Mobile device management (MDM) controls how company phones and tablets are set up: which devices are enrolled, which apps and settings they carry, and what happens when one is lost. Mobile threat defence (MTD) detects and blocks attacks on those devices, such as phishing links, malicious apps, and network interception. MDM keeps a device in line with policy, MTD protects it from threats, and most organisations need both.
This guide explains what each tool does, where MDM stops, how the two work together, and how to decide what your fleet needs.
What is the difference between MDM and MTD?
The two tools look at different things. MDM looks at the state of the device and whether it is configured the way policy says it should be. MTD looks at what is happening on and around the device and whether it is under attack.
What MDM does
MDM is the tool IT uses to enrol, configure, and control a fleet of devices. Most MDM products have grown into unified endpoint management (UEM) platforms, such as Microsoft Intune and Omnissa Workspace ONE, which manage phones alongside laptops. Typical MDM tasks include enforcing a passcode and encryption, setting a minimum OS version, deploying and updating apps, pushing Wi-Fi, VPN, and email settings, separating work and personal data, and locking or wiping a device that is lost or belongs to someone who has left. On personal devices, that wipe is usually a selective wipe that removes only company data.
MDM can also check a few security-related settings, including OS version, passcode status, and, in most products, whether a device has been jailbroken or rooted. Those checks describe how the device is configured. They do not inspect the links a user opens, the networks the phone joins, or what installed apps are doing.
What MTD does
MTD is security software, offered by the around ten vendors in our guide to mobile threat defence software, that runs as an app on the device and looks for threats in the device itself, its apps, its network connections, and the links and websites the user opens.
It detects phishing sent by SMS, messaging apps, email, and QR codes, malicious or over-permissioned apps, rogue Wi-Fi and man-in-the-middle attacks, and signs of compromise such as spyware. When it finds a threat, it can block it on the device, warn the user, and report a risk level that other systems act on.
Comparing MDM and MTD
MDM |
MTD |
|
|---|---|---|
Question it answers |
Is this device set up the way our policy requires? |
Is this device, or the person using it, being attacked? |
Main capabilities |
Enrolment, configuration and compliance policies, app deployment, and remote lock or wipe. |
Detection and blocking of phishing, malicious apps, network attacks, and device compromise. |
What it cannot see |
Links users open, networks the device joins, and what apps are doing. |
It does not manage configuration, push apps, or wipe devices. |
Devices covered |
Enrolled devices only. |
Enrolled devices and, depending on the product, personal devices that are not enrolled. |
Usually owned by |
IT or the end-user computing team. |
The security team, often jointly with IT. |
Is MDM enough to secure company phones?
For most organisations it falls short, because MDM was built to manage devices and has no view of the attacks that most often reach phones.
Take a phone that passes every MDM check, with a passcode, a current OS, and only approved apps. Its user can still tap a phishing link in a WhatsApp message, enter their Microsoft 365 password on a fake login page, or join a hotel Wi-Fi network that is intercepting traffic. MDM reports the phone as compliant throughout, because none of those events changes how the device is configured.
There are two further gaps. MDM covers only enrolled devices, so personal phones used for email and Teams, and contractors’ devices, often sit outside it entirely. MDM also evaluates compliance when a device checks in, so it has no way to react the moment an attack starts.
MDM remains essential for the job it does. Detection is the part it leaves uncovered, and that is the job MTD is built for.
Do I need MTD if I already have MDM?
If your phones and tablets can reach company email, files, or SaaS apps, you almost certainly do. MDM keeps the device set up correctly, and MTD covers the threats that a correctly set-up device can still meet.
The two also make each other more useful. MDM can deploy the MTD app silently to enrolled devices, so users do not have to install anything. MTD in turn gives MDM and your identity provider a risk signal that configuration checks could never produce, so a phone that has just connected to a malicious network can lose access before any compliance check would have noticed.
Some organisations already have an MTD option through an existing vendor. Microsoft 365 E3 and E5 include Microsoft Defender for Endpoint, which has apps for Android and iOS, and our comparison of Corrata and Microsoft Defender for Endpoint on mobile covers how that option works. Whichever product you look at, test whether it detects threats across messaging apps as well as the browser, and whether it covers the personal devices your MDM does not reach.
How MDM and MTD work together
On a managed device, the two tools form a loop. The MDM enrols the device, applies policy, and deploys the MTD app. The MTD app then monitors the device, its apps, and its connections, blocks what it can immediately, and calculates a risk level. That risk level feeds compliance and conditional access, so a device with an active threat loses access to company apps. Once the user fixes the problem, for example by removing a malicious app or updating the OS, the risk level drops and access returns without IT having to step in.
For a wider view that also covers mobile EDR and SIEM integration, see our guide to mobile endpoint security.
MDM and MTD on personal devices
Personal phones are where the difference between the two tools matters most. Employees are often reluctant to enrol their own phone in MDM, since full enrolment gives the employer control over a device they paid for, and many organisations do not ask them to. Those phones still read company email and join Teams calls.
MTD can protect a personal device without MDM enrolment. The app is installed from an email or SMS invite, protects against phishing, malicious apps, and network attacks, and can report the device’s risk into access decisions. Before rolling out any MTD product to personal devices, check what it collects; Corrata sets this out in its product privacy statement.
How to decide what your fleet needs
If you manage corporate-owned phones through Intune or Workspace ONE, keep the MDM and add MTD, then connect MTD’s risk level to compliance and conditional access so that a detection changes what a device can reach.
If staff also use personal phones for work, run MTD on those devices through invite-based installation, and base access to company apps on device risk instead of enrolment status.
If you run a smaller fleet without MDM, MTD on its own covers the threats, although you will still lack central configuration, app deployment, and remote wipe. Corrata Essentials is built for fleets of up to 250 devices.
How Corrata works alongside your MDM
Corrata provides mobile threat defence for iOS and Android, protecting corporate-owned and personal devices in the same platform. It integrates with the leading MDM platforms, including Microsoft Intune and Workspace ONE, for zero-touch deployment, and personal devices activate from an email or SMS invite. It also works with identity providers including Microsoft, Google, and Okta, and with EDR and XDR tools such as Microsoft Defender for Endpoint.
Detection runs on the device. Corrata blocks phishing links across SMS, messaging apps, email, and browsers, detects rogue Wi-Fi and adversary-in-the-middle attacks, blocks connections to command-and-control infrastructure, and flags dangerous apps, jailbroken or rooted devices, outdated operating systems, risky configurations, and spyware. When it finds indicators of compromise, the device can be blocked from enterprise apps until the issue is fixed, and the user gets guided steps to resolve it.
To see how Corrata would sit alongside your current MDM, you can request a demo with our team.
