MDM was designed to control hardware the company owns. Pushed onto personal laptops, it creates more security gaps than it closes.
Most companies now run on laptops they don’t own. Contractors, freelancers, offshore teams, and employees on personal machines all regularly handle corporate data, a shift that accelerated during COVID-19 and never reversed. The knee-jerk response has been to push those devices into the same mobile device management (MDM) programs built for company-issued hardware. That approach made sense when every work device came from IT. Today, it creates more problems than it solves.
The reasoning behind MDM is still sound. Companies need control over where sensitive data lives, who accesses it, and which apps touch it. But copying device-level controls onto personal machines creates privacy friction, employee pushback, legal exposure, and enrollment gaps, leaving data less protected than the policy promises. On personal devices, the goal should be protecting corporate data wherever it’s used, without taking over the employee’s machine.
MDM was built for hardware you own
Traditional MDM is based on the idea that everyone uses company-issued laptops. It was designed for a stable, long-term workforce. When the company owns the hardware and the staff stay put, it’s reasonable to apply device-wide controls, such as remote wipe, location tracking, and a full inventory of every app on the machine.
The model makes a lot less sense when dealing with devices that hold personal information alongside work data. Employees resent that level of visibility, and with good reason.
In Europe, it can also run into legal limits. EU data protection regulators have specifically warned employers against monitoring the private side of personal devices, and in Germany, works councils must approve technical tools capable of monitoring employee behavior.
It’s likewise hard to justify intrusive MDM when companies employ a rotating slate of freelancers and contractors. They’re understandably unwilling to give an organization control over their device when next week could see them working elsewhere.
Forced enrollment backfires
Device management only works if people go along with it, and that can’t be forced. One recent study found that 78% of employees ignore BYOD bans and use personal devices for work anyway. Contractors and freelancers have even less reason to comply. Many will refuse to enroll their devices in an intrusive MDM program, and others simply don’t provide a complete inventory of the devices they use for work. IT can’t enforce controls on devices it doesn’t know exist.
The result is more shadow IT, more shadow AI, and less visibility. Some employees enroll and then find workarounds to keep their activity private, such as quietly removing the management profile or handling work through a personal browser or messaging app the company can’t see. Others quietly keep work on a second, unenrolled device. Either way, the policy looks air-tight on paper, while unmanaged access grows.
Even when laptops, tablets and phones are enrolled, keeping them that way is a constant effort. Personal devices span different operating systems, models, and versions, and IT has little say over updates or maintenance. People upgrade phones and hand old laptops to their kids, so IT ends up in a constant cycle of enrolling and removing devices.
Secure the work, not the device
For personal devices, MDM has become more reflex than strategy. The real goal is protecting corporate data. Controlling the device is only a means to that end, and on hardware you don’t own, it’s an inefficient solution.
The usual fallback is virtual desktop infrastructure (VDI), which runs a corporate desktop on remote servers and streams it to the user’s device. That solves the privacy problem but creates new ones, including latency, a clunky user experience, high infrastructure costs, and little relief on admin work. Because of these drawbacks, many security teams are now rethinking their reliance on VDI.
A better option is to isolate work on the device itself. Corporate apps and data run inside a protected local environment, sometimes called a secure enclave or workspace, kept separate from the user’s personal apps and files. IT can then enforce policies, encryption, and DLP controls inside that environment, without touching anything else on the machine.
Because the work runs locally, there’s no streaming lag. And because the personal side of the device stays untouched, employees and contractors have far less reason to resist.
It also simplifies offboarding. When a contractor’s engagement ends, IT revokes access to the workspace and wipes the corporate data inside it. Nothing on the personal side of the device is touched, and there’s no need to recover hardware or trust that files were deleted. For companies that cycle through freelancers and short-term contractors, that alone removes much of the admin work MDM creates.
Where MDM still belongs
Traditional mobile device management hasn’t become obsolete. It remains an effective way to enforce security controls and prevent data leakage on company-owned fleets. When the organization buys the laptop, issues it, and takes it back, device-wide control is reasonable. Employees expect it, and there’s no personal data on the machine to protect.
MDM also makes sense for devices that serve a single business purpose, such as shared tablets on a warehouse floor, point-of-sale terminals, or kiosks. When one of these is lost or stolen, it needs to be locked or wiped quickly, and full device control is the right tool for that.
Most organizations will end up running both models side by side, with MDM covering the hardware they own and workspace-level controls covering everything else. The mistake is treating MDM as the answer for every device.
The right way to secure BYOD
Security leaders need to differentiate between device-level controls for corporate-owned machines, and workspace-level defenses for BYOD. The first step is to inventory all the personal and unmanaged devices in use in your organization. Identify which machines access corporate apps and data and assess the attendant risks.
From there, set separate policies for the two categories. Company-owned devices can stay under MDM. Personal devices should be governed by what happens inside the work environment, such as which apps can open corporate files, whether data can be copied out, and what happens when access ends.
The next task should be to prioritize data protection. Focus on securing corporate apps and data wherever they’re accessed. Use controls like encryption, DLP, and conditional access. To track progress, measure how much data and how many access paths are covered by your security controls, rather than counting device enrollment.
Device control still has a place. It just isn’t the right foundation for protecting work done on hardware the company doesn’t own.