Multi-tenant mobile device management (MDM) is a critical tool for managed services providers (MSPs) that provide IT services to multiple organizations. It enables security and confidentiality, and helps keep your MSP efficient and scalable.
This guide explains the important factors and features that you should assess when choosing the multi-tenant MDM that will form the foundation of the managed services your MSP offers.
What is multi-tenant MDM?
MDM is a software tool that is used for the remote configuration and management of mobile devices, including phones, tablets, and laptops. Top-billed features you should consider when choosing an MDM include:
- Deployment and inventory: MDM that integrates with vendors’ zero-touch solutions means you can ship devices directly to users, who will then enroll themselves with your MDM when they are powered up, and be tracked as inventory.
- Configuration and security: Once enrolled, devices can receive configurations and security policies (like enforcing device encryption) that can be updated remotely.
- App management, updates, and patching: Manage which apps are installed for users and groups, deploy updates, and enforce patch compliance.
- Remote monitoring and troubleshooting: While direct remote access is usually a separate product, MDM usually includes tools to monitor and help troubleshoot end-user devices.
- Remote lock, wipe, and deprovisioning: Misplaced devices can be remotely locked until they are found, and stolen, or obsolete devices can be securely wiped to ensure sensitive data is protected.
Multi-tenant mobile device management fills the same roles and performs the same tasks – but for multiple organizations rather than just one.
What managing multiple companies requires from MDM
Single-tenant MDM is designed for use within one business, and makes assumptions based on this, the primary outcome of this being limited isolation between logical groups of users or devices.
Multi-tenant MDM for managing the devices for multiple organizations requires the following:
- Core MDM features: Multi-tenant mobile device management should build on the popular MDM features outlined above.
- Separate environments for each client: Access to client systems and data should be restricted and independently granted, with no cross-contamination.
- Centralized visibility across all clients: Consolidating clients in a single tool should see additional efficiency benefits.
- Role-based access controls: Your MSP’s identity and access should be used to grant access to individual tenant resources.
If you manage a single organization or are an internal team, you may not need a multi-tenant MDM – though you shouldn’t rule out solutions that offer it as a feature.
What MSPs should evaluate when choosing a multi-tenant MDM
End-user mobile devices contain highly sensitive data, from proprietary business information to customer data that must be protected for compliance reasons. Remote work, BYOD, and the unique management and security complexities they introduce can quickly overwhelm MSPs who rely on fragmented, inefficient tools and workflows.
Tenant isolation
Security and compliance are compromised if single-tenant MDM tools are used to manage the devices for multiple organizations. There should be no cross-tenant visibility unless explicitly allowed: configurations, data, and access must be separate in their own environment.
Role-based access control (RBAC)
In addition to your in-house technicians, your clients will often want access to their own MDM systems. Role-based access control lets you grant the right technicians and stakeholders access only to the resources they are permitted on a per-tenant basis.
Somewhat counterintuitively, bringing all of your clients into the same platform can enhance overall security: rather than separately managing access controls across different single-tenant accounts or MDM platforms, you have granular control and centralized oversight, and can grant and revoke permissions across all client environments at a moment’s notice.
Centralized management dashboard
Beyond isolation and security, multi-tenancy enables efficiency. Being able to effectively manage the devices for multiple organizations through a single portal with complete oversight reduces operational complexity.
Remote automation and policy management
IT automation is no longer a ‘nice to have’; it is vital for keeping up with client expectations. You should be able to apply standardized policies and configurations, and deploy scripts from templates shared across clients (and later tailored to their unique needs) to reduce duplication of work.
Monitoring, reporting, and alerts
While device health and monitoring data and reports should be isolated per-tenant, alerts and activity tracking should be visible in a centralized dashboard for technicians who have been granted access. This removes the need for checking multiple dashboards and improves visibility and accountability – and quickly helps identify where devices may have drifted out of configuration or compliance.
Approaches for MSPs managing multiple company devices using MDM
While it’s technically possible to use single-tenant MDM software to manage multiple clients, it is usually not feasible from practical, security, and compliance perspectives. If multi-tenancy is not an option, or if clients are already invested in their own separate MDM solutions, single-tenant, per-client MDM deployments are sensible.
However, for MSPs, gradually transitioning clients with appropriate requirements to a single multi-tenant platform is often worth the effort for long-term operational advantages. In some cases, tools can be mixed in a hybrid or bespoke solution that grants centralized visibility over isolated single-tenant environments, where only diagnostic data is shared. This can be useful in regulated environments.
Other factors MSPs should look out for to enhance multi-tenancy
MSPs rely on efficiency to provide fast, effective service while remaining profitable. This makes fast onboarding of new clients and devices a must for all of their tools, including MDM. Standardization and reducing duplication of work, and interfaces that account for multi-tenant environments are also required for optimized workflows.
Integration with other tools is also critical: remote backup, remote access, and helpdesk tools should work in lock-step with your MDM to ensure your technicians are not stuck shuffling between tools when trying to solve problems.
Trade-offs when choosing multi-company MDM
Different MDM vendors, product tiers, or configuration options present tradeoffs between security, efficiency, cost, and other practical factors. These include:
- Centralization vs. strict isolation
- Ease of use vs. advanced customization
- Cost vs. scalability
- Automation vs. manual control
You should fully vet each of your MDM options to ensure that these tradeoffs make sense for you and your clients.
Why you should look for more than MDM
Managed IT services don’t just cover mobile devices. Desktops and servers require remote monitoring and management (RMM), networks need continuous monitoring, cloud resources need oversight, and the people who rely on all of these components themselves need proactive help.
Fragmented toolchains lead to gaps in oversight and security, and result in slow workflows. When choosing an MDM, you should look for one that readily integrates with the other IT management tools you rely on, or adopt one that is already part of an IT management platform with an ecosystem of connected tools.
Common mistakes when selecting multi-tenant MDM
There are a few common pitfalls to watch out for when selecting an MDM solution (as well as other IT management tools).
The first is mistakenly thinking that you can get away with single-tenant tools for multi-tenant environments: while this may save on licenses or seats initially, this will be offset by the additional drag in your workflows, and the security and compliance problems it may introduce could be detrimental to your business.
Assumptions about tenant separation capabilities should also be avoided: what is considered ‘isolated’ for practical purposes may not meet compliance concerns. Many multi-tenant MDM and MSP platforms obtain compliance themselves to assist you in providing compliant managed IT services.
Unifying MDM, RMM, remote access, helpdesk, and more, in a single multi-tenant platform
NinjaOne brings together MDM, RMM, remote access, helpdesk, self-service documentation, and monitoring under a single, multi-tenant platform for MSPs that need a complete IT toolchain that covers all their clients.
It’s cost-efficient, with flexible per-device, per-month subscriptions that scale with your business. NinjaOne keeps your tenants isolated, while granting oversight and control, with robust access controls and proven compliance with an increasing number of industry, government, and regional regulations.
