A
Agent
The app installed on each managed device that receives policies and commands from the MDM server and reports the device’s status back. On Android, the agent usually acts as the device’s DPC (Device Policy Controller). See how MDM works.
Allowlist and blocklist
An allowlist names the only apps or websites a device may use. A blocklist names the ones it may not use. Allowlists are stricter and are common on kiosk and dedicated devices. See app management.
Android Enterprise
Google’s framework for managing Android devices in organizations. It defines the management modes (fully managed device, work profile, dedicated device), the enrollment methods and the policies an MDM can apply. See what is Android Enterprise.
APK
Android Package, the file format used to install apps on Android. Organizations often distribute their own in-house apps as APK files through their MDM instead of a public store.
Attestation
A way for a server to verify that a device is genuine and has not been tampered with. Android key attestation uses keys stored in the device’s secure hardware, so the result is hard to fake. MDMs use it to check device integrity before trusting a device. See security and compliance.
B
BYOD (Bring Your Own Device)
An ownership model in which employees use their personal devices for work. On Android, BYOD is usually handled with a work profile so the organization manages only work apps and data. See work profile and BYOD.
C
Closed network
A network with no connection to the internet, also called an isolated or air-gapped network. An MDM used in a closed network must run on-premises and must not depend on outside services. See cloud vs on-premises MDM.
COBO (Corporate-Owned, Business-Only)
An ownership model in which the organization owns the device and it is used only for work. The device is fully managed. See device ownership models.
Compliance policy
A set of conditions a device must meet, such as a minimum OS version, an active screen lock or an unmodified system. When a device falls out of compliance, the MDM can alert an admin or act automatically, for example by locking the device.
Console
The web interface admins use to manage devices, policies, apps and reports. It runs on the MDM server, either in the vendor’s cloud or on-premises.
COPE (Corporate-Owned, Personally Enabled)
An ownership model in which the organization owns the device but allows personal use. On recent Android versions, COPE devices have a work profile, and the organization manages the work side and some device-wide settings.
COSU (Corporate-Owned, Single-Use)
The older name for a dedicated device: a company device locked to one purpose, such as a kiosk, a scanner or a vehicle tablet. See kiosk and dedicated devices.
CYOD (Choose Your Own Device)
An ownership model in which employees pick a device from a list the organization approves and pays for. Management is usually the same as for COBO or COPE devices.
D
Data controller
The organization that decides why and how personal data is processed. An employer that manages employee devices is the data controller for the data the MDM collects. See MDM and data protection.
Data minimisation
The data protection principle that you collect only the personal data you need for a stated purpose. In MDM terms, it means switching off data collection, such as location, where it is not needed.
Data processor
An organization that processes personal data on behalf of a data controller. A cloud MDM vendor that hosts customer data is usually a data processor.
Data residency
The physical location, usually the country, where data is stored. Some laws, contracts and policies require data to stay in a specific country or facility.
Device Admin API
Android’s original management interface. It is deprecated for enterprise use, and modern MDMs use the Android Enterprise modes (Device Owner and Profile Owner) instead.
Device Owner
The Android Enterprise mode in which the management app controls the whole device. It is set during setup on a new or factory-reset device and is used for company-owned and dedicated devices.
DPC (Device Policy Controller)
The app on an Android device that applies the organization’s policies through Android’s management interfaces. It runs as Device Owner or Profile Owner. In most MDM products the agent is the DPC.
E
EMM (Enterprise Mobility Management)
A broader category than MDM that adds management of apps, content and identity on mobile devices. See MDM vs EMM vs UEM.
Enrollment
The process of registering a device with an MDM so it can be managed. Enrollment installs or activates the agent and applies the first policies. See device enrollment.
F
Factory reset protection (FRP)
An Android feature that, after an unauthorized factory reset, asks for a previously signed-in account before the device can be used again. Organizations can set which accounts are allowed to unlock their devices, so a stolen device cannot simply be reset and reused.
G
GDPR
The European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), applied since May 2018. It governs how personal data of people in the EU is processed, including data collected from managed devices.
Geofence
A virtual boundary drawn on a map. An MDM can record or act when a device enters or leaves the area, for example sending an alert or applying a different policy. See location and geofencing.
K
Kiosk mode
A mode that locks a device to one app or a small set of approved apps and hides system settings. Used on self-service screens, handhelds and classroom tablets. See what is kiosk mode and kiosk mode.
KVKK
Türkiye’s Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, Law No. 6698), in force since 2016. It applies to personal data processed by organizations in Türkiye, including data from employee devices. See MDM and data protection.
L
LDAP
Lightweight Directory Access Protocol, a standard way to read user accounts and groups from a directory. MDMs use it to sync users and let admins sign in with their directory accounts. See identity and integrations.
Live control
Viewing a device’s screen in real time and, where allowed, operating it remotely. Help desks use it to solve problems without collecting the device. See live control.
Lock task mode
The Android feature behind kiosk mode. The device policy controller allows specific apps to run in lock task mode, and the user cannot leave them. It is normally used on devices where the agent is Device Owner.
Logcat and bug report
Logcat is Android’s system log, and a bug report is a larger package of logs and diagnostics. Collecting them remotely helps developers and support teams find the cause of app crashes.
M
MAM (Mobile Application Management)
Management of specific apps and their data rather than the whole device. It covers distribution, configuration, updates and data protection inside apps.
Managed Google Play
The enterprise version of the Google Play Store. Admins approve which public and private apps users can install, and the MDM can install them silently.
MCM (Mobile Content Management)
Delivering documents, forms and files to devices in a controlled way. See content management.
MDM (Mobile Device Management)
Software that lets an organization enroll, configure, secure and support mobile devices from a central console. See what is MDM.
Multi-tenancy
An architecture in which one MDM installation serves several separate organizations or units, each seeing only its own devices and settings. Useful for groups of companies and service providers.
N
NFC provisioning
An enrollment method for factory-reset devices in which the setup data is sent by touching the new device with a second device over NFC. Support depends on the Android version and device model.
O
On-premises
A deployment in which the MDM server runs in the customer’s own data center or private cloud. It keeps data inside the organization and allows use in closed networks. See deployment options.
OTA update
Over-the-air update: a software or system update delivered over the network instead of by cable. MDMs can schedule or postpone OS updates to avoid disruption.
P
PKI (Public Key Infrastructure)
The system of certificates and certificate authorities used to prove identity and encrypt traffic. MDMs distribute certificates for Wi-Fi, VPN and app authentication.
Policy
A set of settings and restrictions applied to a device or group, such as password rules, disabled camera or allowed apps. See policies.
Profile Owner
The Android Enterprise mode in which the management app controls only a work profile, not the whole device. Used for BYOD and COPE devices.
Push notification
A message sent from a server to a device without the device asking for it. MDMs use push to wake the agent so it can fetch new commands, and to send messages to users. See messaging.
Q
QR code enrollment
An enrollment method for new or factory-reset devices: the setup wizard scans a QR code that contains the MDM’s details, then downloads and configures the agent automatically.
R
RBAC (Role-Based Access Control)
A way of granting console permissions by role, such as help desk, regional admin or auditor. Each admin sees and does only what their role allows.
Remote wipe
Erasing data on a device from the console, usually when it is lost or stolen. A full wipe returns the device to factory settings.
REST API
A web interface other systems use to read data from and send commands to the MDM, for example from a help desk or asset management tool.
Rugged device
A phone, tablet or handheld built to survive drops, water, dust and extreme temperatures. Common in logistics, utilities, mining and field work. See embedded and rugged devices.
S
SaaS (Software as a Service)
A delivery model in which the vendor hosts the software and customers use it over the internet for a subscription. Cloud MDM is SaaS.
Selective wipe
Erasing only work data, such as the work profile, while leaving personal data untouched. Used on personal devices when an employee leaves.
Silent installation
Installing or updating an app without asking the user to confirm. On Android this requires management rights, such as Device Owner, or installation through Managed Google Play.
U
UEM (Unified Endpoint Management)
Management of mobile devices, laptops, desktops and other endpoints from one console. See MDM vs EMM vs UEM.
Userless enrollment
Enrolling a device without assigning it to a named user. Common for shared and dedicated devices such as kiosks or shift handhelds. See shared devices.
V
VPN (Virtual Private Network)
An encrypted tunnel between a device and the organization’s network. An MDM can configure a VPN and, on Android, make it always on so work traffic never goes out unprotected.
W
Work profile
A separate area on an Android device for work apps and data, managed by the organization while the personal side stays private. See work profile and BYOD.
Z
Zero-touch enrollment
An Android enrollment method for company-owned devices. Devices bought from participating resellers are assigned to the organization in advance and enroll in the MDM automatically when first switched on. See device enrollment.