Difference between Microsoft 365 MDM and Microsoft Intune MDM

Question

Hi there,

Basically, I'm so confused about the Windows' MDM system. I was trying to develop my own MDM solution based on https://learn.microsoft.com/en-us/windows/client-management/mdm-overview. However, I've just found another link that seems to be saying about MDM as well, https://learn.microsoft.com/en-us/mem/configmgr/mdm/.

Based on just a short glimpse, I think they differ as Microsoft 365 MDM document and Microsoft Intune MDM document.

Which one is the right one for my need???? I'm going to control Windows devices distributed to students.

Anyone's help and clarification on this issue would be really appreciated.

Thanks in advance.

Answer 1

Microsoft 365 MDM is a lightweight MDM solution that is built into Microsoft 365. It provides basic MDM capabilities, such as the ability to:

• Wipe devices
• Set passcodes
• Require encryption
• Install apps

Microsoft Intune MDM is a more comprehensive MDM solution that is not part of Microsoft 365. It provides a wider range of MDM capabilities, such as the ability to:

• Wipe devices
• Set passcodes
• Require encryption
• Install apps
• Configure device settings
• Manage mobile apps
• Restrict access to corporate data

Intune also integrates with other Microsoft solutions, such as Azure Active Directory (AAD), to provide a more comprehensive security solution.

Here is a table that summarizes the key differences between Microsoft 365 MDM and Microsoft Intune MDM:

Cost	Included in Microsoft 365	Purchased separately
Capabilities	Basic MDM	Comprehensive MDM
Integrations	Not integrated with other Microsoft solutions	Integrated with AAD and other Microsoft solutions

Ultimately, the best MDM solution for your organization will depend on your specific needs and requirements. If you only need basic MDM capabilities, then Microsoft 365 MDM may be a good option. However, if you need more comprehensive MDM capabilities or integration with other Microsoft solutions, then Microsoft Intune MDM may be a better option.

More details:

Microsoft 365 MDM (Mobile Device Management) and Microsoft Intune MDM are both mobile device management solutions offered by Microsoft, but there are some differences between the two:

1. Microsoft 365 MDM: Microsoft 365 MDM is a built-in solution that is included with certain Microsoft 365 plans, such as Microsoft 365 Business Premium or Microsoft 365 Enterprise. It provides basic mobile device management capabilities to manage and secure devices accessing Microsoft 365 services. With Microsoft 365 MDM, you can enforce policies, such as requiring device passcodes, managing device settings, and performing selective wipe of Microsoft 365 data on devices.
2. Microsoft Intune MDM: Microsoft Intune is a standalone comprehensive mobile device management and application management solution. It offers more advanced and granular control over mobile devices across various platforms, including iOS, Android, Windows, and macOS. Intune provides a wide range of device management capabilities such as conditional access policies, app management, mobile application management (MAM), and integration with other Microsoft 365 services like Azure Active Directory (AAD) for identity and access management.

In summary, while Microsoft 365 MDM is a basic mobile device management solution included with specific Microsoft 365 plans, Microsoft Intune is a more feature-rich standalone MDM solution that offers a broader range of management and security capabilities for devices accessing both Microsoft 365 services and other resources outside the Microsoft ecosystem.

Answer 2

Hi Dj Moon

From experience, Microsoft can be used, and it is good, but from my point of view, it lacks many advantages, and as you know nothing is perfect. Many companies follow a policy of paying an amount for each endpoint, for example, you may find it difficult to publish and update apps and software once on each endpoint, in this case a lot goes to System Configuration Manager, so it depends on what you want.

you want to protect by using antivirus / antimalware with MDR for all endpoints with central management

or

you want to protect by using antivirus / antimalware with MDR for all endpoints with central management in addition to control & manage software " deploy package, upgrade, uninstall...etc"
you can read about: Chocolatey, PDQ and ManageEngine desktop central
and for MDR : Sophos, ESET as example

I know that it is not easy and has many complications and also requires consideration of many financial matters.

Answer 3

Microsoft Endpoint Manager Documentation:

• Microsoft Endpoint Manager (formerly Intune) is Microsoft's unified management solution for Windows endpoints. The documentation provides comprehensive guidance on device management, application management, security policies, and more. Visit the Microsoft Endpoint Manager documentation website: https://docs.microsoft.com/en-us/mem/

Microsoft Graph API Documentation:

• Microsoft Graph API offers a unified endpoint to interact with various Microsoft services, including endpoint management capabilities. The documentation provides details on using Graph API to manage Windows devices, applications, policies, and more. Visit the Microsoft Graph API documentation website: https://docs.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0

Microsoft Partner Center:

• Microsoft Partner Center provides resources for partners and developers looking to build solutions on Microsoft technologies. You can explore the partner documentation and guides to understand the requirements, capabilities, and integration options for building Windows endpoints management solutions. Visit the Microsoft Partner Center website: https://partner.microsoft.com/

Third-Party Endpoint Management Solutions:

• Consider exploring third-party vendors that provide Windows endpoints management solutions. Some notable vendors include VMware (Workspace ONE), Citrix (Workspace), Ivanti (Endpoint Manager), and Symantec (Endpoint Management). Visit their websites and developer portals to access relevant documentation, APIs, and integration examples. Each vendor usually provides resources specific to their solution.

Developer Blogs and Forums:

• Stay updated with the latest developments, best practices, and discussions in the Windows endpoints management space. Microsoft Developer Blogs, Stack Overflow, and other developer communities often have valuable insights, code samples, and examples related to Windows endpoint management. Search for relevant topics and participate in discussions to learn from the community.

It's important to note that developing a comprehensive Windows endpoints management solution requires significant expertise in device management, security, network protocols, and related technologies. Building such a solution from scratch can be complex and time-consuming. Therefore, consider evaluating the effort and resources required before deciding to develop your own solution.

Answer 4

Hi DJ Moon

you mentioned:

• As for the answer to your comment, which one I want, I want 2-protect by using antivirus / antimalware with MDR for all endpoints with central management in addition to control & manage software " deploy package, upgrade, uninstall...etc"

You need all the features so; one solution is not enough.

Therefore, you notice many companies offer solutions that are linked with Microsoft Azure to compensate for the missing features, and therefore you will have to pay money to both parties :)

as you said:

"Also we're thinking to use On-premises server to manage our devices, by which I mean we're going to build our own server that will use the Windows MDM module we'll be developing, and whether the module is going to use API or not doesn't matter for now(actually, we thought of not using them at first, since they might charge us, but with your strong suggestion on using them, we're considering it now)."

Thank you for your trust in my opinion, but you know that using the cloud or on-prem each has its advantages, you will need a server, maintenance, backup plan, and in return there is nothing in the cloud without paying, but you on-prem you know every small and large element in your project without limits.

so, you can get a workstation computer, install windows server and make it your pilot project

solution for software management and deployment can i use in the On-premises server

Docker: Docker is a popular containerization platform that allows you to package applications and their dependencies into lightweight, portable containers. It provides a consistent and reproducible environment for deploying and managing software on on-premises servers.

Kubernetes: Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It provides advanced features for load balancing, scaling, and fault tolerance, making it suitable for large-scale deployments on on-premises servers.

Ansible: Ansible is an open-source automation tool that enables you to automate software provisioning, configuration management, and application deployment. It uses a declarative language to define configurations and can be used to manage on-premises server infrastructure efficiently.

1. Puppet: Puppet is a configuration management tool that allows you to define and enforce the desired state of your infrastructure. It provides declarative language for describing system configurations and can be used for software deployment, configuration management, and orchestration on on-premises servers.

Chef: Chef is another popular configuration management tool that uses a domain-specific language (DSL) to define system configurations and policies. It provides a flexible and scalable solution for managing software deployment and infrastructure configuration on on-premises servers.

Jenkins: Jenkins is a widely used open-source automation server that supports continuous integration and continuous delivery (CI/CD). It enables you to automate the build, test, and deployment processes of your software on on-premises servers.

On-Premises Security Products for central management

product for central management depends on various factors such as your specific security requirements, budget, the size of your organization, and the complexity of your infrastructure.

Symantec Endpoint Protection Manager (SEPM): SEPM is a comprehensive endpoint security solution that provides antivirus, firewall, intrusion prevention, and advanced threat protection. It offers a centralized management console for easy deployment, configuration, and monitoring of security policies across endpoints.

McAfee ePolicy Orchestrator (ePO): ePO is a central management console that provides a unified view of your security infrastructure. It allows you to manage and enforce security policies, deploy security updates, and monitor endpoints, network devices, and data protection across your organization.

Trend Micro Apex Central: Apex Central is a centralized management console that allows you to manage and monitor endpoint security solutions from Trend Micro, including antivirus, web filtering, behavior monitoring, and more. It provides a single pane of glass for managing security across endpoints.

Sophos Central: Sophos Central is a cloud-based security management platform that offers a range of security products, including endpoint protection, firewall, encryption, and mobile device management. It provides a unified console for centralized management, reporting, and threat intelligence.

Cisco Security Manager: Cisco Security Manager is a centralized management platform for Cisco security devices, including firewalls, intrusion prevention systems, and VPN gateways. It enables you to configure, monitor, and manage security policies across your network infrastructure.

IBM Security QRadar: QRadar is a security information and event management (SIEM) solution that provides centralized log management, threat detection, and incident response capabilities. It offers a comprehensive view of security events and enables you to manage and investigate security incidents from a central console.

---

your questions:

yes, you can have options for integrating and leveraging APIs between Microsoft Graph API and other third-party applications or resources such as ZENworks. Microsoft Graph API is a powerful and comprehensive API provided by Microsoft that allows you to access and interact with various Microsoft services and resources, including Office 365, Azure Active Directory, SharePoint, and more.

When it comes to third-party applications like ZENworks, which is a systems management and endpoint security solution provided by Micro Focus, there may be integration possibilities depending on the availability of APIs or integration capabilities provided by the specific application.

Here are a few scenarios:

Integration through Microsoft Graph API: Microsoft provides extensive documentation and resources for integrating with Microsoft Graph API. You can explore the capabilities of Microsoft Graph API and leverage it to interact with Microsoft services. For example, you can use the API to manage user accounts, access SharePoint resources, retrieve Office 365 data, and more. You may need to refer to the documentation and specific endpoints provided by Microsoft Graph API to understand the available integration options.

Integration through ZENworks APIs: ZENworks may provide its own set of APIs or integration capabilities that allow you to interact with its management and security features. These APIs could provide functionality to manage and secure endpoints, deploy software, configure policies, and more. You can refer to the documentation and resources provided by ZENworks to explore the available APIs and integration possibilities.

Custom Integration: If there is no direct integration available between Microsoft Graph API and ZENworks, you may consider building a custom integration using intermediary components or integration platforms. For example, you can develop custom code or leverage integration platforms like Zapier, Microsoft Power Automate (formerly known as Microsoft Flow), or custom middleware to bridge the gap between the two systems. This would involve using the APIs provided by Microsoft Graph API and ZENworks to facilitate communication and data exchange between them.

It's important to carefully review the documentation and resources provided by both Microsoft Graph API and ZENworks to understand the capabilities, limitations, and integration options available. Additionally, consulting with the respective vendors or seeking guidance from developers experienced in integrating these systems can help you determine the best approach for integrating Microsoft Graph API with ZENworks or any other third-party application.
=============================

No, not all APIs for mobile device management (MDM) are based on the OMA DM (Open Mobile Alliance Device Management) protocol. While the OMA DM protocol is a widely adopted standard for device management in the mobile industry, there are other protocols and APIs used by different MDM solutions.

As Example for used APIs and protocols for mobile device management:

OMA DM (Open Mobile Alliance Device Management): OMA DM is a protocol developed by the Open Mobile Alliance (OMA) that provides a standardized approach for managing mobile devices. It enables remote management of device configurations, firmware updates, and application provisioning. Some MDM solutions use the OMA DM protocol as their underlying framework.

Microsoft Graph API: Microsoft Graph API is an API provided by Microsoft that allows developers to access and interact with various Microsoft services and resources. It includes functionality for managing mobile devices and implementing device management policies within the Microsoft ecosystem, such as with Microsoft Intune.

Apple Device Management APIs: Apple provides a set of APIs and frameworks for managing iOS, iPadOS, and macOS devices. These APIs include Apple Device Enrollment Program (DEP), Apple Configurator, and the Apple Push Notification Service (APNs), which allow organizations to enroll and manage devices, configure settings, and push policies and profiles to Apple devices.

1. Android Management API: Android Management API is an API provided by Google for managing Android devices. It allows organizations to remotely manage device settings, provision applications, and enforce policies on Android devices.