- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Your shortlist was decided before you started shopping.
Where you bought the hardware set your enrolment options. The licences you already hold set your baseline. Who owns the devices set your architecture.
A retail-bought laptop cannot be zero-touch enrolled. Ever. No MDM you buy changes that.
Already decided — before you started shopping
Still yours to weigh
What UEM & MDM actually is
UEM and MDM are how an organisation enrolls, configures, secures and — if it has to — wipes the devices it owns or allows: phones, tablets, laptops, desktops. You install a management profile or agent, and from one console you push settings (Wi-Fi, VPN, passcode rules), deploy and remove apps, enforce OS updates and encryption, prove compliance, and lock or wipe a lost device.
MDM was born managing phones and tablets. UEM is the same idea widened to every endpoint — mobile and desktop — under one policy engine. In 2026 the labels blur; judge a product by its capability list, not its acronym.
One boundary to hold onto
UEM is not endpoint security, not RMM, and not identity. Several products bolt those on — and that bolt-on is a decision variable, not a bonus. A “UEM + EDR” suite may be exactly right, or may be two mediocre tools where you wanted one great one. Decide it deliberately.
Often confused withRMM & Patch — keeping devices working, patched and fixed at a distance →· Endpoint Protection — stopping, spotting and responding to what is trying to get in →
The full endpoint-management landscape — UEM, MDM, RMM, EPP and where each fits →
Narrow 28 products to your shortlist
Set what you know. Every product stays on the page — the ones that no longer qualify fade and say why; the ones we can’t verify at your scale are marked, never cut. Unset a chip and they come back.
India data residency
OS mix
Ownership model
Fleet size
The licence you already hold removes nothing — it changes the price. That lives under What it costs.
per Mac/mo as Jamf for Mac (Jamf Pro + Connect + Protect, billed annually, 25-device minimum); Jamf for Mobile $5.75 per device
Apple-heavy fleets that want the deepest macOS/iOS management there is.
The catch: Apple-only. No Windows MDM at all; Android is a separate Jamf-for-Mobile bundle, not Jamf Pro.
per device/mo ('starting at' on Jamf's pricing page)
Very small Apple shops (under ~25 employees) that need basics, not automation.
The catch: Deliberately shallow: no DDM update enforcement, no scripting, no patch policies (those are Jamf Pro).
per device (education bundles)
Apple-only K-12 / education estates (Apple School Manager, Classroom).
The catch: Education-tuned and Apple-only; no Jamf-Pro-grade DDM / patch / scripting.
per user/mo (Plan 1; often $0 if bundled)
Microsoft-committed shops with a mixed Windows-heavy fleet.
The catch: macOS depth historically trails Jamf. And it is NOT in any Office 365 plan (Office 365 ≠ Microsoft 365).
per device/mo (10-device min; page fetch blocked — verify)
Mixed fleets and rugged/field Android, especially where India data-residency matters.
The catch: Vendor pricing page blocks automated reads; confirm current per-tier prices at quote time.
per device/mo (Pro tier; 15-device min)
Mixed fleets wanting broad multi-OS coverage at a low entry price.
The catch: No India data centre (US/EU/UAE). macOS DDM version floor + Apple-silicon specifics unconfirmed in docs.
per device/mo (Standard; bundles SureLock/SureFox)
Rugged/frontline Android + kiosk, with India/US/EU data-region choice or on-prem.
The catch: macOS DDM update floor is macOS 15+ (higher than peers). FileVault key-escrow wording unconfirmed.
per-endpoint editions (Free / Pro / Enterprise / UEM)
IT teams wanting UEM + patch + software deployment in one, with India DCs or on-prem.
The catch: Windows-enrollment specifics (Autopilot/Entra) and macOS DDM depth are datasheet-level, not doc-confirmed.
per device/mo (quote-only; 14-day trial)
Identity-first shops (miniOrange IAM/SSO heritage) adding device management.
The catch: A newer UEM: advanced macOS (FileVault escrow, DDM, Apple silicon) is not substantiated in public docs.
per device (quote-only)
India shops managing Android + iOS mobile only (Quick Heal / Seqrite estate).
The catch: Mobile-only — NO macOS and NO Windows. Apple ABM/ADE not evidenced (email/SMS enrollment only).
per device (add-on to the NinjaOne platform)
Teams already on NinjaOne RMM adding Apple/Android MDM in one console.
The catch: MDM is an add-on, not standalone; Windows/Linux are RMM-only (not in the MDM module); macOS apps are Apps-&-Books only (no .pkg).
per device/mo (Premium; $4.75 Premium+)
Mixed fleets wanting a genuinely free-to-start, four-OS MDM (incl. macOS .pkg deploy).
The catch: No documented DDM (classic MDM protocol); Finland-built / US-owned, no India data-residency confirmed.
per module or as ZENworks Suite (quote-only); patch content needs its own subscription after 60 days; a Windows-only SaaS edition
Mixed Windows, Mac, Linux, iOS and Android fleets managed from servers in your own data centre.
The catch: Disk encryption, endpoint security and the SaaS edition are Windows-only; kiosk lockdown and macOS DDM are not documented.
per user/yr (quote-only; Mobile Standard / Advanced editions, managed in Sophos Central)
Sophos Central estates that want phones, tablets and Macs managed in the same console as Intercept X.
The catch: Not available in Sophos Central's India region — the tenant sits in the US or EU; Windows is agent-enrolled, with no documented Autopilot.
per device or per user (quote-only); on-prem Endpoint Manager Mobile (EPMM, formerly MobileIron Core) quoted separately
Large or regulated mixed fleets that want a cloud MDM, with an on-prem path (EPMM) for air-gapped or government estates.
The catch: No India data region. Its on-prem sibling EPMM has had actively exploited flaws in 2023, 2025 and 2026 — Ivanti patches the cloud service, you patch EPMM.
per 50 devices/yr (Cloud Standard, ≈$1.08/device/mo; Professional $1,195; free ≤25 devices)
Teams that want MDM only — phones, tablets, Macs and Windows — at a published per-device price, cloud in India or on-prem, without Endpoint Central's patching stack.
The catch: Apple DDM is limited to status reporting — no declarative OS-update enforcement documented; macOS depth trails Jamf.
per Mac/mo (starting figure in Addigy's pricing FAQ; iPhone, iPad and Apple TV a separate unpublished add-on rate; MSP rates quoted; 14-day trial)
MSPs running Apple fleets for many clients, and lean Apple-heavy IT teams that want live, agent-backed control rather than check-in polling.
The catch: Apple-only (no Windows or Android MDM) and cloud-only, with no India or selectable data region documented; only the Mac price is published, so iPhone and iPad seats are a quoted add-on.
per device by platform (macOS / mobile / Windows / Android), annual; EDR and Vulnerability Management licensed per device on top; 14-day trial
Apple-first fleets that want Jamf-grade Mac and iPhone automation, and now need a few Windows laptops and company Android phones in the same console.
The catch: Android is company-owned work profile only (no fully managed, dedicated/kiosk or personal-BYOD mode) and Windows needs Windows 11 24H2 or later; tenants sit in the US or EU, with no India region.
per device/mo (PREMIUM, billed annually, 30-licence minimum; free up to 30 devices)
Small and mid-size Apple fleets that want Apple Business Manager zero-touch MDM free up to 30 devices, or for $1 a device after that.
The catch: Apple-only, and PREMIUM is MDM alone: security, DNS filtering, Mac sign-on, the macOS App Catalog and watchOS are Fuse-only; data is stored in the US (Azure).
per Mac/mo ($1.50 per iPhone, iPad or Vision Pro), billed annually, 30-licence minimum
Mac-heavy companies that want MDM, Mac antivirus, DNS filtering and Mac sign-on in one Apple-only licence at a published price.
The catch: Apple-only, with no Windows or Android at all; customer data is stored only in the US on Azure (no India or EU region), and the antivirus and sign-on layers are macOS-only.
per device/mo ($5.50 per device a year PREMIUM, 30-licence minimum; OneK12 with security and filtering $9 a year)
Schools running iPads and Macs through Apple School Manager on a tight budget.
The catch: Education-only and Apple-only; security and web filtering need OneK12, and data is stored in the US.
per device/mo (Genesis; Bridge $4, Architect $6, Enterprise quoted; 25-device contract minimum; 30-day trial)
Dedicated-device fleets (POS, kiosks, signage, payment and rugged Android, including non-GMS AOSP hardware) run by teams that want staged, code-driven rollouts.
The catch: Built for company-owned dedicated devices: no macOS, no Android work profile or Apple User Enrollment, Windows is agent-enrolled with no documented Autopilot, and data is hosted in North America; remote control and the API start at Bridge, Pipelines at Architect.
per device, quote-only on its own, cloud or on-prem; the SOTI ONE bundle (MobiControl + XSight + Snap + Premium or Enterprise Service) lists at $119.88 a device a year on AWS Marketplace; 30-day trial
Large rugged and frontline fleets (Zebra, Honeywell and Samsung scanners, handhelds and shared phones in logistics, retail and field service) that also need Windows, Apple and printers under one vendor, in the cloud or on their own servers.
The catch: Enterprise-weight and quote-only on its own, subscription-only since perpetual licences ended in 2024; no documented India cloud region, so in-country data means running it on-prem.
per user or per device subscription (quote-only; on-premises, air-gapped or UEM Cloud; the Dynamics container and services such as 2FA licensed on top)
Government, defence and regulated enterprises that must run device management on their own servers, including air-gapped, with certified, containerised protection for work data.
The catch: Built for high-assurance security, not Mac depth or price: macOS ADE enrolment, FileVault and PKG deployment only arrived in 2026 (UEM 12.24), Apple User Enrollment is unsupported from iOS 18, pricing is quote-only and there is no India data region.
per device, annual and quote-only (computer, mobile and Chromebook licences); FileWave-hosted adds a yearly per-device hosting charge and a one-time migration fee; self-hosting also available; 30-day trial
Mixed Mac and Windows estates, schools among them, that want one console for computers and mobiles on a server they run or in FileWave's hosting, including an AWS India region.
The catch: Quote-only; ChromeOS is inventory and reporting on top of Google Admin Console rather than full management, and Android runs on Google's management API with its 500-device default quota and no Samsung Knox or Zebra extensions documented.
quote-only; one UEM licence covering Empirum client management, Silverback MDM and Intune co-management, with Patch Management and Package Cloud as add-ons; cloud, on-prem or hybrid; 30-day trial
Windows-heavy estates that want PC imaging, software distribution, patching and phone management in one console that also runs their service desk, on their own servers if data has to stay in-house.
The catch: No Apple Declarative Device Management (OS updates still go out as legacy MDM commands), no Android Enterprise Recommended listing, quote-only pricing, and no India office, partner or data region.
per device / month list for Essentials (Fast Start MDM-only $1.50; Deluxe $5.30, Premier $6.63, Enterprise $9.54); 30-day free trial
Mixed iOS, Android, Windows and macOS fleets that want UEM with containerised mail and documents, mobile threat defence and AI policy advice in one SaaS console.
The catch: Containerised email, content, gateway and threat defence sit in the $5.30–$9.54 tiers, not Essentials; Apple DDM support is partial; no India-hosted tenant is documented.
not sold on its own: included in Citrix Universal Hybrid Multi-Cloud (one managed user per UHMC licence) and unlimited in the Citrix Platform licence, per user, quoted; cloud service or on-premises (formerly XenMobile Server)
Citrix DaaS estates in regulated sectors that want MDM/MAM with 300+ security policies and micro-VPN-wrapped apps from the same vendor and console as their virtual desktops, on Citrix's cloud or their own servers.
The catch: Only comes as part of a Citrix platform subscription, so it rarely makes sense without Citrix DaaS. Apple Declarative Device Management covers a handful of policies and parts are Technical Preview, Android Device Administrator mode is deprecated (26.8.0, Sep 2026), and Citrix's cloud service locations stop at SE Asia and Sydney, with no India region.
Why each constraint rules out what it doesShow the reasoning ↓
India data residencyRules out Jamf Pro, Jamf Now, Jamf School, Hexnode UEM, NinjaOne MDM, LogMeIn Miradore (GoTo), OpenText ZENworks, Sophos Mobile, Ivanti Neurons for MDM, Addigy MDM, Iru Endpoint Management (formerly Kandji), Mosyle Business, Mosyle Fuse, Mosyle Manager, Esper Deploy, SOTI MobiControl, BlackBerry UEM, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management — no India data residency; miniOrange UEM — India HQ, but data residency unconfirmed. That leaves Microsoft Intune, Scalefusion UEM, 42Gears SureMDM, ManageEngine Endpoint Central, Seqrite mSuite, ManageEngine Mobile Device Manager Plus and FileWave.
Mostly AppleRules out Jamf Now, miniOrange UEM, Seqrite mSuite and Esper Deploy — Apple management too shallow for an Apple-heavy fleet. That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, NinjaOne MDM, LogMeIn Miradore (GoTo), OpenText ZENworks, Sophos Mobile, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Addigy MDM, Iru Endpoint Management (formerly Kandji), Mosyle Business, Mosyle Fuse, Mosyle Manager, SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
Mostly AndroidRules out Jamf Pro, Jamf Now, Jamf School, Addigy MDM, Mosyle Business, Mosyle Fuse and Mosyle Manager — no Android management; Iru Endpoint Management (formerly Kandji) — limited Android Enterprise depth. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM, LogMeIn Miradore (GoTo), OpenText ZENworks, Sophos Mobile, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Esper Deploy, SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
Windows in the fleetRules out Jamf Pro, Jamf Now, Jamf School, Addigy MDM, Mosyle Business, Mosyle Fuse and Mosyle Manager — Apple-only; Seqrite mSuite, NinjaOne MDM, Sophos Mobile and Esper Deploy — mobile-only, no desktop. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, LogMeIn Miradore (GoTo), OpenText ZENworks, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Iru Endpoint Management (formerly Kandji), SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
A genuinely mixed fleetRules out Jamf Pro, Jamf Now, Jamf School, Addigy MDM, Mosyle Business, Mosyle Fuse and Mosyle Manager — Apple only; Seqrite mSuite, NinjaOne MDM, Sophos Mobile and Esper Deploy — mobile only, no desktop. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, LogMeIn Miradore (GoTo), OpenText ZENworks, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Iru Endpoint Management (formerly Kandji), SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
Kiosk and dedicated devicesRules out Jamf Pro, Jamf Now, Jamf School, Addigy MDM, Mosyle Business, Mosyle Fuse and Mosyle Manager — Apple-only, no Android dedicated (COSU) devices; OpenText ZENworks and Iru Endpoint Management (formerly Kandji) — no kiosk / dedicated mode. That leaves Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM, LogMeIn Miradore (GoTo), Sophos Mobile, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Esper Deploy, SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
Fleets of 10–200 devicesRules nothing out on published terms. It flags Jamf Pro — 25-device minimum on Jamf business plans and NinjaOne MDM — No published minimum, but the platform bills its highest per-device rate at 50 or fewer endpoints — marked on the cards, not removed.
Fleets of 200–2,000 devicesRules out Jamf Now — built for small shops (Jamf positions it for teams up to ~50 devices). That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM, LogMeIn Miradore (GoTo), OpenText ZENworks, Sophos Mobile, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Addigy MDM, Iru Endpoint Management (formerly Kandji), Mosyle Business, Mosyle Fuse, Mosyle Manager, Esper Deploy, SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management.
Fleets above 2,000 devicesRules out Jamf Now — built for small shops (Jamf positions it for teams up to ~50 devices). That leaves Jamf Pro, Jamf School, Microsoft Intune, Scalefusion UEM, Hexnode UEM, 42Gears SureMDM, ManageEngine Endpoint Central, miniOrange UEM, Seqrite mSuite, NinjaOne MDM, LogMeIn Miradore (GoTo), OpenText ZENworks, Sophos Mobile, Ivanti Neurons for MDM, ManageEngine Mobile Device Manager Plus, Addigy MDM, Iru Endpoint Management (formerly Kandji), Mosyle Business, Mosyle Fuse, Mosyle Manager, Esper Deploy, SOTI MobiControl, BlackBerry UEM, FileWave, Matrix42 Unified Endpoint Management, IBM MaaS360 and Citrix Endpoint Management. It flags miniOrange UEM — Unverified above 2,000 devices, LogMeIn Miradore (GoTo) — Unverified above 2,000 devices, OpenText ZENworks — Unverified above 2,000 devices and Sophos Mobile — Unverified above 2,000 devices — marked on the cards, not removed.
Corporate-owned, fully managedRules nothing out. Every product here enrols corporate-owned devices in a fully managed state — Android device owner and/or Apple supervised via Automated Device Enrolment — so there is no eliminating power and no chip.
BYOD, personal devicesRules nothing out on verified documentation. Every Android-capable product supports the work profile, and Jamf Pro and Jamf School document Apple User Enrolment. Jamf Now's User Enrolment support is not documented either way, so it is not ruled out.
Mixed corporate and BYODRules nothing out: the same consoles run fully managed and work-profile or User Enrolment devices side by side.
Small-estate fit, beyond the published minimumsThe published floors are low — Hexnode 15 devices, Scalefusion 10, 42Gears none, ManageEngine free to 25 — so at 10–200 only Jamf Pro's 25-device minimum bites, and NinjaOne's platform is simply dearest per device at 50 or fewer endpoints — both only at the bottom of the band. Where enterprise-tier pricing makes a product a poor fit for a small estate is delivery-team judgement: [TechBag to confirm].
Above 2,000 devices — what is and isn't provenSeqrite mSuite is proven at volume (Fino Payments Bank: 410 branches, 25,000+ banking points) and NinjaOne's platform runs estates of 100,000+ endpoints. miniOrange UEM and LogMeIn Miradore are marked unverified rather than ruled out: vendor claims of scale, no documented deployment at that volume. The tool stamps them, it does not eliminate them.
Eight situations, eight shortlists — with the reasoning
A bare recommendation converts nobody and gets cited by nothing — models quote explanations, not verdicts. So here’s the logic, not just the names.
All-Apple, 200–2,000 devices, dedicated IT
Why: Apple depth (DDM, FileVault escrow, patch, scripting) is the deciding variable; Jamf Pro is the benchmark.
The trade-off: Jamf is Apple-only and priced for it; if you also run Windows, Intune consolidates at the cost of some Mac depth.
Android field devices — retail, delivery, manufacturing, rugged
Why: Dedicated/COSU kiosk mode + rugged-OEM support + zero-touch are what matter; the India-built vendors lead here.
The trade-off: 42Gears/Scalefusion go deep on rugged/kiosk; if the fleet is also Apple-heavy, weigh macOS depth separately.
Mixed Windows + Apple + Android, existing Microsoft commitment
Why: If you hold M365 E3/E5/Business Premium, Intune is likely already paid for — marginal cost near zero.
The trade-off: Intune's macOS is good-not-Jamf; if Macs are your crown jewels, pair Intune (Win) with Jamf (Mac) or go Scalefusion.
BYOD-heavy, employees resist agents on personal phones
Why: Android work profile + Apple User Enrollment keep the personal side cryptographically untouched — no full device control.
The trade-off: MAM-without-enrollment protects apps only; if you need device compliance too, you need enrollment consent.
Kiosk / dedicated — signage, POS, self-service
Why: COSU/dedicated lock-down and single-app mode are the whole job; the rugged/kiosk specialists win.
The trade-off: Exiting Android dedicated/fully-managed requires a factory reset — plan provisioning accordingly (see enrollment).
Regulated sector, data residency or on-prem required
Why: Verified India data region and/or on-prem is the gating requirement before any feature comparison.
The trade-off: India-built vendors satisfy residency; confirm each vendor's exact hosting region and on-prem terms at quote.
Small team, no dedicated IT
Why: A genuine free/low tier and simplicity matter more than depth: Miradore (≤50 free), ManageEngine (≤25 free), Jamf Now (≤3 free, Apple).
The trade-off: Free tiers are capped and shallow; you'll outgrow them — but they prove the fit before you spend.
Devices already bought retail — the recovery path
Why: Zero-touch/ADE only works for devices bought through an approved channel. Retail units can't be zero-touch enrolled without a wipe.
The trade-off: Any UEM can still MANAGE them — you just lose zero-touch. Manual enrollment (or a wipe-and-reprovision) is the recovery path.
“Supports macOS” means four different things
Every vendor on this page ticks the macOS box. What you actually get ranges from Apple-grade management to a profile that barely enrols. This is the single sharpest discriminator for any fleet with Macs in it — and it never shows on a feature grid. Tiers below follow each vendor’s own documentation; where depth is claimed but not documented, we say so.
Tier 1
Apple-grade depth
DDM, FileVault key escrow, patch policies, scripting, supervision — the full Apple toolchain, built Apple-first.
Tier 2
Real Mac inside a multi-OS UEM
DDM documented; Apple silicon and ADE supervision handled. Each still has a named gap: Intune trails Jamf in depth; 42Gears’ DDM update floor is macOS 15+; NinjaOne deploys Mac apps only via Apps & Books (no .pkg).
Tier 3
Mac on the datasheet
Enrols, pushes profiles, manages the basics. DDM is partial or claimed rather than documented; version floors, FileVault wording and Apple-silicon specifics are unconfirmed. Miradore runs classic MDM (no DDM) but does deploy .pkg.
Tier 4
Mac in name only — or not at all
Jamf Now is deliberately shallow (no DDM update enforcement, no scripting, no patch). miniOrange’s advanced macOS is not substantiated in public docs. Seqrite mSuite has no macOS at all — mobile only.
Ask every vendor these five — the answers sort the tiers
Scale behaviour — 500, 2,000, 10,000 devices
Feature grids don’t change with fleet size. Consoles do. Three thresholds where a different thing becomes the constraint — and what to put in a PoC so you find it before you sign.
Process becomes the constraint
- —Manual enrolment stops scaling — zero-touch goes from nice-to-have to mandatory.
- —Policy sprawl begins: overlapping profiles with no clear precedence, so ‘which setting wins?’ becomes a daily question.
- —One admin is still ‘the person who knows the console.’ RBAC and a second admin become a control, not a luxury.
Put this in your PoC
Enrol 50 devices zero-touch in a day. Apply two deliberately conflicting policies and confirm which one wins.
Visibility becomes the constraint
- —Compliance dashboards and inventory lag — you’re reading yesterday’s state.
- —Dynamic / smart groups slow down and get brittle as criteria stack.
- —Change needs rings — pilot, then broad — never fleet-wide at once. Per-device tiers and minimums start to bite.
Put this in your PoC
Time a full compliance report. Push an app to a 200-device ring and measure time-to-90% installed.
The console itself is the constraint
- —Search, filters and bulk actions are now the bottleneck.
- —Delegated, scoped admin by region or business unit is mandatory; connector / gateway / CA capacity and API rate limits decide how fast you can move.
- —Migration without automation is effectively impossible — which is why the switching cost below is a scale problem first.
Put this in your PoC
Bulk-action 1,000 devices. Pull the full inventory through the API. Confirm region / residency sharding.
These are category-wide behaviours. Where a specific vendor’s console starts to strain: [TechBag to confirm] — TechBag tests this against your fleet size during scoping.
Enrollment architecture — where the shortlist is really set
Three platforms, each a distinct set of enrollment modes. The load-bearing fact: whether exiting a mode requires a factory reset is a hard technical boundary, not a policy choice — and it drives both onboarding and migration cost. All verified against Google/Apple/Microsoft docs.
Android Enterprise — four modes, one reset boundary
Device Owner · corporate
Fully managed
Corporate-owned, full control, work-only
Personal space
None
Kiosk · userless
Dedicated / COSU
Single-purpose — signage, POS, scanners (userless)
Personal space
None
Profile Owner · BYOD
Work profile
Personal device, separated work container
Personal space
Untouched, private
Work profile on company-owned
COPE
Corporate hardware + private personal space (Android 11+)
Personal space
Private container
*COPE can be released with the RELINQUISH_OWNERSHIP command — removes the work profile, preserves personal data, no reset. Fully-managed and dedicated can only be provisioned from a factory-reset state, so exiting them means a wipe.
Zero-touch enrollment — the mechanic that’s locked at purchase
You buy zero-touch devices from an approved reseller, who assigns them by serial/hardware ID to your account at fulfilment. Requires Android 9.0+ (7.0+ on Pixel) and work-profile support. It fires only on a device in factory-reset / first-boot state — an already-set-up or retail-bought device will not auto-enroll without a factory reset first. Consumer-store devices are never eligible. (developer.android.com / support.google.com)
Apple — supervised vs the modern protocol
Supervised vs unsupervised
Supervision means org-ownership and unlocks the serious controls — single-app mode, web-content filtering, disabling AirDrop, blocking user wipe, OS-update enforcement, removing built-in apps. Unsupervised gets only a baseline. In practice, serious corporate control ≈ supervised ≈ ADE (or a Configurator wipe).
Automated Device Enrollment (ADE)
The chain: buy from Apple / a linked Authorised Reseller / carrier → the purchase links to your Apple Business account → register your MDM server → assign the device → it enrolls during Setup Assistant, supervised, with a non-removable profile a user can’t undo.
Declarative Device Management (DDM) — a real discriminator
DDM replaces the old command-and-poll model with a device that applies settings and reports state on its own. Apple runs it alongside legacy MDM and it’s the forward direction — required for the newest features. Which vendors genuinely moved to DDM separates products more than any feature comparison (Jamf, Intune, Scalefusion, 42Gears, NinjaOne document it; Miradore and some others don’t).
“Apple Business” ships a built-in MDM (April 2026)
Apple consolidated Apple Business Manager, Business Essentials and Business Connect into Apple Business (available 14 April 2026) with a free built-in MDM: Managed Apple Accounts, Blueprints (zero-touch), App Store app distribution, an Admin API, IdP federation. Where it stops being enough: advanced app management, complex config/compliance/PKI, non-Apple platforms, and scale/automation depth — that’s where a dedicated UEM earns its price.
Windows — Autopilot, Entra join, co-management
Autopilot
Turns an OEM-imaged, out-of-box PC into a corporate, Intune-managed, Entra-joined device during OOBE. v1 needs the hardware hash (and is the only option for hybrid join); v2 (device preparation) needs no hash but is cloud-only.
Entra join
Cloud-native and recommended — identity only in Entra, no on-prem AD dependency. Hybrid Entra join keeps on-prem AD too, but needs line-of-sight to domain controllers and the Intune Connector. Microsoft explicitly recommends against hybrid for new devices — it’s a migration mode, not a target.
Co-management
Runs the ConfigMgr agent and Intune together, moving seven workloads (compliance, Windows Update, resource access, Endpoint Protection, device config, Office apps, app deployment) to Intune on a slider.
Which vendors do Windows PROPERLY (Entra + Autopilot + co-management + Win32 packaging) versus treating it as a thin “enroll + push a profile” afterthought is a real discriminator. Among TechBag’s list, Intune / Scalefusion / Hexnode / 42Gears / ManageEngine / Miradore do real Windows; Jamf, Seqrite and NinjaOne-MDM do not.
Migration cost — the thing buyers discover after committing
Switching UEM vendors generally means re-enrolling every device — the enrolment binds a device to one management authority. Licensing is a line item; re-enrolling the fleet is the project. The per-platform rule decides the effort:
Apple · ADE devices
Re-assign the MDM server in Apple Business — no touch, no wipe on already-supervised devices.
Android work profile · Apple User Enrolment
Remove the old work container, enrol the new — personal side untouched.
Android fully-managed · dedicated
Enrolment is bound at setup. Exiting means a factory reset per device — the expensive case.
Windows
Mostly scriptable — unenrol, re-enrol via provisioning package or Autopilot. Hybrid-join estates are the exception.
Out-of-ADE Apple devices are the other hands-on case — per-unit Configurator wipes, no scalable over-the-air option.
Migration effort in hours for your fleet: [TechBag to confirm] — TechBag scopes this from your device count, platform mix and current modes.
Do you already own one?
Before “which UEM”, the cheaper question: four licences you may already hold include one. Then what the rest cost — per device, per user, per technician, in USD and INR — and what never appears on the licence line.
Check before you buy
Four platforms bundle endpoint management — and buyers pay twice more often than not.
- Microsoft 365
- Yes, if the SKU says “Microsoft 365”: Business Premium, E3, E5, F1, F3, EMS. Office 365 plans do not include it. Plan 1 $8, Plan 2 +$4, Suite +$10 per user / month standalone; E3 $36→$39 and E5 $57→$60 from 1 July 2026.
- Apple Business
- Yes free since April 2026. Enough for simple Apple fleets; not for compliance reporting or complex policy.
- Google Workspace
- Partly basic management in every edition, advanced from Business Plus and Enterprise. Not a full UEM.
- Your RMM
- Often NinjaOne sells MDM as an add-on; Atera offers Miradore through its marketplace as a paid add-on. Check the console before you buy again.
We’ll tell you if you don’t need to buy anything. It costs us a sale and saves you one.
What the rest actually cost
Three pricing models. Published USD list with INR at ≈₹83/$ for scale; tier named where the vendor publishes tiers, term stated, minimums stated. The indicative bands first, the per-product ladders under them.
Per device
most of the categoryper device / month, annual. The India-built and mid-market products live here; the spread is tier, not vendor.
Per user
the Microsoft modelper user / month, any number of devices. $0 when bundled in Microsoft 365; Entra ID P1 ($6 ≈ ₹498) if you buy it standalone.
Per technician
the RMM modelper IT seat / month, unlimited endpoints; the MDM then arrives as a per-device add-on or a partner SKU.
Per device — the ladders
USD list · INR ≈ · per device / monthHexnode UEM
min: 15 devicesTerm: Annual prices shown; monthly billing is about 10% more ($2.40 / $3.60 / $5.20 / $6.00); Hexnode also lists INR, from ₹212 on Pro.
Tiers gate kiosk depth, Windows/macOS management, app management and OS-update control — match the tier to the OS mix, not to the price.
Scalefusion UEMIndia-built
min: 10 devicesTerm: Annual; 360 Enterprise Suite (UEM + OneIdP + Veltar) bundles at $12.42.
India-built, India-hosted. Admin-seat limits and the OneIdP / Veltar add-ons move the per-device figure — tier-match before you compare with Hexnode.
42Gears SureMDMIndia-built
min: none publishedTerm: Monthly and annual SKUs, cloud or on-premise (on-prem priced separately).
India-built. Standard already bundles SureLock / SureFox kiosk — the reason it wins rugged and dedicated-device fleets at this price.
ManageEngine Endpoint CentralIndia-built
min: 50 endpoints (paid); free to 25Term: Annual per 50 endpoints, on-prem: $795 / $945 / $1,095 / $1,695 a year; cloud higher (Professional $1,045); one technician included.
India-built. The per-device figures are those annual prices ÷ 50 ÷ 12 — the cheapest full UEM on the page per endpoint, priced like software, not SaaS.
Seqrite mSuiteIndia-built
min: quoteTerm: Annual, INR-native list through partners.
India-built, India-hosted, INR-native — the one line here where the USD is the conversion and the INR is the list. Proven at volume (Fino Payments Bank).
LogMeIn Miradore
min: noneTerm: Monthly or annual.
Also the MDM inside Atera. The free tier is real but thin.
NinjaOne MDM
min: None publishedTerm: Quoted; NinjaOne publishes a per-device platform band ($3.75 at 50 or fewer endpoints to $1.50 at 10,000), and MDM is priced on top.
You pay for the RMM seat first; the MDM rides on it.
Jamf Now
min: first 3 devices freeTerm: Monthly; 'starting at' on Jamf's pricing page.
Apple-only, teams up to ~50.
Jamf for Mac / Mobile (Jamf Pro)
min: 25 devicesTerm: Billed annually; each plan bundles Jamf Pro, Connect and Protect; Jamf School and education quoted.
Apple-only; the depth ceiling for Macs, priced accordingly.
miniOrange UEM
min: quoteTerm: Annual, 14-day trial.
India HQ; quote-only.
OpenText ZENworks
min: none publishedTerm: Quote-only; ZENworks Suite on your own servers, or the Windows-only Endpoint Management SaaS edition.
The Suite includes 60 days of patch content, then Patch Management needs its own subscription; the full Service Desk is a further add-on.
ManageEngine MDM PlusIndia-built
min: 50-device packs (paid); free to 25Term: Annual per pack of 50 devices ($645 Standard, $1,195 Professional, cloud); on-prem annual or perpetual.
MDM only, on the same engine as Endpoint Central; per-device figures are the pack price ÷ 50 ÷ 12.
Sophos Mobile
min: quoteTerm: Annual per user, through partners; Sophos Central only (on-prem ended July 2023).
Not available in Sophos Central's India region.
Ivanti Neurons for MDM
min: quoteTerm: Quote-only; on-prem EPMM licensed separately.
No India data region.
Addigy
min: none publishedTerm: Per device per month, starting figures from Addigy's pricing FAQ; MSP rates and iPhone, iPad and Apple TV seats quoted.
Apple-only. Intelligence is included at no extra cost through 31 October 2026, then a paid tier; Security Suite resells SentinelOne EDR and MDR.
Iru Endpoint Management
min: quoteTerm: Annual, quote-only; 14-day trial.
Per-device figures on third-party sites are an old Kandji list from before the October 2025 rename, not a current price.
Mosyle Business / Fuse
min: 30 licences (paid); free up to 30 devicesTerm: Annual, USD, mostly bought direct; school lines priced per device per year.
Apple-only. PREMIUM is MDM alone; Fuse adds Mac antivirus, DNS filtering and Mac sign-on. Manager PREMIUM is $5.50 and OneK12 $9 a device a year.
Esper Deploy
min: 25 devices (contract)Term: Per device per month, USD; billing term not published; 30-day free trial.
Dedicated-device first. Remote control, RBAC, SSO and the API start at Bridge; Pipelines and the SDK at Architect. Titanium, Edgebox and a dedicated stack are paid add-ons.
SOTI MobiControl
min: none publishedTerm: Per device; $119.88 a device for 12 months on SOTI's AWS Marketplace listing (MobiControl + XSight + Snap + Premium or Enterprise Service); otherwise quoted, cloud or on-prem; subscription only since September 2024.
Premium Service covers deployments up to 1,000 devices, Enterprise Service 1,001 and above.
FileWave
min: none publishedTerm: Annual per device, quote-only; FileWave Cloud Hosting adds a yearly per-device charge and a one-time migration fee.
Self-hosted or FileWave-hosted, with AWS India (ap-south-1) among the hosting regions; confirm the region at order time.
Matrix42 UEM
min: quoteTerm: Quote-only; cloud hosted in-country for Matrix42's European markets, private cloud or on-prem.
Patch Management and Package Cloud are add-ons; adding Endpoint Data Protection makes it Secure UEM.
Per user — the Microsoft model
- Intune Plan 1 standalone$8 ≈₹664$0 marginal when bundled (Business Premium, E3, E5, F1, F3, EMS). Plan 2 +$4 (≈₹332), Suite +$10 (≈₹830); Entra ID P1 $6 ≈ ₹498 if you are not on Microsoft 365.
- Google WorkspaceIncludedNo separate price — endpoint management rides on the edition you pay for (advanced from Business Plus / Enterprise).
- Apple BusinessFreeFree with the Apple Business account since April 2026; the cost is what it cannot do, not the licence.
Per user is cheap when users carry several devices and dear when they carry one — the arithmetic is in block 03.
Per technician — the RMM model
- NinjaOne platformQuotePer device; NinjaOne publishes a $1.50–3.75 band and quotes the exact rate; the MDM module is then priced per device on top (ladder above).
- AteraPublishedPer-technician plans; mobile devices via the Miradore partnership, priced per device on Miradore’s terms.
The bill tracks your IT headcount, not your fleet. It wins for a small team running a large, simple fleet that needs patching and remote access more than compliance evidence — an RMM question, not a UEM one.
What isn’t in the licence price
Migration re-enrolment
Apple ADE and Android work profile move cleanly; Android fully-managed means a factory reset per device, and out-of-ADE Apple devices need a per-unit Configurator wipe. That is people-hours, not licence dollars — it sits in the migration section, and the hours for your fleet are [TechBag to confirm].
Implementation time
The console is live in a day; the fleet is not. Zero-touch readiness (channel-bought hardware registered to ABM / Android Enterprise), a pilot ring, then staged enrolment by site or OS. At 2,000+ devices the calendar — not the licence — is the larger cost; scope it before you sign, and scope it per platform.
The per-device vs per-user flip
At one device per user, $8 per user (Intune Plan 1) costs more than ~$2–4 per device. Give each user a laptop, a phone and a tablet and it flips: three devices at $3 is $9, against $8 for the user. Count devices per user before comparing models — the cheaper model is decided by your fleet shape, not the vendor.
What goes wrong — verified failure modes
Buyers discover these after signing. Putting them before the decision is the point of the page. (Items marked with a fleet-specific number are scoped by TechBag from your real engagement.)
Retail-bought devices can never be zero-touch enrolled without a wipe
Zero-touch / ADE only fire for devices bought through an approved channel and assigned to your account at fulfilment. A retail unit must be factory-reset and manually enrolled — at scale, that’s hands-on per device.
Office 365 ≠ Microsoft 365 — Intune is in neither Office plan
A buyer who owns Office 365 E3 and assumes they ‘already have Intune’ is wrong. Only Microsoft 365 (and EMS) include it.
Apple Business built-in MDM covers more than expected, and less than needed
It handles Managed Apple Accounts, Blueprints and App Store apps for free — but stops at advanced app management, complex config/PKI, non-Apple platforms and scale automation. Know the nameable ceiling before you assume it’s enough.
Android zero-touch fails silently on pre-Android-9 and already-provisioned devices
It only fires from a factory-reset first-boot state, on Android 9.0+ (7.0+ Pixel) with work-profile support. An already-set-up device just… doesn’t enroll.
Exiting Android fully-managed or dedicated requires a factory reset
Device Owner and COSU are provisioned at setup; removing management wipes the device. BYOD work-profile and COPE don’t — a real migration-cost difference.
UEM migration means re-enrolling every device
Switching vendors isn’t a config export. Depending on platform/mode, some of the fleet gets wiped. Scope it before you commit, not after.
Conditional Access & Windows auto-enrollment carry hidden Entra licensing
Both need Entra ID P1/P2 — discovered at configuration time if you didn’t plan for it (bundles like E3/E5/EMS already include it).
Rugged OEM support varies by manufacturer and model
‘Supports rugged’ on a datasheet is not the same as supporting your specific Zebra/Honeywell model and its OEM extensions. Verify the exact SKU.
Failure modes are drawn from documented platform behaviour and are being cross-checked against real TechBag engagements before any is presented as a case study.
Three doors — pick by where you are
Vendor-neutral. No gated content.