Open Source MDM
Device management software is unusually powerful: the agent it installs on every phone and laptop can push configuration, read inventory, and wipe the device remotely, so whoever runs the management server effectively holds a master key to the whole fleet. That makes where the server lives the real decision. The open source platforms here let you read exactly what the agent is allowed to do and host the enrollment and command infrastructure yourself, rather than trusting a vendor's cloud with signing keys, push certificates, and remote-wipe authority. You still work within each platform's own rules, but the sensitive parts, the device identifiers, the admin privileges, and the power to erase, stay inside infrastructure you own.
Fleet
Open MDM platform for managing, updating, and securing devices across every OS
MicroMDM
Mobile Device Management server for Apple devices with an API-first workflow
NanoMDM
Minimal Apple MDM server and library with MySQL and PostgreSQL backends
Headwind MDM
Open source mobile device management for Android with QR enrollment and web-based app deployment
Our picks
Which one fits comes down to the devices you manage and how much you want to assemble yourself.
Best for mixed-OS fleets: Fleet Fleet manages MDM, patching, and software deployment across Linux, macOS, Windows, iOS, Android, and Chromebooks from one console, so a mixed fleet does not need a separate tool per platform. It is built on osquery and deliberately collects only management data, not keystrokes or webcam access, which helps the privacy conversation on employee devices. GitOps, a REST API, and webhooks let you drive it as code.
Minimal Apple MDM core to build on: NanoMDM NanoMDM is a deliberately minimal Apple MDM server and library with MySQL and PostgreSQL backends, meant to be one component you assemble rather than a turnkey console. It scales horizontally with little local state and includes a migration endpoint for moving enrollments between backends. It expects you to supply your own TLS and SCEP, so it suits teams comfortable building their Apple stack from parts.
Best for Android device fleets: Headwind MDM Headwind MDM focuses on Android, with QR-code enrollment for Android 7 and later and a web panel for pushing apps, grouping devices, and controlling GPS, Wi-Fi, Bluetooth, and OS-update behavior. It can also run in application mode without full enrollment for lighter deployments. You can host the control panel yourself or use the cloud option.
What to settle before you enroll a single device
Enrollment decides how much an MDM can actually do, so map yours before comparing feature lists. Corporate-owned, supervised, user-owned, kiosk, and shared-device flows each expose a different set of controls, and a user-owned phone will never hand over the authority a supervised, company-owned device does. Confirm the platform supports the operating systems and enrollment programs you truly run: Fleet spans Linux, macOS, Windows, iOS, and Android from one console, while NanoMDM and Headwind MDM specialize, NanoMDM in Apple fleets and Headwind in Android with QR-code enrollment. Pick for the devices you have, not the logos on a homepage.
Policy depth matters more than a long list of checkboxes. A usable MDM handles Wi-Fi, VPN, certificates, passcodes, app allow or block lists, update deferrals, and selective or full wipe, and it models groups with inheritance and exceptions so contractors, executives, and kiosks can carry different rules. For bring-your-own-device fleets, look just as hard at the privacy boundary: what inventory the agent collects and what an admin can do to a personal phone. Osquery-based tools like Fleet make a point of collecting only management data, not keystrokes or webcam access.
Treat the server as security infrastructure, not a dashboard. MDM leans on long-lived signing keys, push certificates, and privileged APIs, so review how a project stores secrets, rotates certificates, and logs admin actions. Minimal cores like NanoMDM deliberately leave TLS and SCEP to surrounding tooling, which is more to assemble but more control. Confirm the exit too: inventory, profiles, and audit logs should export in formats your team can read during an incident.
Related categories
Frequently asked questions
What can an MDM actually control on a device?+
It depends on the operating system, who owns the device, and how it was enrolled. An MDM can install configuration profiles, enforce passcode and encryption rules, deploy or block apps, collect inventory, manage Wi-Fi, VPN, and certificates, and trigger lock or wipe. A user-owned phone in a work profile exposes far fewer controls than a supervised, company-owned device, which is why the enrollment model matters more than any feature list.
Is open source MDM realistic for iPhone and iPad fleets?+
It can be, but the MDM still works through Apple's rules: you need APNs connectivity, valid push certificates, profile signing, and supervised enrollment for the stronger controls. NanoMDM is built for exactly this as a minimal Apple MDM server. Note that MicroMDM, a longer-standing Apple option here, has entered maintenance mode with support ending, and it points new deployments toward NanoMDM. Test enrollment, app deployment, and remote wipe on real devices first.
How should I evaluate Android support?+
Check which Android management modes a tool supports: work profile for BYOD, fully managed for company-owned devices, and dedicated-device mode for kiosks. They behave differently. Headwind MDM targets Android directly, with QR-code enrollment for Android 7 and later and a web panel for app deployment and device grouping. Also test the enrollment flow, app distribution, and certificate-based Wi-Fi on a real device before rolling out to the fleet.
Does the MDM server store signing keys and certificates safely?+
This is the part to scrutinize, because an MDM depends on long-lived signing keys, push certificates, device tokens, and privileged APIs, the keys to your whole fleet. Review how a project stores secrets, rotates certificates, and logs admin actions, and whether the admin console supports role separation and multi-factor sign-in. Minimal cores like NanoMDM leave TLS and SCEP to surrounding tooling, so securing those pieces becomes your responsibility.
Can one tool manage Apple, Android, and laptops together?+
Some can. Fleet manages Apple, Android, Windows, Linux, and Chromebooks from a single console, which suits a mixed environment. The alternative is specialized tools, NanoMDM for Apple and Headwind MDM for Android, stitched together, which can give deeper platform coverage at the cost of running more than one system. Decide whether you value one pane of glass or best-fit control per platform before committing.
Can BYOD be managed without collecting personal data?+
Yes, if the tool supports the platform's work-and-personal separation and exposes clear privacy settings. Look for work-profile support, selective wipe that removes only managed data, and limited inventory collection. Fleet is explicit that it gathers only management data, not keystrokes, emails, or webcam access. Whatever you choose, write a policy that tells users exactly what the agent can see and what the company can do to their device.
How hard is it to move devices off a commercial MDM?+
It is usually a staged re-enrollment project rather than a database import, because management authority moves device by device. User-owned phones can often unenroll and re-enroll without a wipe, though managed apps and profiles are removed; supervised, company-owned devices may need release or reset depending on how they were enrolled. Plan pilot groups, a communication plan, and a deadline for devices that stay unenrolled.