MDM vs MAM for BYOD: which fits developers?

Mobile device management (MDM) enrols and controls the whole device. Mobile application management (MAM) protects work data inside specific apps and leaves the rest of the device alone. For personal phones, MAM is usually easier to accept. For laptops used to write code, neither does the job on its own.

What each approach does

Microsoft's Intune documentation describes app protection policies as a way to keep company data safe inside a managed app, and says they work independently of any MDM solution, with or without enrolling the device.

Examples it gives: requiring a PIN or fingerprint to open corporate email, preventing copy and paste of corporate data into personal apps, and restricting access to approved apps.

MDM adds things app policies cannot. Microsoft lists enrolling the device, deploying apps, and ongoing compliance and management. Full device wipe is only possible on devices enrolled in MDM.

Where BYOD usually lands

Microsoft says devices not enrolled in any MDM are typically employee owned. Its documentation also lists limits for those devices: apps are not deployed to them, certificate profiles are not provisioned, and company Wi-Fi and VPN settings are not provisioned.

Policies apply only in a work context, so personal use is untouched. A selective wipe can remove only company data from an app without removing the app.

A comparison

• Scope. MDM covers the device. MAM covers chosen apps.
• Privacy. MAM is lighter touch, which helps staff accept it.
• Wipe. MDM can wipe the device. MAM can remove only company app data.
• Coverage. MAM covers apps that integrate with the vendor SDK or are wrapped. Other apps are outside it.
• Cost of rollout. MAM can start without enrolling anyone.

What this means for developers

Mobile app policies protect mail, chat, documents and similar apps. A developer's real exposure is on the laptop: source trees, terminals, SSH keys, local env files. App level protection built for office productivity apps does not reach those.

So split the problem:

1. Phones and tablets. Use app protection for work apps on personal devices. Require a PIN and block rooted or jailbroken devices where your platform supports it.
2. Laptops that hold code. Prefer company owned and managed. If personal, move the code off the device into a managed remote workspace.
3. Identity. Put conditional access in front of everything, so that unmanaged devices get the narrower access.

Microsoft notes that conditional access should be used together with app protection policies to make sure policies are enforced.

This post uses one vendor's documentation as an example of how app protection works. Other platforms have similar features. Check yours for the specifics.

See the overall BYOD decision guide.

Quick check

Sources

• App protection policies overview, Microsoft Learn
• NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise

Last reviewed: 19 October 2026.