- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Your shortlist was decided before you started shopping.
Where you bought the hardware set your enrolment options. The licences you already hold set your baseline. Who owns the devices set your architecture.
A retail-bought laptop cannot be zero-touch enrolled. Ever. No MDM you buy changes that.
Already decided — before you started shopping
Still yours to weigh
What UEM & MDM actually is
UEM and MDM are how an organisation enrolls, configures, secures and — if it has to — wipes the devices it owns or allows: phones, tablets, laptops, desktops. You install a management profile or agent, and from one console you push settings (Wi-Fi, VPN, passcode rules), deploy and remove apps, enforce OS updates and encryption, prove compliance, and lock or wipe a lost device.
MDM was born managing phones and tablets. UEM is the same idea widened to every endpoint — mobile and desktop — under one policy engine. In 2026 the labels blur; judge a product by its capability list, not its acronym.
One boundary to hold onto
UEM is not endpoint security, not RMM, and not identity. Several products bolt those on — and that bolt-on is a decision variable, not a bonus. A “UEM + EDR” suite may be exactly right, or may be two mediocre tools where you wanted one great one. Decide it deliberately.
Often confused withRMM & Patch — keeping devices working, patched and fixed at a distance →· Endpoint Protection — stopping, spotting and responding to what is trying to get in →
The full endpoint-management landscape — UEM, MDM, RMM, EPP and where each fits →
Narrow 12 products to your shortlist
Set what you know. Every product stays on the page — the ones that no longer qualify fade and say why; the ones we can’t verify at your scale are marked, never cut. Unset a chip and they come back.
India data residency
OS mix
Ownership model
Fleet size
The licence you already hold removes nothing — it changes the price. That lives under What it costs.
per device (Jamf publishes no list price)
Apple-heavy fleets that want the deepest macOS/iOS management there is.
The catch: Apple-only. No Windows MDM at all; Android is a separate Jamf-for-Mobile bundle, not Jamf Pro.
per device/mo (third-party; Jamf lists no price)
Very small Apple shops (under ~25 employees) that need basics, not automation.
The catch: Deliberately shallow: no DDM update enforcement, no scripting, no patch policies (those are Jamf Pro).
per device (education bundles)
Apple-only K-12 / education estates (Apple School Manager, Classroom).
The catch: Education-tuned and Apple-only; no Jamf-Pro-grade DDM / patch / scripting.
per user/mo (Plan 1; often $0 if bundled)
Microsoft-committed shops with a mixed Windows-heavy fleet.
The catch: macOS depth historically trails Jamf. And it is NOT in any Office 365 plan (Office 365 ≠ Microsoft 365).
per device/mo (10-device min; page fetch blocked — verify)
Mixed fleets and rugged/field Android, especially where India data-residency matters.
The catch: Vendor pricing page blocks automated reads; confirm current per-tier prices at quote time.
per device/mo (Pro tier; 15-device min)
Mixed fleets wanting broad multi-OS coverage at a low entry price.
The catch: No India data centre (US/EU/UAE). macOS DDM version floor + Apple-silicon specifics unconfirmed in docs.
per device/mo (Standard; bundles SureLock/SureFox)
Rugged/frontline Android + kiosk, with India/US/EU data-region choice or on-prem.
The catch: macOS DDM update floor is macOS 15+ (higher than peers). FileVault key-escrow wording unconfirmed.
per-endpoint editions (Free / Pro / Enterprise / UEM)
IT teams wanting UEM + patch + software deployment in one, with India DCs or on-prem.
The catch: Windows-enrollment specifics (Autopilot/Entra) and macOS DDM depth are datasheet-level, not doc-confirmed.
per device/mo (quote-only; 14-day trial)
Identity-first shops (miniOrange IAM/SSO heritage) adding device management.
The catch: A newer UEM: advanced macOS (FileVault escrow, DDM, Apple silicon) is not substantiated in public docs.
per device (quote-only)
India shops managing Android + iOS mobile only (Quick Heal / Seqrite estate).
The catch: Mobile-only — NO macOS and NO Windows. Apple ABM/ADE not evidenced (email/SMS enrollment only).
per device (add-on to the NinjaOne platform)
Teams already on NinjaOne RMM adding Apple/Android MDM in one console.
The catch: MDM is an add-on, not standalone; Windows/Linux are RMM-only (not in the MDM module); macOS apps are Apps-&-Books only (no .pkg).
per device/mo (Premium; $4.75 Premium+)
Mixed fleets wanting a genuinely free-to-start, four-OS MDM (incl. macOS .pkg deploy).
The catch: No documented DDM (classic MDM protocol); Finland-built / US-owned, no India data-residency confirmed.
Why each constraint rules out what it doesShow the reasoning ↓
India data residencyRules out Jamf Pro, Jamf Now, Jamf School, Microsoft Intune, Hexnode UEM, NinjaOne MDM and LogMeIn Miradore (GoTo) — no India data residency; miniOrange UEM — India HQ, but data residency unconfirmed. That leaves Scalefusion UEM, 42Gears SureMDM, ManageEngine Endpoint Central and Seqrite mSuite.
Mostly AppleRules out Jamf Now, miniOrange UEM and Seqrite mSuite — Apple management too shallow for an Apple-heavy fleet. That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, NinjaOne MDM and LogMeIn Miradore (GoTo).
Mostly AndroidRules out Jamf Pro, Jamf Now and Jamf School — no Android management. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM and LogMeIn Miradore (GoTo).
Windows in the fleetRules out Jamf Pro, Jamf Now and Jamf School — Apple-only; Seqrite mSuite and NinjaOne MDM — mobile-only, no desktop. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM and LogMeIn Miradore (GoTo).
A genuinely mixed fleetRules out Jamf Pro, Jamf Now and Jamf School — Apple only; Seqrite mSuite and NinjaOne MDM — mobile only, no desktop. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM and LogMeIn Miradore (GoTo).
Kiosk and dedicated devicesRules out Jamf Pro, Jamf Now and Jamf School — Apple-only, no Android dedicated (COSU) devices. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM and LogMeIn Miradore (GoTo).
Fleets of 10–200 devicesRules nothing out on published terms. It flags Jamf Pro — 25-device minimum on Jamf business plans and NinjaOne MDM — Platform minimum ~50 devices (~$200–250/mo floor) — marked on the cards, not removed.
Fleets of 200–2,000 devicesRules out Jamf Now — built for small shops (Jamf positions it for teams up to ~50 devices). That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM and LogMeIn Miradore (GoTo).
Fleets above 2,000 devicesRules out Jamf Now — built for small shops (Jamf positions it for teams up to ~50 devices). That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM and LogMeIn Miradore (GoTo). It flags miniOrange UEM — Unverified above 2,000 devices and LogMeIn Miradore (GoTo) — Unverified above 2,000 devices — marked on the cards, not removed.
Corporate-owned, fully managedRules nothing out. Every product here enrols corporate-owned devices in a fully managed state — Android device owner and/or Apple supervised via Automated Device Enrolment — so there is no eliminating power and no chip.
BYOD, personal devicesRules nothing out on verified documentation. Every Android-capable product supports the work profile, and Jamf Pro and Jamf School document Apple User Enrolment. Jamf Now's User Enrolment support is not documented either way, so it is not ruled out.
Mixed corporate and BYODRules nothing out: the same consoles run fully managed and work-profile or User Enrolment devices side by side.
Small-estate fit, beyond the published minimumsThe published floors are low — Hexnode 15 devices, Scalefusion 10, 42Gears none, ManageEngine free to 25 — so at 10–200 only NinjaOne's ~50-device platform minimum and Jamf Pro's 25-device minimum bite, and only at the bottom of the band. Where enterprise-tier pricing makes a product a poor fit for a small estate is delivery-team judgement: [TechBag to confirm].
Above 2,000 devices — what is and isn't provenSeqrite mSuite is proven at volume (Fino Payments Bank: 410 branches, 25,000+ banking points) and NinjaOne's platform runs estates of 100,000+ endpoints. miniOrange UEM and LogMeIn Miradore are marked unverified rather than ruled out: vendor claims of scale, no documented deployment at that volume. The tool stamps them, it does not eliminate them.
Eight situations, eight shortlists — with the reasoning
A bare recommendation converts nobody and gets cited by nothing — models quote explanations, not verdicts. So here’s the logic, not just the names.
All-Apple, 200–2,000 devices, dedicated IT
Why: Apple depth (DDM, FileVault escrow, patch, scripting) is the deciding variable; Jamf Pro is the benchmark.
The trade-off: Jamf is Apple-only and priced for it; if you also run Windows, Intune consolidates at the cost of some Mac depth.
Android field devices — retail, delivery, manufacturing, rugged
Why: Dedicated/COSU kiosk mode + rugged-OEM support + zero-touch are what matter; the India-built vendors lead here.
The trade-off: 42Gears/Scalefusion go deep on rugged/kiosk; if the fleet is also Apple-heavy, weigh macOS depth separately.
Mixed Windows + Apple + Android, existing Microsoft commitment
Why: If you hold M365 E3/E5/Business Premium, Intune is likely already paid for — marginal cost near zero.
The trade-off: Intune's macOS is good-not-Jamf; if Macs are your crown jewels, pair Intune (Win) with Jamf (Mac) or go Scalefusion.
BYOD-heavy, employees resist agents on personal phones
Why: Android work profile + Apple User Enrollment keep the personal side cryptographically untouched — no full device control.
The trade-off: MAM-without-enrollment protects apps only; if you need device compliance too, you need enrollment consent.
Kiosk / dedicated — signage, POS, self-service
Why: COSU/dedicated lock-down and single-app mode are the whole job; the rugged/kiosk specialists win.
The trade-off: Exiting Android dedicated/fully-managed requires a factory reset — plan provisioning accordingly (see enrollment).
Regulated sector, data residency or on-prem required
Why: Verified India data region and/or on-prem is the gating requirement before any feature comparison.
The trade-off: India-built vendors satisfy residency; confirm each vendor's exact hosting region and on-prem terms at quote.
Small team, no dedicated IT
Why: A genuine free/low tier and simplicity matter more than depth: Miradore (≤50 free), ManageEngine (≤25 free), Jamf Now (≤3 free, Apple).
The trade-off: Free tiers are capped and shallow; you'll outgrow them — but they prove the fit before you spend.
Devices already bought retail — the recovery path
Why: Zero-touch/ADE only works for devices bought through an approved channel. Retail units can't be zero-touch enrolled without a wipe.
The trade-off: Any UEM can still MANAGE them — you just lose zero-touch. Manual enrollment (or a wipe-and-reprovision) is the recovery path.
“Supports macOS” means four different things
Every vendor on this page ticks the macOS box. What you actually get ranges from Apple-grade management to a profile that barely enrols. This is the single sharpest discriminator for any fleet with Macs in it — and it never shows on a feature grid. Tiers below follow each vendor’s own documentation; where depth is claimed but not documented, we say so.
Tier 1
Apple-grade depth
DDM, FileVault key escrow, patch policies, scripting, supervision — the full Apple toolchain, built Apple-first.
Tier 2
Real Mac inside a multi-OS UEM
DDM documented; Apple silicon and ADE supervision handled. Each still has a named gap: Intune trails Jamf in depth; 42Gears’ DDM update floor is macOS 15+; NinjaOne deploys Mac apps only via Apps & Books (no .pkg).
Tier 3
Mac on the datasheet
Enrols, pushes profiles, manages the basics. DDM is partial or claimed rather than documented; version floors, FileVault wording and Apple-silicon specifics are unconfirmed. Miradore runs classic MDM (no DDM) but does deploy .pkg.
Tier 4
Mac in name only — or not at all
Jamf Now is deliberately shallow (no DDM update enforcement, no scripting, no patch). miniOrange’s advanced macOS is not substantiated in public docs. Seqrite mSuite has no macOS at all — mobile only.
Ask every vendor these five — the answers sort the tiers
Scale behaviour — 500, 2,000, 10,000 devices
Feature grids don’t change with fleet size. Consoles do. Three thresholds where a different thing becomes the constraint — and what to put in a PoC so you find it before you sign.
Process becomes the constraint
- —Manual enrolment stops scaling — zero-touch goes from nice-to-have to mandatory.
- —Policy sprawl begins: overlapping profiles with no clear precedence, so ‘which setting wins?’ becomes a daily question.
- —One admin is still ‘the person who knows the console.’ RBAC and a second admin become a control, not a luxury.
Put this in your PoC
Enrol 50 devices zero-touch in a day. Apply two deliberately conflicting policies and confirm which one wins.
Visibility becomes the constraint
- —Compliance dashboards and inventory lag — you’re reading yesterday’s state.
- —Dynamic / smart groups slow down and get brittle as criteria stack.
- —Change needs rings — pilot, then broad — never fleet-wide at once. Per-device tiers and minimums start to bite.
Put this in your PoC
Time a full compliance report. Push an app to a 200-device ring and measure time-to-90% installed.
The console itself is the constraint
- —Search, filters and bulk actions are now the bottleneck.
- —Delegated, scoped admin by region or business unit is mandatory; connector / gateway / CA capacity and API rate limits decide how fast you can move.
- —Migration without automation is effectively impossible — which is why the switching cost below is a scale problem first.
Put this in your PoC
Bulk-action 1,000 devices. Pull the full inventory through the API. Confirm region / residency sharding.
These are category-wide behaviours. Where a specific vendor’s console starts to strain: [TechBag to confirm] — TechBag tests this against your fleet size during scoping.
Enrollment architecture — where the shortlist is really set
Three platforms, each a distinct set of enrollment modes. The load-bearing fact: whether exiting a mode requires a factory reset is a hard technical boundary, not a policy choice — and it drives both onboarding and migration cost. All verified against Google/Apple/Microsoft docs.
Android Enterprise — four modes, one reset boundary
Device Owner · corporate
Fully managed
Corporate-owned, full control, work-only
Personal space
None
Kiosk · userless
Dedicated / COSU
Single-purpose — signage, POS, scanners (userless)
Personal space
None
Profile Owner · BYOD
Work profile
Personal device, separated work container
Personal space
Untouched, private
Work profile on company-owned
COPE
Corporate hardware + private personal space (Android 11+)
Personal space
Private container
*COPE can be released with the RELINQUISH_OWNERSHIP command — removes the work profile, preserves personal data, no reset. Fully-managed and dedicated can only be provisioned from a factory-reset state, so exiting them means a wipe.
Zero-touch enrollment — the mechanic that’s locked at purchase
You buy zero-touch devices from an approved reseller, who assigns them by serial/hardware ID to your account at fulfilment. Requires Android 9.0+ (7.0+ on Pixel) and work-profile support. It fires only on a device in factory-reset / first-boot state — an already-set-up or retail-bought device will not auto-enroll without a factory reset first. Consumer-store devices are never eligible. (developer.android.com / support.google.com)
Apple — supervised vs the modern protocol
Supervised vs unsupervised
Supervision means org-ownership and unlocks the serious controls — single-app mode, web-content filtering, disabling AirDrop, blocking user wipe, OS-update enforcement, removing built-in apps. Unsupervised gets only a baseline. In practice, serious corporate control ≈ supervised ≈ ADE (or a Configurator wipe).
Automated Device Enrollment (ADE)
The chain: buy from Apple / a linked Authorised Reseller / carrier → the purchase links to your Apple Business account → register your MDM server → assign the device → it enrolls during Setup Assistant, supervised, with a non-removable profile a user can’t undo.
Declarative Device Management (DDM) — a real discriminator
DDM replaces the old command-and-poll model with a device that applies settings and reports state on its own. Apple runs it alongside legacy MDM and it’s the forward direction — required for the newest features. Which vendors genuinely moved to DDM separates products more than any feature comparison (Jamf, Intune, Scalefusion, 42Gears, NinjaOne document it; Miradore and some others don’t).
“Apple Business” ships a built-in MDM (April 2026)
Apple consolidated Apple Business Manager, Business Essentials and Business Connect into Apple Business (available 14 April 2026) with a free built-in MDM: Managed Apple Accounts, Blueprints (zero-touch), App Store app distribution, an Admin API, IdP federation. Where it stops being enough: advanced app management, complex config/compliance/PKI, non-Apple platforms, and scale/automation depth — that’s where a dedicated UEM earns its price.
Windows — Autopilot, Entra join, co-management
Autopilot
Turns an OEM-imaged, out-of-box PC into a corporate, Intune-managed, Entra-joined device during OOBE. v1 needs the hardware hash (and is the only option for hybrid join); v2 (device preparation) needs no hash but is cloud-only.
Entra join
Cloud-native and recommended — identity only in Entra, no on-prem AD dependency. Hybrid Entra join keeps on-prem AD too, but needs line-of-sight to domain controllers and the Intune Connector. Microsoft explicitly recommends against hybrid for new devices — it’s a migration mode, not a target.
Co-management
Runs the ConfigMgr agent and Intune together, moving seven workloads (compliance, Windows Update, resource access, Endpoint Protection, device config, Office apps, app deployment) to Intune on a slider.
Which vendors do Windows PROPERLY (Entra + Autopilot + co-management + Win32 packaging) versus treating it as a thin “enroll + push a profile” afterthought is a real discriminator. Among TechBag’s list, Intune / Scalefusion / Hexnode / 42Gears / ManageEngine / Miradore do real Windows; Jamf, Seqrite and NinjaOne-MDM do not.
Migration cost — the thing buyers discover after committing
Switching UEM vendors generally means re-enrolling every device — the enrolment binds a device to one management authority. Licensing is a line item; re-enrolling the fleet is the project. The per-platform rule decides the effort:
Apple · ADE devices
Re-assign the MDM server in Apple Business — no touch, no wipe on already-supervised devices.
Android work profile · Apple User Enrolment
Remove the old work container, enrol the new — personal side untouched.
Android fully-managed · dedicated
Enrolment is bound at setup. Exiting means a factory reset per device — the expensive case.
Windows
Mostly scriptable — unenrol, re-enrol via provisioning package or Autopilot. Hybrid-join estates are the exception.
Out-of-ADE Apple devices are the other hands-on case — per-unit Configurator wipes, no scalable over-the-air option.
Migration effort in hours for your fleet: [TechBag to confirm] — TechBag scopes this from your device count, platform mix and current modes.
Do you already own one?
Before “which UEM”, the cheaper question: four licences you may already hold include one. Then what the rest cost — per device, per user, per technician, in USD and INR — and what never appears on the licence line.
Check before you buy
Four platforms bundle endpoint management — and buyers pay twice more often than not.
- Microsoft 365
- Yes, if the SKU says “Microsoft 365”: Business Premium, E3, E5, F1, F3, EMS. Office 365 plans do not include it. Plan 1 $8, Plan 2 +$4, Suite +$10 per user / month standalone; E3 $36→$39 and E5 $57→$60 from 1 July 2026.
- Apple Business
- Yes free since April 2026. Enough for simple Apple fleets; not for compliance reporting or complex policy.
- Google Workspace
- Partly basic management in every edition, advanced from Business Plus and Enterprise. Not a full UEM.
- Your RMM
- Often NinjaOne sells MDM as an add-on; Atera bundles Miradore. Check the console before you buy again.
We’ll tell you if you don’t need to buy anything. It costs us a sale and saves you one.
What the rest actually cost
Three pricing models. Published USD list with INR at ≈₹83/$ for scale; tier named where the vendor publishes tiers, term stated, minimums stated. The indicative bands first, the per-product ladders under them.
Per device
most of the categoryper device / month, annual. The India-built and mid-market products live here; the spread is tier, not vendor.
Per user
the Microsoft modelper user / month, any number of devices. $0 when bundled in Microsoft 365; Entra ID P1 ($6 ≈ ₹498) if you buy it standalone.
Per technician
the RMM modelper IT seat / month, unlimited endpoints; the MDM then arrives as a per-device add-on or a partner SKU.
Per device — the ladders
USD list · INR ≈ · per device / month
Hexnode UEM
min: 15 devicesTerm: Monthly or annual — annual ~10% less; Express entry tier (~$1) and a custom Ultra above.
Tiers gate kiosk depth, Windows/macOS management, app management and OS-update control — match the tier to the OS mix, not to the price.
Scalefusion UEMIndia-built
min: 10 devicesTerm: Annual; 360 Enterprise Suite (UEM + OneIdP + Veltar) bundles at $12.42.
India-built, India-hosted. Admin-seat limits and the OneIdP / Veltar add-ons move the per-device figure — tier-match before you compare with Hexnode.
42Gears SureMDMIndia-built
min: none publishedTerm: Monthly and annual SKUs, cloud or on-premise (on-prem priced separately).
India-built. Standard already bundles SureLock / SureFox kiosk — the reason it wins rugged and dedicated-device fleets at this price.
ManageEngine Endpoint CentralIndia-built
min: 50 endpoints (paid); free to 25Term: Annual per 50 endpoints, on-prem: $795 / $945 / $1,095 / $1,695 a year; cloud higher (Professional $1,045); one technician included.
India-built. The per-device figures are those annual prices ÷ 50 ÷ 12 — the cheapest full UEM on the page per endpoint, priced like software, not SaaS.
Seqrite mSuiteIndia-built
min: quoteTerm: Annual, INR-native list through partners.
India-built, India-hosted, INR-native — the one line here where the USD is the conversion and the INR is the list. Proven at volume (Fino Payments Bank).
LogMeIn Miradore
min: noneTerm: Monthly or annual.
Also the MDM inside Atera. The free tier is real but thin.
NinjaOne MDM
min: ~50 devices (platform), ~$200–250 / month floorTerm: Annual, quote-only; reported $1.50–3.75 per device on top of the per-technician RMM.
You pay for the RMM seat first; the MDM rides on it.
Jamf Now
min: first 3 devices freeTerm: Monthly; third-party listing, Jamf publishes no list.
Apple-only, teams up to ~50.
Jamf Pro / Jamf School
min: 25 devices on business plansTerm: Annual, quote-only; education bundles for School.
Apple-only; the depth ceiling for Macs, priced accordingly.
miniOrange UEM
min: quoteTerm: Annual, 14-day trial.
India HQ; quote-only.
Per user — the Microsoft model
- Intune Plan 1 standalone$8 ≈₹664$0 marginal when bundled (Business Premium, E3, E5, F1, F3, EMS). Plan 2 +$4 (≈₹332), Suite +$10 (≈₹830); Entra ID P1 $6 ≈ ₹498 if you are not on Microsoft 365.
- Google WorkspaceIncludedNo separate price — endpoint management rides on the edition you pay for (advanced from Business Plus / Enterprise).
- Apple BusinessFreeFree with the Apple Business account since April 2026; the cost is what it cannot do, not the licence.
Per user is cheap when users carry several devices and dear when they carry one — the arithmetic is in block 03.
Per technician — the RMM model
- NinjaOne platformQuotePer technician, quote-only; the MDM module is then priced per device on top (ladder above).
- AteraPublishedPer-technician plans; mobile devices via the Miradore partnership, priced per device on Miradore’s terms.
The bill tracks your IT headcount, not your fleet. It wins for a small team running a large, simple fleet that needs patching and remote access more than compliance evidence — an RMM question, not a UEM one.
What isn’t in the licence price
Migration re-enrolment
Apple ADE and Android work profile move cleanly; Android fully-managed means a factory reset per device, and out-of-ADE Apple devices need a per-unit Configurator wipe. That is people-hours, not licence dollars — it sits in the migration section, and the hours for your fleet are [TechBag to confirm].
Implementation time
The console is live in a day; the fleet is not. Zero-touch readiness (channel-bought hardware registered to ABM / Android Enterprise), a pilot ring, then staged enrolment by site or OS. At 2,000+ devices the calendar — not the licence — is the larger cost; scope it before you sign, and scope it per platform.
The per-device vs per-user flip
At one device per user, $8 per user (Intune Plan 1) costs more than ~$2–4 per device. Give each user a laptop, a phone and a tablet and it flips: three devices at $3 is $9, against $8 for the user. Count devices per user before comparing models — the cheaper model is decided by your fleet shape, not the vendor.
What goes wrong — verified failure modes
Buyers discover these after signing. Putting them before the decision is the point of the page. (Items marked with a fleet-specific number are scoped by TechBag from your real engagement.)
Retail-bought devices can never be zero-touch enrolled without a wipe
Zero-touch / ADE only fire for devices bought through an approved channel and assigned to your account at fulfilment. A retail unit must be factory-reset and manually enrolled — at scale, that’s hands-on per device.
Office 365 ≠ Microsoft 365 — Intune is in neither Office plan
A buyer who owns Office 365 E3 and assumes they ‘already have Intune’ is wrong. Only Microsoft 365 (and EMS) include it.
Apple Business built-in MDM covers more than expected, and less than needed
It handles Managed Apple Accounts, Blueprints and App Store apps for free — but stops at advanced app management, complex config/PKI, non-Apple platforms and scale automation. Know the nameable ceiling before you assume it’s enough.
Android zero-touch fails silently on pre-Android-9 and already-provisioned devices
It only fires from a factory-reset first-boot state, on Android 9.0+ (7.0+ Pixel) with work-profile support. An already-set-up device just… doesn’t enroll.
Exiting Android fully-managed or dedicated requires a factory reset
Device Owner and COSU are provisioned at setup; removing management wipes the device. BYOD work-profile and COPE don’t — a real migration-cost difference.
UEM migration means re-enrolling every device
Switching vendors isn’t a config export. Depending on platform/mode, some of the fleet gets wiped. Scope it before you commit, not after.
Conditional Access & Windows auto-enrollment carry hidden Entra licensing
Both need Entra ID P1/P2 — discovered at configuration time if you didn’t plan for it (bundles like E3/E5/EMS already include it).
Rugged OEM support varies by manufacturer and model
‘Supports rugged’ on a datasheet is not the same as supporting your specific Zebra/Honeywell model and its OEM extensions. Verify the exact SKU.
Failure modes are drawn from documented platform behaviour and are being cross-checked against real TechBag engagements before any is presented as a case study.
Three doors — pick by where you are
Vendor-neutral. No gated content.