UEM adds the laptop: only 5 of 12 tools document Apple's DDM updates

01Beyond MDM means the laptop, and the Mac splits the field

MDM was built for phones and tablets; UEM manages those and the Windows, macOS and sometimes Linux machines under one policy engine. In 2026 the acronyms blur, so TechBag’s guide judges each product by what it documents. Seven of the 12 manage Windows. Six do it properly, with Entra join, Autopilot and Win32 packaging: Intune, Scalefusion, Hexnode, 42Gears, ManageEngine Endpoint Central and Miradore. Jamf’s three products, Seqrite mSuite and NinjaOne’s MDM module do not manage Windows at all.¹

What the laptop brings is a different set of jobs. A phone is configured and wiped; a laptop is also patched, has software packaged and deployed to it, has its disk encryption key escrowed, and is joined to a directory. Those jobs are where scope creeps, which is why the guide draws a hard boundary around the category: UEM is not endpoint security, not remote monitoring and management, and not identity. Several products bolt those on, and the bolt-on is a decision, not a bonus. A suite that adds an antivirus engine may be exactly right, or may be two average tools where you wanted one good one.¹ Our companion piece on phones, MDM and endpoint security, counts which endpoint products cover the phone half.

The Mac is the sharper test, because every vendor ticks the macOS box and the box means four different things. The guide sorts eleven of the products into four tiers by what their own documentation shows: declarative updates, FileVault key escrow, package deployment, scripting and supervision on Apple silicon.¹

02Apple moved updates to DDM, and 5 of 12 document it

Declarative device management replaces the old command-and-poll model: the device applies its settings and reports its own state. For a long time it ran beside legacy MDM. For software updates, that period is over. Microsoft told Intune administrators on 11 September 2026 that Apple ended support for the legacy MDM software-update commands with its 26 releases and removed them with the 27 releases, and that devices whose update policies are not moved to DDM may fail to update.²

For a fleet of phones this matters less than it sounds; for a fleet with Macs and supervised iPads it is the single question to put first. The five products with no documented DDM are not all equal: Seqrite mSuite has no Mac at all, and Jamf Now is deliberately shallow. But a buyer with Macs should ask every vendor, in writing, whether macOS and iOS updates are enforced through DDM today, and from which operating-system version.¹

03You may already own one, and the fleet shape sets the price

Before choosing a UEM, check the licences you already pay for. Intune Plan 1 is included in Microsoft 365 Business Premium, E3, E5, F1, F3 and EMS; it is in no Office 365 plan. Standalone it lists at US$8 a user a month, with Plan 2 at US$4 more and the Intune Suite at US$10 more. Apple Business, which consolidated Apple Business Manager and Business Essentials, has shipped a free built-in MDM since 14 April 2026. Google Workspace includes basic endpoint management in every edition and advanced management from Business Plus.¹

Where you do buy, two pricing models meet. Most of the category charges per device, US$1.33 to US$6 a month on published lists; Microsoft charges per user, for any number of devices. Which is cheaper depends on how many devices each person carries.¹

Read the chart from the left. A company where each person has one laptop pays US$3 a user on a per-device product and US$8 on standalone Intune, so the per-device product wins easily. Give the same person a phone and the gap narrows to US$2; add a tablet and the per-device bill passes Intune’s. Count devices per user before comparing quotes, because the cheaper model is decided by the shape of your fleet, not by the vendor. And if the Microsoft 365 plan already includes Intune, its marginal cost is zero and the comparison is between zero and something.¹

The free options have ceilings. Apple Business stops at advanced app management, complex configuration and certificates, and anything that is not Apple. Conditional Access and Windows automatic enrolment need Entra ID P1, which the Microsoft 365 bundles include and a standalone Intune buyer pays for separately, at US$6 a user a month.¹

04Switching means re-enrolling, and some devices need a wipe

The 2024 post promised that UEM would replace a hodgepodge of tools with one platform. It does, but leaving that platform later is not a configuration export: enrolment binds each device to one management authority, so changing vendor means re-enrolling the fleet. Whether that needs a wipe depends on how each device was enrolled.¹

That is why the first purchase matters more than the renewal. Buying phones and Macs through a channel that registers them to your Apple Business or zero-touch account at the time of sale is what keeps a future switch cheap.¹ Scale makes the switch harder still. The guide’s thresholds are blunt: past about 500 devices manual enrolment stops scaling, past 2,000 compliance reporting starts to lag, and at 10,000 the console’s search, bulk actions and API limits become the constraint. Put a bulk action on 1,000 devices and a full inventory pull through the API into the trial, not the demo.¹