Unified endpoint management (UEM) is software that enrols, configures, updates and, when needed, wipes every device that a company gives its staff, from one console. The devices include laptops, desktops, phones, tablets and rugged handheld scanners. When the software manages only phones and tablets, it is called mobile device management, or MDM.
Every company device passes through four stages. First, it is enrolled, which means it is registered as the company's device. Second, it is configured with the company's apps, Wi-Fi settings, email and security rules. Third, it is kept up to date with fixes, through patch management. Fourth, when it is lost, or when its user leaves, it is wiped, which means that all the company's data on it is erased. UEM handles all four stages, so that a small IT team can manage thousands of devices.
Consider a dairy cooperative in Anand that gives 900 Android handhelds to the staff who collect milk at village centres, and 150 laptops to its office staff. A new handheld arrives in its box. The supplier has already registered it to the cooperative, through Android's zero-touch enrolment service, which Google runs. When a collection employee turns it on and connects it to Wi-Fi, the handheld contacts UEM by itself and enrols. UEM installs the milk collection app and locks the handheld in kiosk mode, which means that it can run only that one app. A month later, one handheld is lost on a bus. The supervisor marks it as lost in UEM. The next time the handheld connects to the internet, UEM erases it.
Office laptops follow the same stages. When HR records a joiner in the human resources information system (HRIS), UEM prepares the apps for that person's laptop. It reads the person's account from the directory services. When the person leaves, UEM locks and wipes the laptop.
For a phone that belongs to the employee, UEM creates a separate work profile. The company manages only the work apps and work data inside the profile. It cannot see personal photos or messages. When the employee leaves, only the work profile is deleted.
UEM is half IT and half security. It installs the endpoint detection and response (EDR) agent on every laptop, and it encrypts each disk. It installs mobile threat defence on phones. It also reports whether each device is up to date and encrypted. Zero trust network access (ZTNA) uses that report to refuse company apps to a device that is out of date.