Device management platform (MDM): what it is and how it is attacked
The system that configures every laptop and phone, and can install software on all of them.
Also known as
- MDM
- UEM
- Intune
- Jamf
- SCCM
- mobile device management
- endpoint management
- unified endpoint management
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It can run code on every device in the estate by design, which makes it a single point that reaches further than any server. It usually decides what counts as a healthy device, so it also decides who gets in.
How it gets attacked, and what reduces it
How it gets attacked
- An administrator account on the platform, which is code execution on every enrolled device
- Weakening the health rules so an unmanaged device is treated as compliant
- Devices never enrolled, which the platform cannot configure and nobody counts
What reduces it
- Treat platform administration as the most privileged role you have, with a phishing-resistant second factor and separate accounts
- Alert on new deployment packages and on changes to the compliance rules, which are the two levers worth pulling
- Reconcile enrolled devices against the staff list, because the gap is the part nobody is managing
Where it sits
- Group
- Identity · Who something claims to be, and what proves it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- device-management
Reviewed . CC BY 4.0.
Others in identity
- Sign-in serviceIdP · SSO · identity provider · Entra ID · OktaThe single service that proves who someone is, for every application.
- Directory serviceActive Directory · AD · DC · LDAP · domain controller · staff directory · identity storeThe system that holds every account and computer, and decides what each one is allowed to do.
- Second factorMFA · 2FA · multi-factor authenticationA second proof of identity beyond the password.
- Machine accountservice account · robot account · non-human account · application accountAn account used by software rather than by a person.
- CertificateTLS certificate · PKI · code signing certificateA digital document proving something is genuinely what it claims to be.
- Access badgeproximity card · prox card · RFID card · fob · smart card · staff passThe card or fob a person holds against a reader to open a door.
The identity group lists all 7 of them side by side.
Device management platform on your own diagram
Open the editor, press N, and type MDM. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker