EMM and UEM
Enrol, configure and retire every company device the same way, whatever it runs, and tie device access to the people who should have it.
At a glance
What it is
One console for company Android, iPhone, iPad, Mac and Windows devices: enrolment, apps, access and offboarding, on platform APIs or your existing UEM.
How to start
Tell us what you need in your own words. You talk to the developers who would build it and get a written, line-item estimate.
Get a project estimateAndroid Enterprise, Apple's MDM protocol and the MDM client built into Windows all do the same broad jobs: enrol a device, apply settings, install apps, report status, and lock or wipe it. They do them differently, with different enrolment routes, capabilities and limits. A unified console hides those differences where it can and shows them honestly where it cannot: a setting that exists on Android may have no equivalent on iPhone, and the console should say so rather than pretend.
The bigger value is usually around the devices rather than on them. When HR records a new joiner, the right device and apps can be ready on day one; when someone leaves, work data is removed the same afternoon, not weeks later.
Challenges
IT switches between tools for Android, Apple and Windows, and the rules drift apart between them.
New staff wait days for a configured device, and leavers keep access to work apps longer than they should.
Email and files sit on personal phones with no clean way to remove them when someone leaves.
Nobody can quickly say how many devices the company owns, who has them and whether they are up to date.
What is included
Platform: Admin dashboard
Platform: Admin dashboard
Platform: Admin dashboard
Platform: Web app
Platform: API
How it works
Each step is triggered by an event in HR or identity, not by someone remembering to act.
A new starter is added with role, site and start date, and the console picks the device kit for that role.
A company device is assigned from stock, or the employee registers a personal phone for work apps only.
Company devices enrol through zero-touch (or a QR code where zero-touch is not available), Automated Device Enrollment or Windows enrolment; personal phones through a work profile or User Enrollment.
The role bundle installs work apps, Wi-Fi, email and VPN, with the same intent on every platform.
Email and business apps open only while the device meets the rules; a device that falls out of line loses access until it is fixed.
A role change swaps the app bundle. A leaver's company device is locked or reset; on a personal phone only the work profile or work data is removed.
Comparison
Most organisations do not need a new EMM. The right choice depends on what your current tools cannot do.
| Use an existing EMM or UEM | Extend it with custom integrations | Build a custom EMM on the platform APIs | |
|---|---|---|---|
| Time to start | Quickest: sign up and configure | Weeks, on top of the tool you have | Longest: a product to design, build and run |
| Fits unusual workflows | Only what the product offers | Yes, through its APIs and webhooks | Fully, including your own device apps |
| Platform changes | Handled by the vendor | Handled by the vendor; we maintain the integrations | Your team or ours tracks every Android, Apple and Windows release |
| Licence costs | Per device or per user, every month | The existing licence plus integration work | No per-device fee, but hosting and upkeep |
| Suits | Standard office and field fleets | Companies with gaps between HR, identity and IT tools | Companies that offer device management as part of their own product |
Privacy & security
On personal Android phones the work profile, and on personal iPhone devices User Enrollment, give IT control of work apps and data only.
The console does not collect personal apps, photos, messages or browsing from personal devices, and the platforms limit what is visible anyway.
Company-owned devices report location only where the management mode allows it, for a stated reason and with notice to staff. Personal devices are never located.
Employees see what the company can and cannot see before they enrol, in line with the Digital Personal Data Protection Act, 2023.
Platforms
Company and personal Android devices, iPhone and iPad, Mac and Windows PCs, plus the console and the self-service portal.
Android phones, tablets and rugged handhelds with Google Play services, managed through Android Enterprise: company-owned devices as fully managed, dedicated (kiosk) or work-profile devices, and personal phones through a work profile only.
Organisation-owned or shared iPhone and iPad devices enrolled in MDM through Apple Business or Apple School Manager, supervised for Single App Mode and stricter restrictions.
Mac computers enrolled in MDM for configuration profiles, app and package installs, disk encryption settings and software update rules, set up at first power-on when the purchase is linked to Apple Business.
Windows laptops and desktops managed through the MDM support built into Windows or an existing UEM, when PCs need to sit in the same console and reports as phones and tablets.
Back-office panels for operations, support and finance teams: orders, users, content, reports and permissions.
Browser-based applications with logins, roles and workflows, such as customer portals, SaaS products and internal tools.
Technology
Each platform keeps its own management API; our backend turns them into one list of devices, one set of rules and one set of reports.
Device management
A Google cloud API for device-management products: your console sets the rules, and a Google app on each Android device applies them.
Used for
Device management
Built-in Android APIs that let one trusted app control a company device: kiosk lock, silent app updates and restrictions, even without Google Play.
Used for
Device management
The management channel built into iPhone, iPad and Mac: an MDM server sends settings, apps and commands, and devices apply them remotely.
Used for
Device management
The Apple portal for organisations, now called Apple Business: devices bought from Apple or linked resellers are assigned to your MDM and set up at first power-on.
Used for
Backend
Runs the server side of apps: fast, scalable back ends that power your app, website and integrations.
Used for
Backend
A structured way to build back ends on Node.js, so large business systems stay organised, testable and easy to hand over.
Used for
Data
A reliable database for the records your business runs on: orders, payments, bookings and stock, kept accurate and easy to report on.
Used for
Data
Keeps frequently used data in fast memory, so apps stay quick on busy days and live features like order tracking feel instant.
Used for
Web
Builds interactive screens in the browser, such as dashboards, admin panels and portals, that respond instantly as your team works.
Used for
Web
A modern web technology for fast, search-friendly websites, online stores and web applications that load quickly on mobile.
Used for
Cloud & DevOps
Cloud hosting for your app, website and data, with data centres in India and room to grow when traffic rises.
Used for
Cloud & DevOps
Packages your software so it runs the same way on every laptop and server, which makes releases predictable and moving hosts easier.
Used for
Plain-English glossary
Product preview
Illustrative screens; names, counts and versions are samples.
Sample screens: names, prices and figures are examples, not client data.
Work
Device management & kiosk solutions
An illustrative kiosk product for retail chains: locked Android tablets for catalogues and price checks, a staff launcher, and a console to enrol, update and monitor every device.
Runs on
Built with
Device management & kiosk solutions
An illustrative console for school tablets: iPad devices through Apple School Manager and MDM, Android™ tablets through Android Enterprise, with class-based rules teachers can follow.
Runs on
Built with
Cost drivers
Each platform has its own protocol, enrolment routes and test devices. Android and Apple together cost more than either alone, and Windows adds another layer.
Extending an existing UEM through its API is far smaller than building a console on the platform APIs and keeping it current with every OS release.
HR, identity, helpdesk and asset systems are estimated per system, depending on the APIs they offer.
Supporting personal phones adds work profile and User Enrollment flows, privacy notices and support guides.
A console on the Android Management API needs Google's approval and a device quota; your own Apple MDM server needs MDM vendor access from Apple.
Moving devices between EMMs often means re-enrolling them, which needs planning per site and clear communication with users.
Estimates are written from your scope, with the effort and assumptions behind each line item.
How pricing worksProcess
We map platforms, ownership, current tools, licences and the HR and identity systems involved.
You getFleet and systems map
Use, extend or build: we recommend one and put the reasoning and trade-offs in writing.
You getRecommendation and estimate
We write one set of rules per role and translate it for each platform, noting where a platform cannot match.
You getCross-platform policy matrix
One department runs the new setup, including a leaver drill and a lost-device drill.
You getPilot report
Departments move in waves; we then maintain the integrations and adapt rules as the platforms change.
You getSupport plan
Solutions
Android MDM consoles, backends and device agents built on the Android Management API or a custom device-owner app, for EMM products and specialised fleets.
MDM for company iPhone, iPad and Mac devices: automatic enrolment, supervision, apps, OS updates and remote lock, as a custom build or an integration.
Compliance rules for Android, Apple and Windows devices: passcodes, encryption, OS updates, app lists, remote lock and wipe, audit logs and reports.
Zero-touch, QR code, Knox Mobile Enrollment and Apple Automated Device Enrollment set-ups that take devices from the box to ready-to-use.
Services
The disciplines a project like this draws on.
Multi-tenant SaaS products with subscription billing, team roles, onboarding and usage analytics, from first MVP to paying customers.
Software shaped around how your business runs, from approvals and inventory to billing and reports, replacing spreadsheets and disconnected tools.
Back-office dashboards built around your team's daily tasks: order queues, approvals, catalogue management, payouts, reports and audit logs.
Secure, documented REST and GraphQL APIs, plus integrations that connect your apps to payment, logistics, GST, messaging and business systems.
Native Android apps in Kotlin and Jetpack Compose, designed for entry-level phones, patchy networks and the background limits of popular Android brands.
Native iPhone and iPad apps in Swift and SwiftUI, built to Apple's review guidelines and privacy rules and tested on the devices your customers use.
Industries
Industries where this kind of product fits well.
FAQ
MDM (mobile device management) controls the device itself: enrolment, settings, restrictions, lock and wipe. EMM adds control of apps and company data on top, which is what makes personal-phone setups workable. UEM extends the same idea to laptops and desktops, so Windows PCs and Mac computers are managed alongside phones and tablets. In practice the labels overlap and vendors use them loosely; what matters is which platforms and ownership types you need to cover.
Yes. A Windows PC can be enrolled in only one MDM at a time, so replacing a working UEM for laptops rarely makes sense. We connect Intune to the rest of your setup through Microsoft Graph, which lets a custom console or report read device and compliance status and trigger actions such as sync or wipe, subject to your Intune licence and the permissions you grant. Phones can stay in Intune too, or sit in another tool if that suits you better.
It depends on who the EMM is for. Google offers the Android Management API to commercial EMM developers that have direct agreements with their end customers, and its usage policy excludes solutions “developed and used exclusively for first party in-house applications”, as well as device-financing locks and monitoring-only tools. If device management is part of a product you sell, the API is usually the right base, subject to Google's approval and device quota. For your own fleet alone, we integrate an established EMM or build on a custom device-owner app.
Only the work side. On Android, a work profile keeps work apps and data in a separate space; IT manages that profile, not personal apps, messages, photos or location. On iPhone, User Enrollment works in a similar way through a Managed Apple Account. When someone leaves, removing the work profile or ending management deletes work data and leaves the rest of the phone alone. We show employees this in plain words before they enrol.
It depends mostly on re-enrolment. Company-owned Android devices set up as fully managed usually need a reset to move to a new EMM. Apple devices enrolled through Automated Device Enrollment and running iOS, iPadOS or macOS 26 or later can be moved to a new MDM from Apple Business or Apple School Manager with a deadline, usually without being erased, although users are prompted to re-enrol. We plan migrations site by site, keep both systems running during the change and schedule resets around shifts so work does not stop.
The same intent, yes; identical settings, no. A rule such as “screen lock of at least six digits, storage encrypted, OS no more than one version behind” maps to each platform in its own way, and some settings exist on one platform only. Our consoles keep one policy per role and show, per platform, how it is applied or where it cannot be, so nobody assumes protection that is not there.
Related
Next step
Tell us which platforms you run, how many devices you have and which tools you already use. We will recommend use, extend or build, with a line-item estimate.
