Every device, every policy, one console
Enrollment, configuration, compliance posture, and remote wipe — across iOS, Android, macOS, and Windows — wired into the same IAM and EDR data model as the rest of the platform.
What is Mobile Device Management (MDM) for Security Teams?
Mobile Device Management (MDM) is a control plane for enrolling, configuring, and securing the devices employees use to access company data. The Threatstealth MDM supports Apple Business Manager (DEP), Android Enterprise, Windows Autopilot, and macOS — pushing configuration profiles, certificates, and app installs, and continuously evaluating each device against your compliance posture.
Why MDM as a standalone tool keeps failing
- Jamf, Intune, Workspace ONE each cover a slice — not the full fleet
- MDM data lives apart from IAM — you can't gate SSO on device posture
- MSSPs juggle separate MDM consoles per client, multiplying operator load
- Compliance auditors want device-posture evidence; manual screenshots don't scale
A four-step operational model
Enroll any device
Apple ABM/DEP, Android Enterprise, Windows Autopilot, and BYOD via QR enrollment — same workflow regardless of OS.
- Apple ABM/DEP
- Android Enterprise
- Windows Autopilot
- BYOD QR enrollment
Policy as code
Configuration profiles, certs, Wi-Fi, VPN, and restrictions defined as YAML and version-controlled. Push changes per group or per tenant.
- YAML-defined profiles
- Per-tenant scoping
- Audit-trail every push
Continuous compliance posture
Every device is scored against your baseline (disk encryption, OS patch, screen lock, jailbreak/root). Posture flows into IAM for conditional access.
- Encryption + OS-patch checks
- Jailbreak/root detection
- Posture → IAM conditional access
Remote actions
Lock, wipe, locate, or reset a device from the incident view — with full audit trail and dual approval for destructive actions.
- Remote lock + wipe
- Selective wipe (BYOD)
- Dual-approval for destructive actions
Outcomes for security teams
Gate SSO on device posture
Because MDM and IAM share a data model, you can require an enrolled, encrypted, patched device before allowing SSO into Salesforce, GitHub, or AWS.
Continuous evidence for SOC 2 / ISO 27001
Device posture is collected continuously and exported as auditor-ready evidence — no end-of-quarter screenshot scramble.
MSSP-friendly multi-tenancy
Operate every client's fleet from one console with strict tenant isolation — no need to log into 30 separate Jamf consoles.
Direct answers
Does it support BYOD?+
Yes. BYOD devices enroll via QR code and only the work profile is managed. Selective wipe removes corporate data without touching personal apps or photos.
Can it replace Intune or Jamf?+
For most fleets, yes. Apple ABM/DEP, Android Enterprise, and Windows Autopilot are first-class — and the per-tenant model and IAM integration are advantages over the single-tenant incumbents.
How does MDM connect to IAM?+
Each device's posture (encrypted, patched, enrolled, jailbroken) is pushed to the IAM module in real time. SSO policies can require posture pass to grant access.
Is jailbreak/root detection reliable?+
We use multi-signal detection (system property checks, binary presence, integrity attestation) — not a single check that's easy to bypass.