Free MDM: A Practical Guide to What Costs Nothing and What It Costs You

TL;DR

• Free means five different things here. Built into the operating system, bundled with a suite you already pay for, a vendor's capped free tier, open source you host yourself, or a trial pretending to be a plan.
• The biggest change in years: Apple retired Apple Business Manager on 14 April 2026 and replaced it with Apple Business, which includes Apple's first built-in MDM at no cost.
• You may be paying for free twice over: Google endpoint management is included with essentially every Workspace edition, and Intune Plan 1 capability comes with Microsoft 365 E3 and E5.
• Genuine free tiers exist: Mosyle Business FREE for Apple, Miradore for mixed fleets, Fleet for teams comfortable with open source.
• What free almost never includes: third-party patch management, auditor-facing reporting, and somebody to call when enrollment breaks on a Monday.
• The honest rule: start free, document what it cannot do, and let that list rather than a vendor call define your requirements.

The Word Doing Too Much Work

A company of 35 with a mix of Macs and Windows laptops decides it needs device management. Somebody searches for a free option and finds six, signs up for the most prominent, and three weeks later the project has stalled because the free tier caps at 30 devices and the thing they actually needed, enforcing disk encryption and proving it, sits one tier up.

That is not a scam. It is the word free covering several unrelated arrangements, and the differences only become visible after you have committed.

The useful move is to stop asking which free MDM is best and start asking which kind of free you are being offered. Built into the platform, included in something you already buy, capped as a lead generator, or free because you supply the server and the labour. Those have completely different failure modes, and only one of them fails at a device count.

Recommended Tools

Best tools for Device Management

B BambooHR HR management system L Lattice Performance management D Deel Global payroll & EOR

View all recommended tools

There is a second question hiding behind it, and it decides more than the price does: what will you be asked to prove, and to whom? A team with no compliance obligation can run on free tooling indefinitely and be entirely correct to do so. A team with a customer security questionnaire due in March is on a clock, and the free option is a stepping stone whether or not it feels like one today.

The Five Kinds of Free

Built into the operating system

The newest category and the one most published advice has not caught up with. Apple retired Apple Business Manager, Apple Business Essentials and Apple Business Connect on 14 April 2026 and replaced all three with Apple Business, free in more than 200 countries, including Apple's first built-in mobile device management with Blueprints for employee groups, device settings, security and apps.

This is free in the strongest sense. No device cap, no trial clock, no upsell tier, from the company that makes the hardware.

Included in a suite you already pay for

Not free, but already bought, which spends the same. Google endpoint management is included across essentially every Workspace edition, with basic mobile management applied automatically and no user setup required. Intune Plan 1 capability is included with Microsoft 365 E3 and E5 and manages Windows, macOS, iOS and Android.

The failure mode here is not discovering it. Organisations buy device management while holding an entitlement that covered it, and nobody checks because the licence was bought by a different team for a different reason.

A vendor's capped free tier

Mosyle Business FREE for Apple fleets and Miradore for mixed ones both offer genuine free tiers rather than time-limited trials. These are real products with real limits, and the limits are the business model: you use them until a device count or a capability boundary makes the paid tier necessary.

That is a fair arrangement provided you know where the boundary sits before you build on it.

Open source you host yourself

Fleet offers a free tier and comes from an open-source lineage, which suits teams comfortable running infrastructure. The licence costs nothing. The server, the upgrades, the backups and the person who understands it are not free, and on a small team that person is usually the one who was already the bottleneck.

A trial wearing a free badge

Fourteen or thirty days, full capability, then a decision. Useful for evaluation and useless as a plan. The tell is a countdown anywhere in the interface.

When Free Is Genuinely Enough

When nobody outside IT is asking for evidence

This is the real dividing line, and it is not about device count. If no auditor, insurer or customer security questionnaire requires you to produce device evidence on a schedule, free tooling can cover the actual job: enforce disk encryption, keep the operating system current, deploy applications, and wipe a lost machine.

When the fleet is one platform

Free options are strongest when they are specialists. Apple Business for an all-Apple fleet is a genuinely good answer. The same fleet split across three operating systems pushes you towards paid cross-platform tooling much faster, because the free options tend to cover one platform properly.

When you are establishing requirements

Even if you know you will buy something, starting free is better research than any vendor call. Three weeks of running your own devices on a free tier produces a specific list of what it cannot do, and that list is a far better specification than a feature comparison somebody else wrote.

When the team is small and the devices are new

A dozen recently purchased laptops in one office, all bought through proper channels, is close to the ideal case. Most free-tier limitations bite on heterogeneous, aging, badly purchased fleets rather than on clean small ones.

When paying would buy capability nobody will use

Worth stating because it is the mirror of the usual advice. A paid platform with a scripting layer, custom reporting and third-party patch management is a better product, and it is a worse purchase if nobody has time to operate any of it. Teams at this size frequently buy the tier they imagine growing into and then run the same basic policies a free option would have enforced, which is the same mistake larger organisations make with enterprise licences, just at a smaller scale.

The test is simple. Name the person who will use the paid capability and ask what they will do with it in the first month. If the answer is vague, free is not a compromise, it is the correct purchase.

When Free Stops Being Enough

When somebody asks you to prove something. The move from managing devices to evidencing device state is where free options run out. Producing a report an auditor will accept, repeatedly and on demand, is the capability paid tiers are actually selling.

When third-party software needs patching. Operating system updates are well covered everywhere. Keeping browsers, runtimes and productivity applications current across a fleet is mostly a paid capability, and it is where a meaningful share of real risk lives.

When you need to script something nobody anticipated. Free tiers offer configuration. Scripting layers, which let an administrator handle a requirement no vendor foresaw, are a paid feature almost everywhere.

When enrollment breaks and you need somebody to call. Support is the quietest difference and the one that matters most on a bad day. If the answer to who helps is the community, that is fine until the morning twenty new starters cannot enroll.

When you cross the cap mid-project. The specific failure that wastes the most time. Find the device limit and the feature boundary before you build a process on top of a free tier.

When two free tools become the plan. This one is subtle and catches careful teams. A mixed fleet covered by two free specialists, one for Apple and one for everything else, looks like a clever saving and behaves like two silos. The test is whether anybody can answer a compliance question across the whole fleet in one operation. If producing an encryption report means exporting from two systems and reconciling them in a spreadsheet, the saving has been converted into a manual process that somebody repeats forever, and one paid cross-platform tool is usually cheaper than that person's time.

Five Questions Worth Answering First

"What will we be asked to prove, and to whom?" The question that decides whether free is a destination or a waypoint. Get it in writing from whoever owns the obligation.

"What do we already hold?" Your Google Workspace edition and your Microsoft 365 licence, checked rather than assumed.

"How many devices, and how fast is that growing?" A cap at 30 is irrelevant at 12 devices and a problem at 28 with hiring underway.

"Who runs this?" Particularly for self-hosted options, where the licence is free and the operational load is not.

"How were the devices bought?" Automated enrollment depends on purchasing through Apple, an enrolled reseller, or for Android a zero-touch reseller. Free tooling does not change that rule, and no paid tool works around it either.

Six Free and Nearly Free Options

Checked on 3 October 2026 against each vendor's own site. Where a figure is not published, this says so rather than estimating.

Apple Business

Best for: any Apple fleet, and the first thing to try before paying for anything.

What you get: Apple's own built-in mobile device management, Blueprints for configuring employee groups, device settings, security and apps, automated device enrollment, volume app purchasing and Managed Apple Accounts. Available in more than 200 countries.

Where it struggles: no scripting layer, no third-party patch management, and reporting that stops well short of auditor-facing. Apple only.

The catch: none on price. You need this platform for automated enrollment regardless of what else you run, which makes trying it genuinely free rather than nearly free.

Cost: free.

Google endpoint management

Best for: organisations already on Google Workspace, especially with Android.

What you get: basic mobile management applied automatically with no user setup, across essentially every Workspace edition including Business Starter, Standard and Plus, Enterprise Standard and Plus, Frontline, Essentials and Cloud Identity. Advanced mobile management asks users to install an app and adds remote wipe, stronger password enforcement and Android work profiles.

Where it struggles: it is device management as a feature of a productivity suite rather than a dedicated platform, and dedicated or kiosk devices are not its ground. Advanced capability varies by edition.

The catch: you are paying for Workspace. Confirm what your specific edition includes rather than planning from a general description.

Cost: included with Workspace editions, with basic mobile management carrying no additional cost.

Mosyle Business FREE

Best for: small Apple fleets wanting more than Apple Business provides without a licence conversation.

What you get: a genuine free tier of a full Apple management platform rather than a time-limited trial, from a vendor built exclusively for Apple with automation that works without assembly.

Where it struggles: Apple only, so a mixed fleet needs something else alongside. The free tier has boundaries, and establishing where they sit for your specific requirements is worth doing before you build on it.

The catch: it is a free tier of a commercial product, which means the limits are deliberate and the upgrade path is the point. That is a reasonable trade, not a trap, provided you know the boundary.

Cost: free tier available. Paid tier pricing is not published in a form that can be verified externally.

Miradore

Best for: small mixed fleets that need one console across platforms without a budget.

What you get: a free mobile device management tier covering core management, with paid tiers adding capability and a 14-day trial of the higher tier available.

Where it struggles: the free tier is foundational rather than comprehensive, and the deeper capabilities sit behind the paid plans, which is the normal shape for this category.

The catch: as with any capped tier, find the boundary first.

Cost: free tier available, paid tiers published on its pricing page.

Fleet

Best for: teams comfortable running their own infrastructure, particularly where visibility across platforms matters.

What you get: a free tier from an open-source lineage, with device visibility and management across platforms and the transparency that comes with inspectable software.

Where it struggles: the operational load. Hosting, upgrading, backing up and understanding it are real work, and on a small team that work lands on whoever was already the constraint.

The catch: free licence, not free operation. Price the person before the product.

Cost: free tier available. Paid tier pricing is not published.

Microsoft Intune

Best for: anyone holding Microsoft 365 E3 or E5, which is a large share of organisations that think they have no device management.

What you get: management across Windows, macOS, iOS and Android, configuration profiles, compliance policies, application deployment, and device compliance tied natively into conditional access through Entra ID.

Where it struggles: Apple depth is visibly second, dedicated devices are weak, and the administrative surface is demanding.

The catch: not free, but already bought. If the licence is in place the marginal cost is nothing, which makes it the strongest option on this page for a great many readers.

Cost: Plan 1 capability included with Microsoft 365 E3 and E5.

What Each One Actually Costs

The third and fourth columns matter more than the second. A free option covering one platform is not free for a mixed fleet, it is free for part of a mixed fleet, and the rest needs a plan. And a device cap is not a limitation to work around, it is a date in your future, so find it now rather than at 28 devices with hiring underway.

The Decision Table

The last row is the one to be honest about. If somebody will ask you to prove device state on a schedule, free tooling is a waypoint rather than an answer, and planning for the paid tier early is cheaper than discovering the gap a fortnight before a deadline.

The Three-Week Free Pilot, Concretely

Starting free gets recommended on every page like this one and described on almost none, which is unhelpful because the pilot is the part that produces your specification. Here is the whole thing, and three weeks is genuinely enough.

Week one: enroll badly on purpose. Enroll one device that was bought through the proper channel and one that was not, because the second is the one that will teach you something. Enroll a machine belonging to somebody who will complain rather than a spare, since a clean device with no user tells you nothing about daily operation. Note how long each enrollment takes from unboxing to usable, because that number multiplied by your hiring rate is the recurring cost you are trying to remove.

Week two: enforce something people notice. Push disk encryption, a screen lock timeout and an operating system update. Then try to undo each one as an ordinary user would. You are testing two things at once: whether enforcement actually holds, and how much support load it creates. A policy nobody notices has proved nothing.

Week three: try to produce evidence. Generate the specific report you would be asked for, with your own devices in it. Not a sample report, the real one. Then deliberately fail a device against a policy and see whether the platform notices, reports it and fixes it, or merely records it and waits for a human. The gap between flagging and remediating is the clearest practical difference between free and paid tiers.

Throughout: write down every refusal. Each time the tool cannot do something, add a line. That document, at the end of three weeks, is your requirements specification, and it is worth more than any feature comparison because every line is something your organisation actually tried to do.

Two things to resist during the pilot. Do not evaluate features nobody has committed to using, which is what most trials get spent on. And do not fix a problem by hand without logging it, because the hand-fix is the finding and a quietly heroic administrator is how a tool gets credited with capability it does not have.

Where Teams Get Free MDM Wrong

Not checking the entitlement. The most common and most expensive mistake on this page. Google endpoint management comes with essentially every Workspace edition and Intune Plan 1 capability comes with Microsoft 365 E3 and E5. Buying device management without checking both is a recurring cost paid for nothing, and ruling it out takes ten minutes.

Building a process on an undiscovered cap. Find the device limit and the feature boundary on day one, not in week three. The cost of crossing a cap is rarely the upgrade price, it is the stalled project around it.

Confusing a trial with a free tier. A countdown is not a plan. Trials are for evaluation, which is a legitimate and useful purpose, but they cannot be the basis of an operating process.

Treating self-hosted as free. The licence costs nothing and the operation costs a person. On a team small enough to be shopping for free MDM, that person is usually the only one who could run it and already has a full week.

Assuming free means weak. Apple Business is free and made by the company that makes the hardware. Dismissing it because of the price is the mirror image of buying depth nobody will use, and it is a mistake in the same family.

Deferring the compliance question. Whether you will be asked to prove something, and to whom, determines whether free is a destination or a waypoint. Answering it late turns a planned upgrade into an emergency one.

Letting the free tier decide the enrollment approach. A subtle one worth naming. If automated enrollment is awkward to set up on a free tier, the tempting shortcut is manual enrollment, which works and which produces a profile a user could remove. Do that across a fleet and you have built your device management on something reversible by the people it governs, which is precisely the property an auditor cares about. Set up automated enrollment properly through Apple Business, or Google's zero-touch programme for Android, before deciding whether the free tier is sufficient, because enrollment quality is not a tier feature and getting it wrong undermines everything above it.

What None of Them Will Tell You

Every option here knows about devices it manages, which sounds complete until you need the other list.

None can tell you about a machine that was never enrolled, because none has seen it. None can tell you where a laptop physically is, only where it last checked in from. None can tell you whether the machine issued to somebody who left in March came back, only that it stopped reporting. And none can tell you what you own, which is the question an auditor actually asks.

This matters particularly on free tooling, because the teams using it are often the ones with the least formal asset process. A free MDM will competently manage the devices it knows about while the gap between that list and reality grows quietly, and the gap is discovered at the worst moment.

That is an asset management gap rather than a shortcoming of any product here, and no paid tier fixes it either. The fix is a register alongside the MDM. Platforms built for that side of the problem, such as RemoAsset, handle procurement, delivery and physical retrieval, with enrollment happening on delivery. RemoAsset is not an MDM and does not replace anything on this list.

The diagnostic is one question. Ask what went wrong last quarter. A misconfigured, unpatched or unencrypted machine is an MDM problem and this comparison is the right one. A laptop nobody can account for is not, and upgrading from free to paid will not touch it.

What to Establish Before You Commit

What you will be asked to prove, and to whom. In writing, from whoever owns the obligation. This single answer determines whether free is a destination or a waypoint.

Both entitlements. Your Google Workspace edition and your Microsoft 365 licence, with the specific Android and device management capability each includes.

The cap on any free tier you are considering. Device count and feature boundary, found before you build rather than after.

Who operates it. Named, and for self-hosted options named with an honest estimate of hours.

Your platform split. Because free options are strongest as specialists, a mixed fleet usually needs either one paid tool or two free ones with a reconciliation routine between them.

How devices are purchased. Automated enrollment depends on the channel, and no tier of any product changes that.

None of those six requires a vendor conversation. They are answerable inside your own organisation in about a day, and together they will tell you whether free is the answer or merely the start.

What Getting This Wrong Costs

The first cost is the one nobody notices for a year: paying for management you were entitled to. A licence running alongside a Workspace or Microsoft 365 entitlement that already covered it, invisible until a renewal review asks what it is for.

The second is the stalled project, and it is the most common failure of free tooling specifically. A process built on a free tier, then halted at the device cap or at a capability boundary, with the work half done and the upgrade unbudgeted. The upgrade itself is usually affordable. The month of stalled rollout is the expense.

The third is the compliance gap, and it is the one that costs something other than money. Free tiers manage devices well and evidence them poorly, so a team running free tooling into an audit tends to discover the shortfall when somebody external asks for a report they cannot produce. That is a planning failure rather than a product one, and the fix is answering the compliance question at the start rather than the end.

The fourth is specific to self-hosting. A free, self-hosted platform that nobody has time to upgrade becomes an unpatched server holding your fleet inventory, which converts a cost saving into a security problem. If nobody owns the upgrades, the licence saving is not a saving.

When You Are Ready to Decide

Check both entitlements first. If you hold Microsoft 365 E3 or E5, or any Google Workspace edition, you may already have the answer installed, and that single check saves more money than any comparison on this page.

Then, if your fleet is Apple, start with Apple Business. It is free without caveats, you need it for enrollment regardless, and three weeks of running real devices on it produces a precise list of what it cannot do. That list is your actual specification, and it is better than anything a vendor will write for you.

Then answer the compliance question honestly. If somebody will ask you to prove device state on a schedule, plan the paid tier now and treat free as the pilot. If nobody will, free tooling can serve you for years and there is no virtue in paying to feel serious.

And whichever you choose, find the cap before you build on it. The device limit and the feature boundary are the two facts that decide whether a free tier is a foundation or a trap, and both are knowable on the first day.

One closing thought, because the framing of this topic is usually wrong. Free device management is not the budget option for people who cannot afford the real thing. For an Apple fleet it is now a product made by the company that makes the hardware, and for Workspace and Microsoft 365 customers it is capability already bought and sitting unused. The teams that get this wrong in the expensive direction are not the ones running free tooling too long. They are the ones who paid for a platform before establishing what they needed, and who are now running six basic policies on a licence that could have done far more. Free is how you find out which of those you are, and it costs three weeks and nothing else.

Frequently Asked Questions