Mobile Device Management (MDM)¶

A core feature of Publish MDM is its Mobile Device Management (MDM) integrations and capabilities. The MDM integration allows administrators to enforce security policies, deploy applications, and monitor device compliance across an organization’s mobile and tablet devices.

Note

To jump into using device management with Publish MDM, check out the Getting Started with Device Management for a step-by-step walkthrough of setting up an organization, enrolling a device, and automating ODK project deployment to your devices.

Concepts¶

MDM Service Provider: The entity that provides MDM services. PublishMDM can currently use either TinyMDM or Android EMM as its MDM service provider.
MDM Device: A device is any Android tablet or mobile device that is managed through the MDM integration.

Tip

A key feature of Publish MDM is the ability to link devices to ODK Central App Users. Devices assigned to an ODK Central App User will automatically configure ODK Collect with the correct forms and settings without needing to scan a QR code (using ODK Collect’s MDM configuration).
MDM Device Snapshot: A snapshot of a device’s current state, including its installed applications, battery level, operating system version, manufacturer, geolocation, and compliance status. Snapshots are taken periodically (using Dagster) to ensure that device states are up-to-date.

MDM Policy: A set of rules and configurations that are applied to devices within a fleet. Policies can include security settings, application installations, managed configurations, VPN settings, and wallpaper configurations, etc. Policies are created and managed in the MDM service provider (e.g., TinyMDM) and can be applied to devices in a fleet.

MDM Fleet: A collection of devices that are managed together. When using TinyMDM as the MDM service provider, fleets are linked to TinyMDM Groups and TinyMDM Policies and use the multiple enrollment feature to manage devices in bulk.

Zero-Touch Enrollment: Zero-touch enrollment is a streamlined process for Android devices to be provisioned for enterprise management. A device is pre-registered for zero-touch enrollment by an IT admin. TinyMDM can take advantage of this feature to automatically enroll devices into a fleet and apply the appropriate policy.

Fleets By Example¶

To illustrate how fleets work, consider the following example:

        classDiagram

    namespace PublishMDM {
        class Fleet-ProdDevices {
            - device1 [appuser1]
            - device2 [appuser2]
        }
        class Fleet-TestDevices {
            - device3 [appuser1]
            - device4 [appuser2]
        }
        class CentralProject-Survey {
            - form1
            - form2
            - appuser1
            - appuser2
        }
    }

    namespace TinyMDM {
        class Group-ProdDevices {
            - device1
            - device2
        }
        class Policy-ProdApps {
            - app1
            - app2
        }
        class Group-TestDevices {
            - device3
            - device4
        }
        class Policy-TestApps {
            - app1
            - app2
        }
    }

    Fleet-ProdDevices --|> Group-ProdDevices
    Group-ProdDevices --|> Policy-ProdApps
    Fleet-TestDevices --|> Group-TestDevices
    Group-TestDevices --|> Policy-TestApps
    Fleet-ProdDevices --|> CentralProject-Survey
    Fleet-TestDevices --|> CentralProject-Survey

In this example, we have two fleets: Fleet-ProdDevices and Fleet-TestDevices with different devices assigned to each fleet. Each fleet is linked to a TinyMDM group and policy. Devices can easily move between fleets, and the associated policies and groups in TinyMDM will automatically update to reflect the changes. This allows for efficient management of devices across different environments (e.g., production and testing) while maintaining the necessary security and compliance standards.

Android EMM Enterprise Enrollment¶

You can enroll an enterprise for your organization in the frontend (/o/<organization-slug>/enterprise/setup/) or in Admin (/admin/publish_mdm/androidenterpriseaccount/). In case an existing enrollment needs to be disposed, it’s better to delete the whole organization and start over, rather than enrolling a new enterprise for the organization.

Deleting Devices¶

Devices can be deleted from within the frontend (on the device detail page) or in Admin (/admin/mdm/device/) using the “Wipe and soft-delete selected devices” bulk action.

When a device is deleted, Publish MDM sends a wipe command to the MDM service provider:

Fully managed (company-owned) devices: the MDM issues a factory reset command, which wipes all data from the device and restores it to factory defaults.
Work-profile (personally-owned) devices: the MDM removes only the work profile from the device, leaving the rest of the device’s personal data intact.

In both cases the device record is soft-deleted from the Publish MDM database. The actual factory reset or work-profile removal is applied by the MDM service provider and may not happen immediately — the time it takes for the device to carry out the command can vary depending on the device and network connectivity.