Skip to content

MDM Solution Comparison

Evaluated across the seven-pillar Amaris framework, plus an AI & Intelligence pillar we added. 8 vendors, checked against 2026 list pricing.

Calculate ROI

Already down to two? Every pair is priced and scored head to head.

E3 Attribution
$2.00/user/mo
Forrester TEI
Standalone Plan 1
$8.00/user/mo
Without M365 bundle
Intune Suite
$18.00/user/mo
Plan 1 + all add-ons
+ Defender P2
+$5.20/user/mo
For full EDR
Add Entra ID P1/P2 ($6-$9/mo) and Defender ($3-$8.40/mo) for comparable security coverage to Jamf for Mac bundle ($12.50).

Pillar 1: Apple Integration Depth

Granular Apple deployment, new feature adoption, and ecosystem integration depth

Scored on
  • Granular Apple deployment and new specific features
  • New features cycle and beta testing
  • Innovation and extended features
  • Integration with Apple's GitHub (device management)
  • Support for Apple services (Managed Apple Accounts)
  • Enrolment methods
Feature
Apple BusinessFree
Apple built-in
Jamf ProTop Apple score
Apple Enterprise
Iru
Modern UEM
Intune
Microsoft UEM
MosyleLow Cost
Apple-focused
Workspace ONE
Omnissa UEM
Addigy
MSP / SMB
Fleet
Open Source
Monthly feature & settings updatesFrequency of new MDM feature releases and Apple setting supportIntune: quarterly plan, not all Apple settings implemented
DDM (Declarative Device Management)Support for Apple's modern declarative management protocol
Beta program for new featuresPre-release testing of new MDM capabilities
Apple GitHub device management integrationBlueprints integrated with Apple's device management repo
Return to ServiceRemote wipe and re-enrollment without physical accessIntune: to be implemented
Managed Apple Accounts supportSupport for Apple services including Managed Apple Accounts
Enrollment methods (ADE + ADUE)Automated Device Enrollment and Account-Driven User Enrollment
Day-0 macOS supportSame-day support for new Apple OS releases
Full support
Partial / limited
Not available
Highlighted = notable gap

Start from free: Apple's built-in device management

New, April 2026

Apple Business merged Apple Business Manager, Business Essentials and Business Connect into one free console, and the per-device fee went with it. For a small Apple fleet that is a real answer, so treat it as the baseline every paid platform below has to out-earn.

Show the detail

What it covers

  • Automated Device Enrolment: zero-touch, fully supervised setup for new or erased devices
  • Account-driven enrolment for BYOD and in-use devices: no wipe, work data separated via a Managed Apple Account
  • Blueprints: preconfigured settings and apps applied at first boot, and reapplied automatically on device replacement
  • Managed Apple Accounts, federated with Entra ID or Google Workspace
  • App and Book (VPP) distribution through Blueprints
  • Core restrictions and DDM-based configuration profiles
  • Activation Lock, remote lock and wipe, on supervised (ADE) devices only
  • External Management: link a paid MDM (Jamf, Mosyle, etc.) alongside Apple Business. Device assignment stays here, day-2 management moves to the paid platform

Where it stops

  • No managed app configuration (AppConfig), so users configure each app by hand
  • No email account payloads (Exchange, Gmail, IMAP)
  • No third-party patch management or app catalogue
  • No scripting, custom reporting or public management API
  • No CIS/NIST benchmark tooling or automated remediation
  • Locate, lock and erase need supervised (ADE) enrolment, which BYOD accounts do not get

Apple publishes no device-count limit for this service. IT consultancies that support Apple fleets (Dr Logic, Iru) independently report real gaps starting to bite somewhere around 30 to 50 devices: app configuration, third-party patching, compliance reporting. That is their field estimate, not an Apple-stated ceiling.

Free isn't zero-effort: where Amaris fits

  • Business verification: DUNS number, or since April 2026 a Federal EIN plus one supporting document. Apple's review runs about 5 business days
  • Managed Apple Account rollout and identity federation (Entra ID / Google Workspace)
  • Blueprints: building the app + configuration bundles new devices boot into
  • If a paid MDM stays in the picture: External Management certificate upload (250-cert limit) and the annual token renewal Apple doesn't proactively warn about

Amaris scopes and runs this setup as a fixed-fee engagement, verification through to a working Blueprint, then hands off a baseline the client owns. For fleets that will outgrow the free tier, a paid MDM is layered in through External Management from day one.

Sources: Apple Newsroom, "Introducing Apple Business" (24 Mar 2026) · Apple Support, "Intro to Apple Business", "Enrollment methods for built-in device management", "Manage the built-in device management service", "Link to an external device management service" (all 14 Apr 2026) · Der Flounder, "DUNS number no longer required" (15 Apr 2026) · Dr Logic, "Apple Business Now Includes Free MDM" (28 Apr 2026). Capabilities not documented by Apple are scored as absent in the matrix below.

Switching MDM vendors got faster in iOS 26 and macOS 26

Moving a fleet between MDMs has always meant wiping every device. Apple shipped a no-wipe path in the iOS 26, iPadOS 26 and macOS 26 generation, so a migration that used to be a multi-week re-enrollment project can be a scheduled cutover instead.

Show the detail
  1. 1

    Admin starts the migration

    In Apple Business (or classic ABM), the admin reassigns already-enrolled devices to the new MDM server and optionally sets a completion deadline of between 1 and 90 days, editable and cancellable.

  2. 2

    New MDM stages configuration ahead of cutover

    Policies and profiles do not carry over automatically. The admin recreates them in the new MDM before cutover. Apps survive the switch only if the new MDM delivers them before the device checks in.

  3. 3

    Device gets a single prompt, not a wipe

    iPhone / iPad: a restart. Mac: a non-dismissible full-screen prompt. No factory reset, no user re-enrollment step, no "erase all content". The device stays supervised throughout.

  4. 4

    Device checks in to the new MDM

    Offline devices get prompted the next time they come online; escalating reminders (24-hour, then hourly) fire as the deadline approaches.

Requirements

  • Devices on iOS 26, iPadOS 26 or macOS 26 or later
  • Organization-owned, enrolled via Automated Device Enrollment (ADE)
  • macOS 26+ also supports unenrolling from ADE and re-enrolling profile-based

Where it doesn't apply

  • Doesn't apply to Apple Business's own built-in MDM: this path is vendor-to-vendor only, not a way in or out of the free tier
  • Shared iPad is unsupported
  • Apple Configurator-enrolled devices must clear a 30-day provisional period first
  • Policies, profiles and compliance state are not carried over, only enrollment and optionally apps

Amaris plans and runs MDM-to-MDM migrations on this path where a fleet is eligible: policies rebuilt in the new MDM ahead of time, a scoped cutover window, no fleet-wide wipe.

Sources: Apple Support, "Migrate devices to a new management service in Apple Business" (14 Apr 2026) · Apple Support, "Migrate managed devices to another device management service" (28 Jan 2026) · SimpleMDM, "Apple streamlines MDM migrations in iOS 26 and macOS 26" (3 Jul 2025, WWDC25) · Miradore migration guide (7 May 2026).

Decision Factors

Key considerations when selecting an MDM solution

Apple-Centric Organizations

Heavily Apple-centric organizations are likely to benefit from a specialist MDM. These solutions provide access to cutting-edge Apple features earlier, offer more detailed control, and deliver faster updates for new OS releases.

Jamf Pro, Mosyle, or Iru

Existing Microsoft Infrastructure

Organizations with EntraID, Microsoft 365, or Intune already in place can gain efficiencies from reusing identity, license, and compliance tools. Intune may be sufficient for many Apple management needs if some compromises are acceptable.

Microsoft Intune (with caveats)

SMB & Cost-Conscious Teams

For smaller to medium teams where ease of setup, lower admin overhead, and cost predictability are important, lightweight Apple-focused tools provide a better return on investment.

Mosyle or Iru (Kandji)

Security Benchmark Leaders

Iru (Kandji) and Jamf are leaders in built-in, turnkey CIS/benchmark workflows with pre-built control libraries and automated remediation. Jamf provides a mature Compliance Editor with CIS/NIST/DISA STIG mappings at scale.

Jamf Pro or Iru for compliance

AI-Forward IT Teams

Compare entitlement, not marketing. Copilot in Intune needs no Intune Suite licence and is included for Microsoft 365 E5/E7, but organisations below E5 provision Security Compute Units separately. Jamf's AI Assistant requires cloud-hosted Jamf Pro, and its AI Governance module sits in the Jamf for Mac plan. Iru and Mosyle include their assistants outright. Ask each vendor which plan the AI actually ships in.

Match the AI tier to the licence you already own

MDM Selection Guide

Key questions to evaluate MDM solutions for your organization

  • 1
    How deeply does the MDM integrate with Apple's latest management frameworks and APIs?
  • 2
    How important is security compliance and audit readiness for our organization?
  • 3
    How much control and visibility do administrators require?
  • 4
    Which activities consume the most time for your administrators and support team?
  • 5
    What is our desired balance between cost, complexity, and support quality?
  • 1
    Is your deployment model one-to-one, shared (non-personalized) or a combination?
  • 2
    Is bring-your-own-device (BYOD) deployment an option for your users?
  • 3
    Do you need to manage devices locally, nationally or internationally?
  • 4
    What type of applications do you plan to deploy: App Store apps, custom apps, third-party apps or a combination?
  • 5
    Do you want to offer a custom catalog for users to deploy content such as apps and documents?
  • 6
    Do you plan to use a vendor's API to build internal tools, scripts or automations?
  • 7
    Do you require separate, role-based access to a management console?
  • 8
    For education: do you need Apple School Manager rosters and education profiles for student and teacher tools?
  • 1
    Do you require management of a mixed device environment?
  • 2
    Does the vendor provide robust support for macOS, in addition to the MDM framework?
  • 3
    How many devices do you currently manage, and what is your projected device growth?
  • 4
    Does the MDM solution support management of other platforms?
  • 1
    Do you need to integrate your current directory service with the MDM solution?
  • 2
    Do you need to integrate certificates and identities with the MDM solution?
  • 3
    Do you plan to provide a single sign-on (SSO) option to users and administrators?
  • 4
    Is your current identity provider supported by the MDM solution?
  • 5
    Is your current certificate distribution mechanism supported by the MDM solution?
  • 6
    Is your user authentication system available only on-premises?
  • 7
    How many users does your organization have?
  • 1
    Do you require an on-premises or self-hosted solution?
  • 2
    Do you need to comply with geographical data and privacy regulations?
  • 3
    Do you have devices that must remain offline?
  • 4
    Do you require support for endpoint security management solutions?
  • 5
    Do you need integration with internal networks that utilize proxies or VPNs?
  • 6
    Do you need to mandate app and software updates for the latest security patches?
  • 7
    Do you need to block specific processes and applications?
  • 1
    Do your admins want natural-language search and AI-assisted configuration, or is the console workflow enough?
  • 2
    Which plan does the AI actually ship in: base licence, a higher tier, or a separate entitlement (Security Compute Units below M365 E5, Jamf for Mac for AI Governance, Omnissa Experience Management)?
  • 3
    Where is admin and device data processed when AI features are enabled, and does that satisfy your data-residency and privacy requirements?
  • 4
    Do you need to manage Apple Intelligence, Genmoji, and Writing Tools availability on employee devices, and how fast does the vendor ship new Apple AI restriction keys?
  • 5
    Do you need visibility into or control over ChatGPT and other GenAI tools used on managed devices (shadow AI)?
  • 6
    Can AI-generated scripts and policies be reviewed and approved before they touch production devices?