If you have been handed a proposal for a mobile device management platform, or if someone on your team has recommended deploying one, you may have encountered a lot of technical language without a clear explanation of what is actually happening behind the scenes. Enrollment, configuration profiles, kiosk mode, zero-touch provisioning, compliance policies: these terms get used freely in MDM conversations, but they do not mean much if no one has explained the underlying mechanics.
This guide is a plain-language explainer of how MDM actually works. It is written for the business owner, operations leader, or executive who needs to understand the technology well enough to make good decisions about it, without needing to become an IT specialist in the process.
The Core Idea: A Persistent Connection Between a Device and a Central Platform
The foundation of mobile device management is a persistent, secure connection between each managed device and a central management platform. When a device is enrolled in an MDM platform like Moki, it establishes a connection with the platform and checks in regularly. Through that connection, the platform can send instructions to the device, receive status information from the device, and enforce policies that determine how the device behaves.
Think of it like a store manager who can see every register in every store at once, can send instructions to each register remotely, and can change what each register is allowed to do without visiting any of them. MDM is that layer of central visibility and control applied to a fleet of tablets, kiosks, POS terminals, or any other managed device.
How a Device Gets Enrolled
Before an MDM platform can manage a device, the device needs to be enrolled. Enrollment is the process of establishing the trusted connection between the device and the management platform. Once it is complete, the device is under the platform’s management and can receive configurations and instructions remotely.
There are several ways enrollment can happen, and the right one depends on the device type and how the hardware was purchased.
Automated enrollment, which Moki supports through Android’s Zero-Touch program and Apple Business Manager, allows devices to enroll themselves automatically the first time they are powered on and connected to the internet. The device recognizes that it belongs to the organization and configures itself without any human involvement at the device. This is the preferred method for deploying large numbers of devices across multiple locations, because each device can be shipped directly to its destination and it sets itself up when it is plugged in.
Manual enrollment involves a person at the device completing a setup process, either by scanning a QR code, entering a server address, or installing an agent application. This is practical for smaller deployments or for devices that cannot use automated enrollment.
Moki’s Android Agent pre-registration allows devices to be registered in Moki before they ship using their serial numbers, so that when the Moki Agent app opens on the device, enrollment completes automatically without manual input.
What Happens After Enrollment: The Configuration Profile
Once a device is enrolled, the MDM platform sends it a configuration profile. This is the set of instructions that defines how the device behaves. It is the most important concept in understanding how MDM works in practice.
A configuration profile can include:
- Which app or apps the device is allowed to run
- Whether kiosk mode is active, restricting the device to a single application
- Which Wi-Fi network the device should connect to automatically
- Which hardware features are enabled or disabled, such as camera, Bluetooth, or USB
- What security requirements apply, including passcode length and screen timeout
- Which apps are installed, at which version, and how they are distributed
- What the device’s screen looks like, including wallpaper and home screen layout
When a profile is applied to a device, the device follows those instructions. If the profile says the device should only run one application, the device locks itself to that application. If the profile says the camera should be disabled, the camera is off. The device does not have the ability to override these instructions on its own.
Profiles are applied to groups of devices rather than individual devices, which is how a single IT person can configure hundreds of devices consistently in a single operation.
What Kiosk Mode Looks Like from the Inside
Kiosk mode is one of the most commonly used MDM configurations for customer-facing devices, and it is worth explaining in plain terms because it is often misunderstood.
When kiosk mode is enabled through an MDM profile, the device locks itself to a designated application at the operating system level. This means the restriction is not applied by a software overlay that a clever user might be able to get around. It is enforced by the operating system itself, through Apple’s supervised mode on iOS devices and Android Enterprise’s Device Owner mode on Android devices.
From the customer’s perspective, the device shows one application. There is no home button that takes them somewhere else. There is no notification that appears from another app. There is no browser they can open. The device does exactly one thing, and it does it every time.
From the IT team’s perspective, kiosk mode is a setting in the configuration profile. Changing which app is locked, updating the app’s content, or releasing the device from kiosk mode entirely are all done remotely from the Moki dashboard without touching the device.
How the Platform Monitors Devices
An MDM platform does not just send instructions to devices. It also receives information from them continuously. Moki’s Application Environment Monitoring tracks real-time data from every enrolled device, including whether the device is online or offline, the battery level, the memory usage, the connectivity status, and whether the managed application is running correctly.
This monitoring data feeds the alert system. When something crosses a threshold that the IT or operations team has defined, the platform sends a notification automatically. The team learns about a device that went offline or an app that crashed before a customer or a store manager reports it, which means the problem can be fixed before it becomes visible to anyone at the location.
How Remote Management Works
When a device has a problem that monitoring alone cannot resolve, the MDM platform’s remote management capabilities allow the operations or IT team to take action without visiting the device.
For Android and BrightSign devices, Moki’s remote control feature allows a team member to see the device’s live screen and interact with it using a mouse and keyboard, exactly as if they were standing in front of it. They can see what is happening, navigate the interface, and fix the issue directly.
Remote reboot sends a restart command to the device, which resolves a significant portion of device problems including frozen applications and connectivity issues, without anyone touching the hardware.
Remote app push installs or updates an application on the device. Remote configuration update changes any setting in the device’s profile. Remote wipe erases the device’s data entirely, which is used when a device is lost, stolen, or decommissioned.
Why This Matters for Your Business
The practical implication of how MDM works is that the operational cost of managing a device fleet does not need to scale with the fleet size. A business with 10 managed devices and one with 300 managed devices can both be managed by the same small team because the platform handles the repetitive, continuous work of monitoring, configuring, and maintaining each device. The team’s job is to define the rules once and respond to exceptions when they arise.
Schedule a Moki demo to see how the platform works in practice for your specific device type and deployment scenario, or start a free trial to experience it firsthand. Moki’s FAQ answers common questions about how the platform works for specific use cases.