MDM for Growing Companies: What to Enforce in Your First 90 Days

A 60-person company that hires ten people in a quarter usually ends up with just as many new laptops and phones landing outside whatever device policy already existed. Nobody decided to skip device management. It happened because IT wasn't in the room when the laptops were ordered, and logins went out before anyone asked what those devices would be allowed to touch. The gap stays invisible until a laptop is lost with company files still on the drive, or a client's security questionnaire asks a question nobody in the company can answer.

What Mobile Device Management Actually Means

Mobile device management, usually shortened to MDM, is the software and policy layer that lets a company enforce security settings on every device that touches its systems, without someone physically handling each one. That covers laptops, phones, and tablets, whether the company owns them outright or an employee is using their own. A working MDM setup can push encryption and passcode requirements automatically, block a device from company email or files the moment it falls out of compliance, and wipe a device remotely if it's lost, stolen, or its owner leaves the company.

That's a different job than antivirus or a firewall. Those protect the network perimeter. MDM protects and enforces policy on the device itself, which matters more every year because most of a growing company's actual exposure now sits on endpoints that leave the building every day, not on a server rack behind a locked door.

Why the Gap Shows Up Between 25 and 200 Employees

Below roughly 25 employees, a founder or office manager can usually track every laptop and phone by memory, and informal habits mostly hold. Above 200, most companies have already been forced to formalize device policy, often by a compliance requirement, a cyber insurance renewal, or a client's vendor security review that demanded it as a condition of doing business.

The messy middle is where this breaks down. Headcount is growing fast enough that new devices show up every few weeks, but nobody has been assigned to own device policy specifically, so it defaults to whatever the hiring manager or new employee happens to set up on day one. The company isn't small enough for informal tracking to work anymore, and it hasn't yet hit the size or the external pressure that forces a formal process. That's exactly the window where an unmanaged device is most likely to sit quietly for months before it becomes a problem.

What the Data Says About Skipping It

The financial case for closing this gap isn't abstract. According to IBM's Cost of a Data Breach Report 2025, the global average cost of a data breach was $4.44 million, and the single biggest driver of that cost is how long a breach goes undetected: incidents contained within 200 days averaged $3.61 million, while ones that took longer averaged $5.49 million, a gap of $1.88 million tied directly to detection and containment speed. A managed device reports its compliance status continuously. An unmanaged one doesn't, which means a company usually finds out about a problem only after it's already serious.

Small and midsize businesses aren't a footnote in this data, they're a disproportionate target. Verizon's 2025 Data Breach Investigations Report found ransomware present in 88% of SMB breaches, compared with 39% at larger organizations, with a median ransom demand of $115,000. The same research traced credential-stealing malware infections and found that 46% of compromised systems carrying corporate logins were personal, unmanaged devices mixing business and personal use, which is exactly the population a device management and BYOD policy is built to bring under control. The report also found that only 54% of known vulnerable edge devices were fully patched within the study window, with a median remediation time of 32 days, a gap that automated patch enforcement through MDM closes directly instead of leaving it to whoever remembers to click "update."

The First 90 Days: What to Enforce, and When

Trying to enforce everything on day one usually backfires, either because IT support gets buried in tickets or because employees push back on a sudden lockdown of devices they've used freely for months. A phased rollout, based on the device lifecycle guidance in NIST SP 800-124 Revision 2 and the enforcement checklist published by CISA, gets a company from no policy to enforced policy without breaking day-to-day operations.

Milestone	Timeframe	What Gets Enforced
Inventory	Days 1-15	Every device touching company data gets cataloged
Enrollment	Days 1-30	All company-owned devices enrolled in MDM
Baseline security	Days 15-30	Encryption, passcode lock, auto-wipe after failed attempts
BYOD policy	Days 30-45	Written policy plus containerization for personal devices
Conditional access	Days 45-60	Non-compliant devices blocked from company systems
Patch enforcement	Days 45-75	OS and app updates pushed automatically, not left to users
Remote wipe test	Days 75-90	Wipe process tested end to end on at least one device
Offboarding tie-in	Days 75-90	Device return and wipe added to the standard offboarding checklist

Each step depends on the one before it. Enrollment without an accurate inventory misses devices by definition. Conditional access rolled out before the BYOD policy is finished locks employees out of tools they legitimately need on personal phones. The order matters almost as much as the individual controls.

Company-Issued vs. BYOD: Decide the Policy Before the Devices Show Up

Every growing company eventually has this conversation, usually right after someone asks whether they can check email from a personal phone. Company-issued devices are the easier half: IT configures them before an employee ever touches one, and MDM enrollment happens as part of standard provisioning. BYOD is harder, because the company doesn't own the hardware and can't dictate everything running on it.

NIST SP 800-124 Revision 2 treats BYOD as its own deployment model, not an informal exception, and recommends containerization: separating a walled-off work profile from the rest of the device so company data can be wiped without touching personal photos, messages, or apps. A written BYOD policy that spells out exactly what the company can and can't see or control on a personal device isn't optional if BYOD is allowed at all. Skipping that step is how a routine remote wipe after someone's last day turns into a legal dispute instead of a five-minute offboarding task.

Where Device Policy Breaks Down After It's Written

A written policy that never gets enforced is functionally no policy at all. Two places this tends to happen even at companies that did the initial rollout correctly.

Conditional access gets skipped because it's the step most likely to generate help desk tickets in the first week. Blocking a non-compliant device from email or file access surfaces every device the company forgot about, which is uncomfortable in month one and exactly the point of doing it. Microsoft's own guidance on device compliance and Conditional Access describes this as the mechanism that actually makes a device policy binding instead of advisory: the identity provider checks a device's compliance status before granting access, not after.

Offboarding is the other common failure point. Device return and remote wipe need to be a required line item on the standard offboarding checklist, tied directly into HR's process, not something IT remembers to do if someone happens to flag it. A device that was properly managed on day one but never gets wiped on someone's last day was never really managed at all, it just hadn't been tested yet.

Frequently Asked Questions

How much does implementing MDM cost for a company our size?

Cost scales with device count more than headcount. Most MDM platforms price per device per month, typically a modest per-device fee, so a 75-person company with roughly 90 managed devices is usually looking at a manageable recurring software cost. The bigger cost is labor: inventorying every device, writing the policy, and testing enforcement, which is why most companies treat the rollout as a defined project with a start and end date rather than an ongoing task nobody owns.

Do we need to replace our current IT support or MSP to do this?

No. MDM implementation sits on top of the device support most managed IT providers already deliver, and many managed IT contracts already include an MDM platform as part of the baseline service. If yours doesn't, adding one is typically a configuration project layered onto the existing relationship, not a reason to switch providers. The actual gap at most companies is that nobody has been assigned to own writing and enforcing the policy itself, which is a leadership decision more than a tooling one.

Does this apply if most of our team already uses personal phones and laptops?

Yes, and it applies more urgently. BYOD environments without a written policy and device containerization are exactly the population both NIST and CISA guidance flag as highest risk, since personal devices mix business and personal use with no separation between them. A BYOD-heavy company still follows the same 90-day framework, it just starts with the BYOD policy and containerization step rather than treating it as an afterthought.

How long does enrollment actually take across a distributed or remote team?

For a fully remote or distributed team, enrollment usually still fits the same 90 days, it just relies more heavily on zero-touch enrollment, where a device ships to a new employee already configured, rather than IT physically handling each one. The timeline mostly stretches when the initial device inventory is incomplete, since tracking down devices nobody knew were still active takes longer than enrolling ones that are already documented.

What happens to company devices when someone leaves?

With MDM in place, offboarding becomes a checklist item instead of a scramble: the device is remotely wiped or its work profile removed, access to company systems is revoked automatically the moment the device falls out of compliance, and the hardware gets retrieved per the company's return policy. Without MDM, that process depends entirely on someone remembering to manually revoke access and hoping the device eventually comes back, which is where most of the real risk in offboarding actually lives.

How do we get started?

The first step is a full device inventory: every laptop, phone, and tablet currently touching company email, files, or systems, whether the company issued it or not. That inventory alone usually surfaces devices nobody realized were still active. From there, the 90-day framework above sets the enforcement order, starting with enrollment and baseline security settings before moving on to conditional access and remote wipe testing.