Two ways to run the same system
An MDM (Mobile Device Management) system has two halves: an agent on each device and a server with a management console. The agent enforces policies and reports back. The server stores the device list, the policies and the reports, and sends commands. If you are new to this model, how MDM works explains it step by step.
The device side looks the same in both deployment models. The difference is where the server half runs:
- Cloud (SaaS): the vendor hosts the server. You open the console in a browser, devices connect over the internet, and the vendor handles hosting, backups and updates.
- On-premises: the server runs in your own data center or private cloud. Your team, or a partner, installs it, operates it and decides who can reach it.
Neither is better in general. Each one fits a different set of constraints.
Side-by-side comparison
| Topic | Cloud MDM | On-premises MDM |
|---|---|---|
| Start-up time | Hours to days. An account is created and devices can be enrolled. | Days to weeks. Servers, network rules, certificates and installation must be prepared. |
| Up-front cost | None or low. You pay per device per month or year. | Servers, operating system and database licences, installation work. Often an installation fee. |
| Running cost | Included in the subscription. | Your staff time for patching, backups, monitoring and capacity. |
| Control | The vendor controls the infrastructure. You control the configuration. | You control everything: hardware, network, access, backup schedule. |
| Data residency | Data is stored where the vendor hosts it. Ask which country and which provider. | Data stays in your own facility. |
| Maintenance | Done by the vendor. | Done by your team or a support partner. |
| Updates | Applied by the vendor, usually without any action from you. | You decide when to install new versions, after your own testing. |
| Closed networks | Not possible. Devices and admins need to reach the vendor over the internet. | Possible if the product supports it. Devices never leave the internal network. |
| Scaling | The vendor adds capacity. | You add servers as the fleet grows. |
| Integration with internal systems | Needs network access from the cloud to systems such as your directory, often through a VPN or a connector. | Direct access to internal systems such as LDAP directories. |
Cost: look at the total, not the licence
Cloud pricing is easy to read: a fee per device, per month or per year. On-premises pricing has more parts. The licence is often similar, but you also pay for:
- servers or virtual machines, and the storage for logs and reports
- operating system, database and backup software
- installation and initial configuration
- the hours your team spends on updates, monitoring and incidents
For a fleet of a few hundred devices, these extras can be larger than the licence itself. For tens of thousands of devices run for many years, they become a smaller share. When you compare offers, ask each vendor for a full cost over three to five years, not only the price per device.
Control and data residency
With cloud MDM, the vendor runs the infrastructure and you configure the service. Ask the vendor where the servers are, which hosting provider they use, who on their side can access customer data and how backups are protected. These answers matter for your data protection documents.
With on-premises MDM, device data never leaves your facility. Inventory, locations, logs and screen sessions are stored on servers your team controls. For organizations that must keep data in a specific country or inside a specific network, this is often the deciding point. Our guide to MDM and data protection covers the legal side in more detail.
Maintenance and updates
Cloud services are updated by the vendor. You get fixes and new features without planning, but you also get them on the vendor’s schedule.
On-premises gives you the choice. You can test a new version in a staging environment before it reaches production, and you can delay an update during a busy period. The flip side is that someone has to do this work. If nobody owns the server, updates slip and security fixes arrive late.
A practical rule: choose on-premises only if a named team will own the server, its backups and its updates.
Closed and isolated networks
Some devices never touch the internet. Police and military radios, devices in secure facilities, and handhelds on isolated industrial networks all fall into this group.
In a closed network, cloud MDM is not an option. The on-premises product must also work without any outside dependency. Check three things:
- The device agent can be installed and enrolled without a public app store.
- Commands reach devices through the MDM’s own connection, not through a public push notification service.
- App updates can be distributed from inside the network.
If any of these depends on an outside service, the system will only work partly in a closed network.
Who should choose which
Choose cloud if:
- you want to start quickly and have no staff to run servers
- your devices already use the internet, such as field sales, retail or logistics fleets
- no rule requires device data to stay inside your own facility
- you prefer a predictable monthly or yearly cost
Choose on-premises if:
- your devices work in a closed or isolated network
- regulation, a contract or internal policy requires data to stay in your own data center
- you need direct integration with internal systems that cannot be exposed to the internet
- you have, or will contract, a team to operate the server
Typical on-premises buyers are defense, security and public sector organizations, and companies with industrial networks. You can read more in our pages for defense and security and government organizations.
Questions to ask any vendor
- Is the product the same in cloud and on-premises, feature for feature?
- In the cloud, where is the data stored and who can access it?
- On-premises, what are the hardware and software requirements?
- Does the on-premises version work with no internet connection at all?
- How are updates delivered on-premises, and how often?
- Can we move from one model to the other later, and what does that involve?
Our MDM buying checklist has more questions like these.
How DeepManage does it
DeepManage offers both models with the same product. In the cloud, Infoline hosts the system and each customer gets its own address, such as yourorg.deepmanage.com. On-premises, DeepManage is installed in your network and works in closed networks without internet access.
Both models include every feature. The cloud has a per-device monthly price; on-premises is quoted per request and covers device licenses and installation. See pricing for details and deployment options for how each model is set up.