A stolen laptop with an unencrypted disk isn't a hardware failure — it's a data incident. And the more companies work hybrid, the more often it turns out that nobody really knows where their devices are or what's on them.
For years in SMEs, "device management" boiled down to the IT person remembering whose laptop was whose. As long as the company had 12 people in one office, that worked. Once you're at 25, 35, 50 people, some at home, some at clients, some on contracts — the model stops adding up. That's when the MDM question shows up.
MDM (Mobile Device Management — these days it covers laptops too) is simply a tool that lets you centrally configure and control company devices. In the Microsoft world it's called Intune and ships inside Microsoft 365 Business Premium — i.e. something most companies using Office for business already pay for.
What MDM actually does
It's easier to start with what MDM isn't. It's not antivirus (that's EDR), it's not backup (that's a different system), and it's not employee surveillance. It's a tool that gives the company technical certainty that its devices are configured the way it wanted, regardless of where they happen to be.
In practice, MDM does four concrete things:
- Enforces configuration — disk encryption (BitLocker), screen lock after 5 minutes, minimum password length, USB ports disabled where they don't need to be open.
- Distributes applications — when a new hire joins, they get a laptop that, after the first login, installs Office, Teams, browser, VPN and whatever the department needs by itself. Without someone sitting there for 4 hours clicking "Next".
- Conditional access — company mail or SharePoint can only be reached from a managed device that meets the rules (encrypted, patched, MFA on). From a personal phone — no.
- Remote wipe — if a laptop disappears (stolen, left in a cab), an admin clears the company data with one click. Without chasing the police to recover the hardware.
When an SME really needs MDM
Not every company has to have it on day one. But there are three signals that the time has come.
First — the number of devices exceeds what one person can keep in their head. The line is soft, but somewhere between 20 and 30 laptops it gets hard for one person to keep order. Second — work outside the office — if over a third of the team is regularly off-site, MDM stops being a luxury. Third — client data or regulation — if customer personal data, deal documents from competing clients, or NIS2 obligations live on those laptops, and your cyber insurance demands concrete controls, without MDM you simply can't prove them.
If none of those apply to you — relax, MDM can wait. There's no point deploying a tool just so you can put it on a slide.
A case from a marketing agency
A concrete example, from our own work. A 28-person marketing and design agency in Warsaw: 35 laptops (employees plus longer-term freelancers), work scattered between the office, home and clients. For years they got by with informal methods — the IT person remembered most of the devices, admin passwords were the same everywhere, nobody encrypted the disks.
One evening in October an account executive left a laptop in a car trunk. The car was broken into overnight. On the disk — unencrypted — were materials from three clients, including strategy decks. The company had to notify the clients, one project froze for two weeks, it was unpleasant. The real cost of the incident, counting team stress and one lost retainer, far exceeded everything they had "saved" over the years by not investing in device management.
After the incident we rolled out Intune for them (it was included in the M365 Business Premium subscription they already used — around 28 PLN per user per month). Concrete results within three months:
- BitLocker enforced on all 35 laptops within 6 weeks.
- Time to provision a new laptop: from 4–5 hours of manual work to 30 minutes of auto-install (Autopilot plus app distribution).
- In March another laptop "went missing" with a freelancer who dropped off the radar. Remote wipe took 20 minutes. Consequences for clients — none.
- IT onboarding for a new hire dropped from half a day to roughly 45 minutes.
It's not spectacular. It's just work that nobody had been doing before, because there was no clean way to.
What usually goes wrong during rollout
Intune looks beautiful in a demo, but the rollout has several traps SMEs fall into repeatedly.
First — the urge to enforce everything at once. You turn on the full set of policies on day one, half the team can't print, the other half can't connect to VPN, a queue forms at IT. Realistically the rollout goes in stages: inventory first, then encryption, then password rules, then conditional access. Typically 2–3 months for 30–50 people.
Second — personal devices without a policy. Staff read company mail on personal phones. Without a decision on whether those phones are managed (BYOD with a work profile) or not (no access), the rollout has a hole the size of the main risk you wanted to defend against.
Third — no offboarding process wired into MDM. Even the best MDM won't help if nobody disables an account after someone leaves. "Wipe the device" must be on the HR checklist, not just in the IT person's head.
Fourth — treating MDM as a one-shot project. It isn't "deploy and done". Policies need a quarterly review, because Windows changes, apps change, risks change. Reserve 2 hours a month for upkeep.
Where to start in your company
Before you even start comparing tools, answer four questions:
- How many devices actually operate in the company (counting freelancers and subcontractors)? If you don't know exactly, that's already a signal.
- Which of those devices hold client data or internal commercial documents?
- What happens if one of them disappears tomorrow — do you have a plan or a prayer?
- Which Microsoft 365 plan are you on today? If Business Premium, you're already paying for Intune — you just need to configure it. If Business Standard, the top-up is around 10–15 PLN per user per month.
This isn't a decision you have to make this week. But if the answer to the third question is "I'm just hoping it doesn't happen" — it's time someone sat down with you and walked through it calmly.
MDM won't stop a laptop from being stolen. It just makes sure that theft doesn't turn into a data incident.