Best MDM for Small Business: A Practical Guide for Teams Without an IT Department

TL;DR

• Start by not buying anything. Apple Business is free and Google endpoint management comes with every Workspace edition. For a small fleet, one of those is often the whole answer.
• Check what you already hold: Intune Plan 1 capability is included with Microsoft 365 E3 and E5, which a surprising number of small companies hold without knowing it covers devices.
• The real constraint is not budget, it is attention. Nobody here does device management full time, so a platform that needs an administrator is the wrong purchase regardless of price.
• Free tiers that are real, not trials: Mosyle Business FREE for Apple, Miradore for mixed fleets.
• Cheapest paid options: Scalefusion from $2 per device per month, Hexnode from $2.20, Jamf Now from $4. Note that one vendor charges small fleets more, not less.
• The thing that will catch you: automated enrollment depends on where you bought the laptop, and that cannot be fixed afterwards.

The Problem Is Not Really Money

A 28-person company has 31 laptops, a mix of Macs and Windows machines, bought over four years from whoever had stock. Two people have left in the last six months and nobody is completely sure both machines came back. A customer has just sent a security questionnaire asking whether disk encryption is enforced.

There is no IT department. There is an operations manager who is good with computers and already has a full week.

Almost every article about device management for small business assumes the constraint is budget and recommends the cheapest tool. The actual constraint here is that nobody has four hours to configure anything, nobody will remember to check a dashboard, and the person nominally responsible has another job. A platform that costs nothing and needs an administrator is more expensive than one that costs money and needs nobody.

Recommended Tools

Best tools for Device Management

B BambooHR HR management system L Lattice Performance management D Deel Global payroll & EOR

View all recommended tools

So the question is not which is cheapest. It is which one will still be working in eight months when nobody has looked at it, and that is a different question with a different answer.

Start Here: What You Probably Already Have

Before evaluating anything, check three things. For a meaningful share of small companies, one of them ends the exercise.

Apple Business is free, and new. Apple retired Apple Business Manager, Apple Business Essentials and Apple Business Connect on 14 April 2026 and replaced all three with Apple Business, free in more than 200 countries, which includes Apple's first built-in mobile device management with Blueprints for employee groups, device settings, security and apps. If your laptops are Macs, this is where to start, and you need the platform for enrollment regardless of what else you ever buy.

Google Workspace includes endpoint management. Across essentially every edition, including Business Starter, Standard and Plus. Basic mobile management is applied automatically with no user setup and no additional cost. If you are already paying for Workspace, some device management is already switched on.

Microsoft 365 E3 and E5 include Intune Plan 1 capability. This is the one small companies miss most often, because the licence was bought for email and nobody read past that. It covers Windows, macOS, iOS and Android.

Ten minutes of checking. No vendor conversation. It is genuinely common for the answer to be that you already own what you were about to buy.

What You Actually Need It To Do

Small companies rarely need most of what device management platforms sell. The honest list is short, and it is worth writing down before anybody shows you a feature grid.

Prove disk encryption is on. The single most commonly requested piece of evidence, and the thing a customer questionnaire or insurer asks for first.

Keep the operating system current. Not optional, and the easiest thing to enforce badly by asking people nicely.

Set a screen lock. Trivial, universally expected, and routinely absent.

Get a laptop ready without a day of work. The recurring cost that justifies the whole exercise, because somebody is currently doing this by hand every time.

Wipe a device you cannot get back. The capability you hope never to need and will be asked about.

Know what you own. Which, as discussed further down, no MDM actually does.

That is six things. Every option on this page covers the first five, including the free ones. Which means the comparison is not about capability. It is about how much effort each one asks of a person who does not have any spare.

Look at the last row. It is the only requirement on the list that no option here satisfies at any price, and it is frequently the one that started the search. More on that further down, because it is worth not spending money to solve the wrong problem.

When You Genuinely Need To Pay

Three situations, and outside them free tooling is a legitimate permanent answer rather than a stepping stone.

Somebody external asks for evidence on a schedule. A customer security questionnaire once is survivable manually. An annual SOC 2 or ISO 27001 cycle, or an insurer wanting device reports, is where producing evidence repeatedly and on demand starts to matter, and that is what paid tiers actually sell.

Your fleet spans platforms and nothing covers all of it. Free options tend to be specialists. Two free tools covering half a fleet each looks like a saving and behaves like two silos, with somebody reconciling spreadsheets forever.

Third-party software needs patching. Operating system updates are handled well everywhere. Keeping browsers, runtimes and applications current across a fleet is mostly a paid capability, and it is where a real share of risk sits.

If none of those three applies, you are being sold capability for a problem you do not have.

There is a fourth situation that is less about capability and more about continuity, and it deserves naming because small companies hit it hardest. If the one person who understands your setup is also the one person who could leave, a platform whose configuration lives in somebody's head is a risk regardless of what it costs. Paying for a tool with better documentation, pre-built defaults and actual support is sometimes buying a second pair of hands rather than a feature, and for a team of thirty that can be the better reason to spend than any item on a comparison grid.

The Purchase Trap Nobody Warns You About

This catches small companies harder than anyone, because small companies buy hardware the most informally.

Automated enrollment, where a laptop configures itself on first boot and management is applied before anybody can decline it, requires the device to be bought through Apple or an enrolled reseller. For Android, it requires a reseller in Google's zero-touch programme. A machine bought from a high-street shop, a general online retailer, or on somebody's personal card during an emergency cannot be added to automated enrollment afterwards.

You can enroll it by hand. That enrollment is one a user could remove, which puts the device in a weaker category than the rest of your fleet and makes it the machine that undermines your compliance answer.

For a company with 31 laptops bought over four years from whoever had stock, a meaningful fraction may be in this position already. Find out how many before choosing a platform, because that number changes what you are buying and no software fixes it.

The practical fix going forward costs nothing: buy through one channel, consistently, even when it is slower. The emergency purchase is understandable and it is also how a permanent second tier gets created one laptop at a time.

Six Options Worth Knowing

Checked on 3 October 2026 against each vendor's own site. Where a vendor does not publish a figure, this says so rather than estimating.

Apple Business

Best for: any small company whose laptops are Macs.

Why it fits a small team: free, from Apple, with Blueprints that configure groups, settings, security and apps without requiring somebody to learn a platform. No device cap, no trial clock, no upsell tier.

Where it struggles: Apple only, no third-party patch management, and reporting that will not satisfy a formal audit process. If you have Windows machines, this covers part of your fleet.

Cost: free.

Google endpoint management

Best for: small companies already on Google Workspace.

Why it fits a small team: basic mobile management is applied automatically with no user setup, which is close to the ideal property when nobody has time to configure anything. Advanced mobile management adds remote wipe, stronger passwords and Android work profiles once users install an app.

Where it struggles: it is a feature of a productivity suite rather than a dedicated platform, and laptop management is less complete than phone management. Capability varies by edition.

Cost: included with Workspace editions, basic mobile management at no additional cost.

Mosyle Business FREE

Best for: small Apple fleets wanting more automation than Apple Business offers.

Why it fits a small team: a genuine free tier of a full Apple platform rather than a trial, built so that automation works without assembly. For a team with no Apple specialist, the pre-built approach is the point.

Where it struggles: Apple only. The free tier has boundaries and finding them before you build on them is the whole job.

Cost: free tier available. Paid tier pricing is not published in a verifiable form.

Miradore

Best for: small mixed fleets with no budget at all.

Why it fits a small team: a genuine free mobile device management tier covering core management across platforms, with paid tiers available when you outgrow it and a trial of the higher tier.

Where it struggles: the free tier is foundational rather than comprehensive, which is the normal shape and worth confirming against your own six requirements.

Cost: free tier available, paid tiers published.

Scalefusion

Best for: small companies needing one paid console across platforms, including shared or purpose-built devices.

Why it fits a small team: published per-device pricing means you can budget without a sales call, and the device-type coverage is broader than most, which matters if you have anything beyond laptops and phones.

Where it struggles: identity integration is less native than Microsoft's, and Apple depth is mid-range.

Cost: published per-device, from $2.00 per device per month on annual billing.

Hexnode

Best for: small mixed fleets wanting a readable rate card and one console.

Why it fits a small team: Apple, Windows and Android together with pricing published in tiers, so there is no sales cycle between deciding and knowing the cost. One adequate tool across a mixed fleet beats two free specialists and a reconciliation problem.

Where it struggles: a generalist, so it is second-best on Apple-specific depth, which for the six requirements above rarely matters.

Cost: on annual billing, $2.20 per device per month for Pro, $3.20 for Enterprise, $4.70 for Ultimate and $5.40 for Ultra. Monthly billing is $2.40, $3.60, $5.20 and $6.00.

What Each One Costs a 30-Device Company

Two notes on that table. The paid figures are arithmetic on published list prices at 30 devices, not quotes, so treat them as the shape rather than the invoice. And the fourth column matters more than the second for a small team: Intune is the most capable thing on this list and the most demanding to configure, which is why it carries a qualified answer in the last column despite often being free at the margin.

One more warning specific to small companies. At least one vendor in this category charges small fleets more per device rather than less. NinjaOne publishes rates from $1.50 per device per month at 10,000 endpoints rising to $3.75 at fifty or fewer, so a thirty-device company pays the top of the range. Assume you are at the unfavourable end of any published range until a quote says otherwise.

The Decision Table

The first four rows cost nothing beyond what you may already pay, and they cover most small companies. Work through them before considering anything else.

The First Ninety Minutes

Written for somebody whose actual job is something else. This is the order to do things in, and it is deliberately short because the common failure is not a bad configuration, it is an abandoned one.

Minutes 0 to 20: the organisational setup. Create your account on the platform you chose, verify the domain you own, and leave the identity federation decision alone for now. Federating means people sign in to Apple or Google services with their work account, which is usually right, but it also prompts anybody with a personal account on a company email address to change theirs. Send an email before you switch that on.

Minutes 20 to 35: link your reseller. This is the step that enables automated enrollment, and it is the one most likely to need somebody else to act. Start it early so the waiting happens in the background.

Minutes 35 to 55: enroll two laptops. The newest machine bought through a proper channel, and the oldest one bought from a shop. The second will fail to join automated enrollment, and that failure is the most useful thing you will learn today, because it tells you how big your manual-handling problem is.

Minutes 55 to 75: turn on three things only. Disk encryption, operating system updates, screen lock. Not a policy framework, three settings. Resist configuring anything else, because every additional setting is something to maintain and you are not staffed to maintain much.

Minutes 75 to 90: produce one report and book the recurring slot. Generate the encryption report, confirm it shows what you expect, and screenshot it. Then put thirty minutes a month in a named person's calendar, titled so they will know what it is for in six months.

Two steps wait on other people, which is why a week is a more realistic expectation than an afternoon even though the hands-on work is ninety minutes. Start those two first and do everything else while they clear.

What to leave until later, deliberately: application deployment, self-service catalogues, custom configuration profiles, anything described as advanced. None of those is in your six requirements, and each one is a thing that breaks quietly and needs somebody to notice.

Where Small Companies Get This Wrong

Buying before checking. Purchasing device management while holding a Microsoft 365 or Google Workspace entitlement that already included it. Ten minutes to rule out and it happens constantly, because the licence was bought for email by somebody who never read the device section.

Choosing on price instead of effort. The cheapest tool that needs four hours of attention a month is more expensive than a slightly dearer one that needs none, because nobody here has four hours. Cost the attention, not just the licence.

Treating a trial as a plan. A thirty-day full-capability trial is for evaluation. If there is a countdown in the interface, it is not your answer.

Building on an undiscovered cap. Free tiers have device limits. Find yours on day one, not in week three with half the fleet enrolled and hiring underway.

Ignoring how laptops were bought. Automated enrollment depends entirely on the purchase channel, and for a company that has bought from whoever had stock, some machines are permanently outside it. Count them before choosing.

Assuming free means inadequate. Apple Business is made by the company that makes the hardware and costs nothing. Dismissing it on price is a real mistake and a surprisingly common one.

Deferring the compliance question. Whether anybody will ask you to prove device state, and when, decides whether free is a destination or a waypoint. Finding out late turns a planned upgrade into an urgent one during the week everything else is due.

Setting it up and never looking again. The most common small-company failure overall. Device management is not an installation, it is a thing that drifts. Put a recurring thirty-minute calendar entry on somebody's week, which costs nothing and is the difference between a working system and a dashboard nobody opens.

Configuring more than you can maintain. Closely related and separately damaging. Every policy, profile and automation you switch on is something that can break silently, and a small team notices breakage late. Three settings maintained beats twenty settings abandoned, and the version of this that causes real trouble is a half-finished application deployment that quietly stops delivering updates nobody is tracking.

Enrolling devices manually because it was faster. It is faster, once. Done as a habit it builds your entire device management on enrollments that users can remove, which means the answer you give a customer about enforced encryption is not reliably true. Fix the enrollment channel first even though it is the least satisfying part of the job.

What No MDM Will Tell You

Every option here knows about devices it manages, which sounds complete until you need the other list.

None can tell you about a laptop that was never enrolled, because none has seen it. None can tell you where a machine physically is, only where it last checked in from. None can tell you whether the laptop belonging to the person who left in March came back, only that it stopped reporting. And none can tell you what you own, which is what the customer questionnaire is actually driving at.

This lands hardest on small companies, for an unglamorous reason. There is usually no formal asset register, hardware was bought informally over years, and nobody owns the offboarding checklist. So the gap between what the MDM knows and what exists is widest exactly where there is least capacity to close it.

That is an asset management gap rather than a shortcoming of any product here, and no paid tier fixes it. The fix is a register alongside whatever you choose. Platforms built for that side of the problem, such as RemoAsset, handle procurement, delivery and physical retrieval, with enrollment happening on delivery. RemoAsset is not an MDM and does not replace anything on this list.

The diagnostic is one question. Ask what actually went wrong in the last six months. A machine that was unencrypted, unpatched or badly set up is an MDM problem and this comparison is the right one. Two laptops nobody is sure came back is not, and no option on this page addresses it.

What to Establish Before You Commit

Your three entitlements. Apple Business if you have Macs, your Google Workspace edition, your Microsoft 365 licence. Ten minutes, and it may end the exercise.

Your six requirements, written down. Encryption evidence, OS updates, screen lock, fast setup, remote wipe, knowing what you own. Then check candidates against that list rather than against a feature grid.

How many laptops were bought outside a proper channel. Because those cannot join automated enrollment and they are the ones that will undermine your compliance answer.

Whether anybody will ask you to prove device state, and when. From whoever owns the customer relationship or the insurance, not from IT.

The free tier cap on anything you are considering. Device count and feature boundary, found before you build.

Your real laptop count, not your headcount. These diverge more than people expect at small scale, because leavers' machines, spares, and the laptop somebody is using at home all exist and none appears on a payroll report. Walk the office, check the cupboard, and ask the two most recent leavers' managers. The number you arrive at is both your licence requirement and, more usefully, the first honest answer you have had to the question of what you own.

Who will spend thirty minutes a month on this, named. Not a role, a person, with it in their calendar.

What happens if that person leaves. The uncomfortable one, and worth five minutes now rather than a crisis later. Write down which platform you use, which account administers it, and where the recovery details live, then put that note somewhere a second person can find it. In a company of thirty, device management is almost always one person's informal responsibility, and the difference between an inconvenience and a genuine problem when they leave is whether anybody else knows how to log in.

None of those six needs a vendor conversation. They are answerable in an afternoon, and together they will usually tell you that the answer is free or already paid for.

What Getting This Wrong Costs

The first cost is paying for what you already hold, and for a 30-person company it is proportionally large. A per-device licence running alongside a Microsoft 365 or Workspace entitlement that covered it, for however long until somebody reviews the subscriptions.

The second is the abandoned setup, and it is the most common small-company outcome by a distance. Somebody configures a platform in a burst of effort, nobody maintains it, and eighteen months later it manages the twelve laptops enrolled that month and none of the nineteen bought since. The licence is being paid and the protection is partial, which is worse than either paying nothing or doing it properly, because it produces a false answer to the compliance question.

The third is the unanswerable questionnaire. A customer asks whether disk encryption is enforced across your fleet, and the honest answer is that it is enforced on most of it and nobody is certain about the rest. For a small company selling to larger ones, that answer can cost a contract, which makes it the most expensive item on this page by some margin.

The fourth is the stalled rollout at a free tier cap. Rarely expensive in licence terms and reliably expensive in time, because the project halts with half the fleet enrolled and the person running it has already spent their available attention.

When You Are Ready to Decide

Check the three entitlements first. Apple Business is free and you need it anyway if you have Macs. Google Workspace includes endpoint management. Microsoft 365 E3 and E5 include Intune capability. For a large share of small companies one of those three is the answer, and finding out takes ten minutes rather than a procurement cycle.

Then write down the six things you actually need and ignore everything else on any vendor's page. Small companies are sold capability for problems they do not have, and the six-item list is the defence against it.

Then enroll two laptops, not one: the newest machine bought through a proper channel, and the oldest one bought from a shop. The second will teach you what your real constraint is, because it is the machine that cannot join automated enrollment and it represents however many others are in the same position.

Then, whatever you choose, put thirty minutes a month in a named person's calendar. That single habit matters more than the choice between any two options here, because the common failure in small companies is not picking the wrong tool. It is picking a reasonable tool and then never looking at it again.

What that thirty minutes is for, concretely: check the enrolled device count against the number of laptops you believe you own, and investigate any gap. That is the whole routine. It catches the two failures that actually hurt, which are machines bought since the last check and never enrolled, and machines that have stopped reporting because somebody left with them. Both are invisible in a dashboard nobody opens and both are obvious in a two-minute comparison of two numbers.

And a final piece of perspective, because this topic is usually written as though small companies were failing at something. A thirty-person company with encryption enforced, updates current and a known device count is in better shape than a great many larger organisations with an expensive platform nobody has staffed. The scale of your tooling should match the scale of your obligations, and for most small companies that means free or already-paid-for software, three settings switched on, and somebody who looks once a month. Spending more than that is not caution, it is a purchase in search of a problem.

Frequently Asked Questions