Endpoint management: UEM controls, enrollment, BYOD and costs

What unified endpoint management (UEM) covers

NIST SP 800-124 Revision 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise, is dated May 2023. It says an enterprise mobility management suite may include mobile device management (MDM), mobile application management (MAM) and mobile threat defense.^2,10

The functions an enterprise buys a UEM tool for:

• Inventory. The CIS Controls ask for every enterprise asset to be inventoried, tracked and corrected, including portable and mobile devices, physical, virtual, remote and cloud.³
• Software control. Only authorized operating systems and applications should be installed and able to run. Unauthorized software should be found and prevented.⁴
• Configuration and policy. EMM tools monitor for and report policy violations, and act on them automatically where possible. They can block access to company services by OS version, by model, or when a device is rooted or jailbroken.^11,12
• Compliance and access. In Microsoft's design, Intune sends each device's compliance state to Entra ID, where conditional access combines it with user, app, location and risk signals to allow or block access.¹³
• App deployment. Windows Autopilot turns the preinstalled Windows on a new PC into a business-ready state, with settings, policies and apps applied, instead of re-imaging it.¹⁴
• Remote wipe. Administrators can delete enterprise data and apps on company-owned or employee-owned mobile devices. Remote wipe needs an agent or profile installed on the device before any company data reaches it.^15,16

SP 800-124r2 leaves laptops out of scope, while noting that laptop and desktop management is converging with mobile device management. It also says most organizations will not need every capability it lists, and should weigh each one for their environment.^17,18

Endpoint management and the CIS Controls, NIST SP 800-40 and SP 800-124

Federal agencies face a hard deadline. CISA's Binding Operational Directive 22-01 requires them to remediate vulnerabilities in its Known Exploited Vulnerabilities catalog within two weeks, or within six months for CVEs assigned before 2021.²²

NIST SP 800-40r4 says the old practice of refreshing inventories monthly or quarterly with a vulnerability scan should no longer be used. Inventories need constant, automated updates.²³

Zero-touch enrollment: Apple, Android Enterprise and Windows Autopilot

Apple, Google and Microsoft each run an enrollment program that hands a new device to the company's management service. Intune, for example, enrolls devices automatically through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise.^7,24,25,26

Apple's Automated Device Enrollment is for devices the organization owns. It configures a device from the moment it comes out of the box, and the organization can stop the user from removing the management profile.^24,27

Android zero-touch enrollment works on first boot. The device checks whether an enterprise configuration has been assigned to it and, if so, starts fully managed provisioning.²⁵

With Windows Autopilot, the user's only steps are to connect to a network and sign in. Automatic enrollment into an MDM service such as Intune requires a Microsoft Entra ID P1 or P2 subscription to configure.^26,28

BYOD vs. corporate-owned devices

For BYOD, NIST suggests managing the apps rather than the device, since MAM instead of MDM may address employees' privacy concerns. Microsoft describes MAM as typical for personal devices, and says IT can selectively wipe company data from them without touching personal content when the employee leaves.^8,33,34

Apple and Google build the same split into their platforms. Apple's account-driven User Enrollment lets IT manage only the organization's accounts, settings and data, and allows a limited set of restrictions because the user owns the device. Google recommends a work profile, which separates work apps from personal ones, for BYOD on Android.^35,36,37

The cost of BYOD is visibility. NIST notes that with BYOD and CYOD the enterprise has little or no knowledge of where a device came from or whether it has been modified.³⁸

Windows 10 end of support and Extended Security Updates (ESU) pricing

Windows 10 reached end of support on October 14, 2025. Version 22H2 is the final version. Existing LTSC releases keep receiving updates on their own lifecycles.^39,40

The terms that catch an enterprise out:

• ESU is cumulative. An organization that joins in year two pays for year one as well.⁴⁴
• Only devices on Windows 10, version 22H2, are eligible.⁴⁵
• Each device must be activated with a multiple activation key from the Microsoft 365 admin center.⁴⁶
• ESU delivers critical and important security updates only. It does not include technical support.^47,48
• Windows 11 requires UEFI firmware capable of Secure Boot and TPM 2.0, so some Windows 10 PCs cannot be upgraded in place.⁴⁹

UEM pricing: Microsoft Intune plans and published list prices

Microsoft says that starting July 2026 it is rolling select Intune Suite capabilities into Microsoft 365 E3 and E5. E3 customers receive Remote Help, Advanced Analytics and the Plan 2 capabilities. E5 customers also get Endpoint Privilege Management, Cloud PKI and Enterprise App Management.^58,59

The pricing units differ. Microsoft prices Intune per user, and every managed user or device needs a license. Jamf and ManageEngine price per device or endpoint. Intune also depends on Microsoft Entra ID for identity and conditional access.^{9,54,57,60,61}

Where endpoint management goes wrong

• Patching everything at once. NIST advises phased rollouts in which a small set of canary devices gets each routine patch first.⁶⁵
• Patching with no deadline. NIST says users can have some flexibility on routine patches, but installation should be forced once a grace period ends.⁶⁶
• Ignoring devices that cannot be patched. An asset at end of life, or one that does not support updates, needs its own risk response plan.⁶⁷
• Switching tools mid-rollout. Apple warns that changing device management service mid-deployment puts users through a migration process.⁶⁸
• Blocking the enrollment service. If a network blocks traffic to Google's servers, Android zero-touch enrollment is skipped, and a device that has a configuration resets itself after it first reaches those servers.⁶⁹