There's a lot of MDM news right now, and it's tempting to treat your endpoint-management choice as the device-operations decision of the year. It's a real decision. It's just not the one that determines whether a laptop reaches a new hire in Manila or comes back from a departed employee in Warsaw. Here's the layer the MDM conversation keeps skipping.
MDM and device management is the policy layer for the calm middle of a device's life — it can't procure the laptop, deliver it to a new hire in another country, or recover it when they leave. Those are the expensive, risky, distributed parts of the employee hardware lifecycle, and they live in the physical world of couriers, customs, warehouses, and country-specific rules that no policy engine reaches. That's why you can switch MDM and device management vendors and still have no idea where half your hardware is. Two layers, two very different jobs — pick the MDM on its merits, then look honestly at the execution layer underneath.
Kandji rebranded to Iru and expanded beyond Apple. Microsoft is shifting Intune to Apple's Declarative Device Management. The Intune Suite folded into the bigger Microsoft plans with a price increase. Meanwhile Gartner is telling enterprises that PC prices are heading up roughly 17% this year — and that the alternative to growing hardware budgets 8–12% is extending the life of the devices they already own.
So IT leaders are re-evaluating the management layer at exactly the moment the lifecycle layer — the part that would let them extend device life — matters most. And in those evaluations I keep hearing MDM treated as if it's the whole of device operations. It isn't. It's one layer, and not the one that's failing.
MDM does something specific and valuable: it manages a device that's enrolled, online, and in someone's hands. Configuration, policy, security posture, updates, remote lock and wipe. For the middle of a device's life, it's essential — and the products are genuinely good.
Now look at everything MDM structurally can't do:
MDM owns the middle of the device's life — the calm part. The expensive, risky, distributed parts are the beginning and the end: getting the device to a person, and getting it back. Those live in the physical world — couriers, customs, warehouses, country-specific rules — and no policy engine reaches them.
That's why you can switch MDMs and still have no idea where half your hardware is. The management layer is crowded with excellent products. The execution layer underneath is, at most companies, a spreadsheet and whoever has time.
Make the MDM decision on its merits — platform fit, security, price. Just don't mistake it for a device-operations strategy. Two layers, two questions:
When you're reviewing MDM this quarter, add the layer-2 questions to the same evaluation sheet: When a device is offboarded, what physically happens to it? Who recovers it? Can I redeploy it instead of buying new — at this year's prices? If the answer is “a person figures it out each time,” you've found the real gap. It isn't the MDM.
To be plain about where we sit, GroWrk is not an MDM and doesn't replace yours — Intune, Jamf, and Iru are among the integrations the lifecycle runs through. GroWrk is the execution layer: procure, deliver employee-ready, recover, wipe with chain of custody, store, redeploy, retire — across 150+ countries, with one record of where every device is through global IT asset management. Your MDM manages the device while you have it. We make sure you have it, get it back, and can prove what happened to it.
MDM is the policy layer. GroWrk is the execution layer. The mistake isn't choosing the wrong MDM — it's assuming the policy layer covers the lifecycle. It never did.
Procurement and delivery — execution. Enrollment through daily policy — MDM (its actual job). Offboarding recovery, storage, redeployment, certified retirement — execution again. Out of a device's whole life, MDM owns the calm middle. Everything expensive happens at the two ends.
If you're re-evaluating MDM this quarter, good — the market gave you reasons to. Just put the layer-2 questions on the same sheet, because that's where distributed IT actually holds together or falls apart.
And a question I'd genuinely like answers to from this audience: when your MDM flags a device that's gone dark in another country, what happens next at your company, honestly?
If you want to see what the execution layer looks like alongside the MDM you already run, we would like to show you.