short, an MDM can control almost every aspect of a managed mobile device.

2. Ownership models

2.1 BYOD — bring your own device

BYOD (also called bring your own technology) means the employee owns the phone and uses it for work too.

Benefit

Challenge

The employee carries only one device

Company data must be protected on a device the company doesn’t own

No hardware cost for the company

The user’s personal data must stay personal and private

Policies are needed for when the phone is upgraded, traded in or lost

The MDM defines which part of the device is home (private) and which is work, and how data in each is protected.

2.2 COPE — corporate owned, personally enabled

With COPE, some organisations don’t allow personal phones for work at all. Instead:

The company buys the phone.
The company assigns it to a user.
The company manages it as a corporate device, with complete control over every aspect of it.
Many organisations also let the user use it personally — the “personally enabled” part.

It’s managed much like company laptops and desktops. The company decides what’s stored on the device, how it’s stored, and what happens to the data if the device is replaced or lost.

2.3 CYOD — choose your own device

CYOD adds flexibility: the company provides and manages the device, but the user chooses it from a selection of approved models.

2.4 Comparing the models

BYOD

COPE

CYOD

Who owns the device

Employee

Company

Who chooses it

Employee

Company

User picks from an approved list

Company control

Limited — the work partition

Complete

Complete (company-owned)

Personal use

Yes — it’s their phone

Often allowed

Key concern

Separating work and personal data; privacy

Cost of buying devices

Supporting several models

Note (beyond this lesson): a fourth model, COBO (corporate-owned, business only), allows no personal use at all. It’s common for high-security roles and shared devices.

2.5 Worked example — choosing a model

Scenario

Model

Reasoning

A small charity has no budget for phones; staff need work email on the phones they already have

BYOD

No hardware cost, with a work partition protecting the charity’s data

A bank needs complete control of every device that holds customer data

COPE (or COBO)

The company owns and fully manages the device

A firm wants control but staff complain about the one model on offer

CYOD

Staff choose from approved models while the company keeps ownership and control

3. Partitioning personal and corporate data

On a BYOD phone, the MDM creates a partitioned area for the organisation:

Corporate data stays in its own area, under company policy.
When the phone is upgraded, traded in, lost, or the employee leaves, the organisation can deal with its own data without touching the user’s personal data.

Note (beyond this lesson): this is often called containerisation. Removing just the corporate partition is a selective (corporate) wipe; erasing the whole device is a full wipe, used for company-owned devices.

4. What the MDM controls

4.1 Policies and security

Area

What administrators can do

Screen lock

Require one, unlocked with a PIN or another access method

Authentication

Require two-factor / multi-factor authentication, and specify which type

Applications

Allow specific apps, forbid others, and push apps for automatic installation

Device features

Enable or disable features such as the camera and GPS

Corporate email

Configure settings centrally and push them to every phone

The pay-off from central email configuration: the user turns on their phone and their inbox simply works. They don’t have to enter any server settings themselves.

4.2 Why extra security for mobiles?

Mobile devices live outside the company and are easily lost. So the security team often requires more on them than on office desktops — for example mandatory screen locks and multi-factor authentication.

5. The MDM console

5.1 The device inventory

The console lists every managed device. Typical columns:

Field

Shows

Device name

The phone’s name

Platform

e.g. iOS or Android

Username

Who the device is assigned to

Email and contact information

The user’s details

IMEI

The device’s unique identifier — the International Mobile Equipment Identity

5.2 Drilling into one device

Selecting a device shows its details — for example:

Model and OS: an Apple iPhone 13, and the exact iOS version.
Operating system details.
Device security options that are enabled or disabled.
A network summary of what it’s currently connected to.

5.3 The Restrictions tab

As the device’s manager, you can enable or disable features, such as:

Category

Examples

Camera and communication

The camera, FaceTime, voice dialling

Assistant

Siri

Other

Security options, printing options, application options

5.4 Worked example — a lost company phone

A user reports their COPE iPhone lost on a train.

Find the device in the MDM console by username.
Note its IMEI — the carrier can use it to identify and block the handset.
Check its details: the last network summary and whether its security options (screen lock, encryption) are enabled.
Act on it using the MDM, according to the company’s lost-device policy — the lesson stresses that the policy for lost devices must be decided in advance. (Beyond this lesson: this usually means a remote lock, then a remote wipe.)
Record everything in the ticket, and arrange a replacement. Synchronised data (section 6) restores onto it.

6. Over-the-air synchronisation

6.1 Why sync matters

Mobile devices are rarely plugged in to anything central, so synchronisation over the air is how their data is backed up — and how it’s restored if a device fails, is damaged or needs replacing.

6.2 What the MDM configures

Setting

Options

What’s always synced

Some items are preconfigured, such as phone information and messages

Email service

Differs by organisation — e.g. Gmail or Microsoft Outlook — so it’s set centrally

Network used

Wi-Fi only, or Wi-Fi and cellular

Data types

Choose individually: calendar, contacts and others

Timing

Different synchronisation behaviour at different times of day

Cellular limits

How much cellular data can be used, and for what

Automatic downloads

Whether they’re allowed over mobile data, and the maximum app size that can download over the mobile network

6.3 Cellular data and cost

Cellular data can be expensive. Many organisations sync only over 802.11 (Wi-Fi) or the local network to control cost. Mobile devices also have their own settings controlling how much cellular data can be used and for what.

Check the contract with the cellular provider: how much data is allowed, and at what times.

6.4 Worked example — designing a sync policy

Field engineers have phones on a plan with a small monthly data allowance.

Always sync: phone information and messages (preconfigured).
Email: configure the company’s service centrally, so it’s pushed to every phone.
Calendar and contacts: sync over any network — they’re small and time-sensitive.
Large data (backups, app downloads): Wi-Fi only.
Automatic downloads over cellular: limit them to small apps — or turn them off.
Confirm the plan’s allowance and any time-based terms in the provider contract.

Result: engineers always have current appointments and contacts, and the heavy data waits for Wi-Fi.

7. Business applications and accounts

7.1 Setting up accounts

Business services such as Outlook, other email, and cloud storage are usually set up in the device’s account settings. You provide:

a username;
a password, or another authentication factor.

7.2 Choosing what each service syncs

Each account has its own granular sync choices:

Data type

Example

Mail

The inbox and folders

Contacts

The address book

Calendars

Meetings and appointments

Reminders

Tasks

Notes

Settings can differ per service. For example, the Microsoft Exchange account might sync mail, contacts and calendars, while a Google Mail account syncs only mail.

7.3 Worked example — one phone, two accounts

A user needs their company Exchange account and a shared Google Mail account for a project.

Account

Sync

Reason

Microsoft Exchange (corporate)

Mail, contacts, calendars, reminders

The main work account

Google Mail (project)

Mail only

Avoids duplicate contacts and calendars

Both are added in the account settings, each with its own credentials and authentication factor.

8. Security perspective

MDM is the security backbone for mobile devices. Screen locks, MFA, app allow and deny lists, and feature restrictions (such as disabling the camera in sensitive areas) all come from central policy.
Plan for loss before it happens. Define in advance what happens to data when a device is lost, upgraded or traded in — then act quickly when it’s reported.
Keep a good inventory. Knowing every device, its user and its IMEI makes lost devices traceable and blockable.
Respect BYOD privacy. On a personal phone, the organisation manages the work partition, not the user’s private data. Clear policies build trust — and users should know what the MDM can see.
Sync is also a data-protection control. Over-the-air backup means a lost device doesn’t mean lost data.
Beyond this lesson: many MDMs also check compliance — for example flagging jailbroken or rooted devices, or out-of-date OS versions — and can block them from company data.

Summary

MDM = central management of company-owned and personal mobile devices: policies, restrictions, security and configuration from one place.
Ownership models:
- BYOD (bring your own device, or technology) — the employee owns it; work and personal data are partitioned.
- COPE (corporate owned, personally enabled) — the company buys, assigns and fully controls it; personal use is often allowed.
- CYOD (choose your own device) — the user picks from approved company devices.
Partitioning keeps corporate data separate from private data on personal phones.
Policies: screen locks with a PIN, MFA (and its type), app allow and deny lists with automatic installs, and control of the camera, GPS, FaceTime, voice dialling and Siri.
Central email configuration is pushed to devices, so the inbox just works.
The console shows device name, platform, user, contact details and the IMEI (unique identifier), plus OS, security and network details per device.
Over-the-air sync:
- It’s the device’s backup and restore.
- Choose Wi-Fi only or cellular too, which data types, and when.
- Limit cellular use and download sizes, and check the provider contract.
Business app accounts are set up in account settings with credentials. Choose mail, contacts, calendars, reminders and notes separately for each service.

Glossary

Term

Definition

MDM

Mobile device manager — central management of mobile devices

BYOD

Bring your own device — employees use their own devices for work

BYOT

Bring your own technology — another name for BYOD

COPE

Corporate owned, personally enabled — company device, personal use allowed

CYOD

Choose your own device — the user picks from approved company devices

COBO

Corporate owned, business only — no personal use (beyond this lesson)

Partition (work / personal)

Separate areas on one device for corporate and private data

Containerisation

Another term for isolating corporate data in its own area

Policy

A rule set by administrators and enforced on devices

Restriction

A setting that disables a device feature, e.g. camera or Siri

Screen lock

A lock requiring a PIN, password or biometric to unlock

Two-factor / multi-factor authentication

Push

Sending configuration or apps from the MDM to devices automatically

IMEI

International Mobile Equipment Identity — a phone’s unique hardware identifier

Over-the-air (OTA) sync

Synchronising data wirelessly, without cables

Cellular data

Mobile network data, often limited or charged by contract

Account settings

Where email and cloud services are added to a device

Microsoft Exchange

Microsoft’s corporate email, calendar and contacts service

Review questions

What does an MDM allow an administrator to do?
What does BYOD stand for, and what’s its alternative name?
Give one benefit and two challenges of BYOD.
What does COPE stand for, and who owns and controls the device?
How does CYOD differ from COPE?
How does an MDM protect both company data and user privacy on a personal phone?
Name two device features the lesson says an MDM can disable.
What screen-lock policy might an organisation enforce?
Why might security teams require MFA on mobile devices in particular?
Which field in the MDM console is the device’s unique identifier?
Name three settings on an MDM Restrictions tab.
Why is over-the-air synchronisation important for mobile devices?
An organisation’s cellular plan has a small data allowance. How should synchronisation be configured?
Can sync settings for a Microsoft Exchange account differ from a Google Mail account on the same phone? Give an example.

Answer key

Manage all mobile devices centrally: set policies, allow or forbid apps, enable or disable features, enforce security, and push configuration such as email.
Bring your own device; also called bring your own technology.
Benefit: the employee carries one device. Challenges (any two): protecting company data; keeping personal data private; deciding what happens to data on upgrade, trade-in or loss.
Corporate owned, personally enabled. The company owns the device and has complete control; personal use is often allowed.
With CYOD, the user chooses from a selection of approved devices; with COPE, the company chooses. Both are company-owned.
It partitions the device into a work area (managed, protected by policy) and a personal area (private to the user).
Any two of: camera, GPS (the restrictions tab also covers FaceTime, voice dialling and Siri).
A mandatory screen lock unlocked with a PIN (or other access method).
Mobile devices are used outside the company and are easily lost, so extra authentication protects company access.
The IMEI.
Any three of: camera, FaceTime, voice dialling, Siri, security options, printing options, application options.
Devices are rarely connected to a central facility, so over-the-air sync provides backup — and restore if the device fails, is damaged or is replaced.
Sync large data over Wi-Fi only; allow only small, essential data (e.g. calendar and contacts) over cellular; limit automatic downloads and app sizes over mobile; check the provider contract.
Yes. For example, Exchange syncs mail, contacts and calendars, while Google Mail syncs mail only.