ProGet MDM - how it secures mobile devices in a company

Mobile devices outside IT control are one of the most underrated risk vectors. Per the Verizon Data Breach Investigations Report 2025, unmanaged devices (private devices and BYOD) account for a materially higher share of corporate credential exposure than managed devices. The threat does not have to be a sophisticated attack: a corporate phone with encryption off, no password policy, connected to public Wi-Fi is enough. MDM (Mobile Device Management) is not just "phone management": it is a risk-management tool that reduces risk to an acceptable level. In this article I show how ProGet MDM and ManageEngine Mobile Device Manager Plus deliver that in practice.

What ProGet MDM is and how it works

ProGet MDM is a mobile device management solution built by Proget Software sp. z o.o., a Polish company from Bielsko-Biala specializing in mobile fleet management software for enterprise and SME. The platform offers MDM, MAM and UEM features tailored to the Polish market, with Polish-language technical support.

The basic MDM mechanism relies on the enrollment protocol: the device registers in the management system, receives a configuration profile and from that point follows the IT policy. On iOS this is delivered by Apple DEP/ABM; on Android by Android Enterprise (formerly Android for Work). Without enrollment, the device simply does not get access to company resources.

Three generations of device management are worth distinguishing: MDM (managing the device itself), MAM (managing applications) and UEM (Unified Endpoint Management, managing all endpoint types). ProGet MDM operates mainly in the MDM and MAM layers. ManageEngine Mobile Device Manager Plus offers full UEM, covering laptops, tablets, smartphones, and even IoT devices.

Key MDM security features

Modern MDM platforms deliver several independent layers of protection. The failure of one does not bring down the whole. Below are the key mechanisms that any enterprise-grade MDM should offer:

Device and data-in-transit encryption

The MDM policy can force device encryption on (FileVault on macOS, BitLocker on Windows, hardware-based encryption on iOS/Android). Data in transit is protected by enforced per-app VPN: corporate apps always connect through an encrypted tunnel, no exceptions, no user bypass.

Geofencing and conditional access

Geofencing defines geographic zones where the device has access to corporate resources. Crossing the boundary - for example, a device traveling abroad or entering an unapproved location - automatically triggers an action: from a notification, through blocking access to mail, up to a full device lock. Especially important in regulated industries where data cannot leave a defined jurisdiction.

Selective wipe and full wipe

Selective wipe removes only corporate data: apps, emails, documents, VPN configurations, certificates. The employee's private photos and apps stay untouched. It is key for BYOD. Full wipe restores the device to factory settings and is used only for theft or loss of a device with especially sensitive data.

App control and App Catalog

MDM policies define a whitelist and blacklist of apps. The App Catalog gives employees an approved toolset, with no installation of external APKs outside the official store or company catalog. In kiosk (single-app) mode the device can run only one approved app; useful for tablets on production lines or in retail.

3 policy layers protecting devices

In practical deployments, MDM policies form three layers that address different threat scenarios. Each layer is independent. They can be rolled out gradually, starting from layer one.

Rolling out all three layers at once may meet employee pushback, especially for private devices (BYOD). The recommended approach is layer-by-layer with clear messaging for users explaining what is collected, what is not, and why.

ProGet MDM vs ManageEngine MDM vs Microsoft Intune

The MDM/UEM market is mature and competitive. The three solutions most often seen in Polish enterprise companies are ProGet MDM, ManageEngine Mobile Device Manager Plus and Microsoft Intune. They differ in integration model, price and feature scope.

For companies using the ManageEngine ecosystem (ServiceDesk Plus, AssetExplorer, Log360), the natural pick is ManageEngine Mobile Device Manager Plus: native integration removes the need to build custom connectors and delivers a consistent view of incidents, assets and policies in one place. ProGet MDM (Proget Software) fits where the priority is Polish-language support, on-premises deployment and dedicated SME/enterprise service for the Polish market. Intune is the choice for companies deeply rooted in the Microsoft 365 ecosystem with Azure AD as the identity center.

Rollout step by step

MDM is a project, not a one-off setup. Below is the approach we use with clients:

1. Device inventory: a list of all mobile devices with access to company resources: corporate and personal (BYOD). This is the baseline for policy and licensing.
2. Security policy definition: decide what is mandatory (encryption, password) and what is optional (geofencing, single-app mode). Policies should be approved by HR and legal before rollout.
3. MDM server configuration and Active Directory integration: the MDM server connects to AD/Azure AD, pulls user groups and assigns configuration profiles per group. For Apple: Apple Business Manager (DEP) setup. For Android: Android Enterprise setup.
4. Pilot enrollment (10-20 devices): roll out to a pilot group, collect feedback, refine policies before the full rollout. This step is often skipped and that is the most common mistake.
5. Full rollout and employee communication: enrollment of all devices, training employees on the MDM app (Intelligent Hub / Company Portal), documentation of what is monitored.
6. Compliance monitoring and review cycle: weekly compliance reports, quarterly policy reviews, policy updates with every operating system change.

Integration with ServiceDesk Plus

The biggest advantage of ManageEngine Mobile Device Manager Plus over standalone MDM tools is integration with ServiceDesk Plus. In practice it means:

• Automatic tickets for MDM incidents: an employee reporting a lost device automatically creates a ticket in SDP, assigns it to the right technician and triggers the selective wipe workflow.
• CMDB synchronization: every MDM-managed device appears automatically as an asset in the ServiceDesk Plus CMDB with a full profile: model, OS, version, compliance, owner, location.
• Compliance dashboards: the SDP view shows which devices fail the security policy, with the ability to take immediate remediation action without switching between systems.
• Service catalog alerts: employees report device issues through the Service Catalog, not by phone to the helpdesk, which shortens reaction time and creates a full incident history.

With ProGet MDM or Microsoft Intune, integration with ServiceDesk Plus can be built through the API, but that requires custom development or connector purchase. The cost and complexity of that integration is one of the key arguments for ManageEngine MDM+ in companies already using SDP.

Summary and recommendations

MDM is not a one-off project and not an audit checkbox. It is an ongoing process that needs maintenance: policy updates with new OS versions, reviewing the device list as employees rotate, and regular testing of wipe procedures.

Three decisions worth making before you start rollout:

• On-premises or SaaS? On-prem gives full data control, SaaS removes server maintenance cost. For sensitive data (healthcare, finance, defense), on-prem is often a compliance requirement.
• One ecosystem or best-of-breed per category? If you already run ManageEngine, MDM+ is the obvious pick. If you are on Microsoft 365, Intune is the natural step. Mixing ecosystems generates integration cost.
• Which devices first? Start with devices that access the most sensitive resources: executive email, VPN to ERP systems, client data access. Only then expand enrollment to all employees.

FAQ: Top questions about MDM

Answers to the questions most often asked before deciding to deploy MDM.