ManageEngine MDM Plus Full Guide to Manage All Mobile Devices

MDM Plus is built for mobile devices only — it is not a computer management tool. It manages:

• Android phones and tablets (company-owned and personal BYOD)
• iOS — iPhone and iPad, plus macOS and Apple TV support in the same console
• Windows and Chrome mobile-class devices, and rugged handhelds used in warehouses and delivery
• Shared and kiosk devices — attendance machines, billing counters, display tablets

For Windows laptops and desktops, ManageEngine's product is Endpoint Central — a different console covered in a separate video. Do not try to manage PCs from MDM Plus.

MDM Plus comes in two forms. Pick one before anything else:

1. Cloud version — sign up on ManageEngine's site and log in; no server to maintain, works from anywhere
2. On-premises version — install the MDM server on a Windows machine in your office; devices must be able to reach it, so most small offices prefer the cloud
3. Log in to the console and complete the first-run setup — organisation name, admin email and timezone
4. Keep the admin account safe with a strong password — this console can wipe every company phone

Android can start immediately, but iPhone and iPad management is impossible without an APNs certificate — Apple's permission slip for your server to talk to iOS devices.

1. In the console go to Enrollment → APNs Certificate and download the vendor-signed CSR file
2. Sign in to the Apple Push Certificates Portal with a company Apple ID (never a personal one) and upload the CSR
3. Download the certificate Apple generates and upload it back into the MDM console
4. Note the date: the certificate is valid for one year and must be renewed with the same Apple ID — if it expires, every iOS device silently stops being managed

Enrollment is the one-time joining process. The right method depends on who owns the device:

1. Company Android — QR code (EMM token) enrollment after a factory reset, Zero Touch for bulk purchases, or Samsung Knox for Samsung fleets
2. Company iPhone/iPad — Apple Business Manager (zero-touch) or Apple Configurator for smaller numbers
3. Personal phones (BYOD) — email/SMS invite or self-enrollment; Android gets a separate Work Profile, so company control stays inside the work side only
4. After enrollment, confirm each device appears under Inventory → Devices with its owner, model and OS version

Every method, with its exact steps, has its own guide in this series — QR/Zero Touch/Knox for Android, and ABM plus APNs for iOS.

A profile is a bundle of settings pushed together — Wi-Fi, passcode rules, restrictions, email, VPN. A group is a set of devices that receives the same profiles.

1. Create groups the way your office actually works — Office Staff, Field Team, Attendance Devices, Directors
2. Build profiles per need: Wi-Fi profile with the office network, a passcode policy, restrictions like blocking the camera on secure floors
3. Associate each profile with its group — devices receive it automatically on the next sync
4. Change a setting once in the console and it reaches every device in the group — this is the entire point of MDM

No more asking staff to install apps themselves. From the Apps tab you can:

1. Add Play Store / App Store apps and your own in-house (APK/IPA) apps to the app repository
2. Assign apps to groups — on company devices they install silently, without the user doing anything
3. Block unwanted apps with a blocklist, and keep a ready app catalog for BYOD users to pick from
4. Watch install status per device, so you know exactly which phone still has not received the update