Mobile Device Management (MDM)

Enroll, manage, and fully control devices from your Simplr dashboard. MDM-as-a-service lets you download a profile, scan a QR code, and bring a device under management in seconds — then push policies, run remote commands, and monitor compliance across your whole fleet.

Android is supported today, built on Google's Android Management API. Apple (iOS/macOS) and Windows are on the roadmap.

Overview

MDM provides:

• One-time enterprise setup — connect a managed Google account once per organization
• Two enrollment modes — fully managed (full control) or BYOD work profile (privacy-preserving)
• Policies — reusable app, password, restriction, and kiosk rules applied to devices
• Remote commands — lock, reboot, reset passcode, or wipe any device
• Compliance monitoring — continuous device state + compliance reporting, with webhooks
• Per-device billing — metered automatically; you pay per enrolled device, per month

No MDM server, push service, or agent app runs on your side — Google hosts the control plane. Simplr orchestrates enrollment, policies, devices, and billing on top of it.

Enrollment modes

Mode	Control	Personal data	Best for	How it enrolls
Fully managed (Device Owner)	Total control of the entire device	Device is company-owned	Company-issued phones, kiosks, dedicated devices	Scan the QR during the initial setup of a factory-reset device (tap the welcome screen 6×), or zero-touch
Work profile (BYOD)	Only the managed work container	Personal apps & data stay private	Employees' personal devices	Install Android Device Policy from the Play Store and scan — no reset, no wipe

The mode is a property of the policy, so a work-profile token allows personal usage while a fully-managed token provisions Device Owner.

Quick start

1. Connect your enterprise (one time)

In the dashboard, go to Device Management → Enroll and complete the two-step Google sign-up. This binds a managed Google account to your organization and seeds two default policies (one per mode).

Selling MDM to customers requires being a registered Android Enterprise EMM. Reach out if you need help with onboarding.

2. Create or pick a policy

Default policies are created automatically. Create your own from Device Management → Policies, or via the API:

curl -X POST "https://api.simplr-ai.com/v1/mdm/policies?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Kiosk Lockdown",
    "management_mode": "fully_managed",
    "policy_json": {
      "kioskCustomLauncherEnabled": true,
      "cameraDisabled": true,
      "applications": [
        { "packageName": "com.example.kiosk", "installType": "KIOSK" }
      ]
    }
  }'

policy_json accepts any Android Management API policy document. Leave it out to start from the sensible baseline for the chosen mode.

3. Generate an enrollment token (QR)

curl -X POST "https://api.simplr-ai.com/v1/mdm/enrollment-tokens?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "policy_id": "POLICY_ID", "duration_hours": 168 }'

The response includes a qr_content payload. The dashboard renders it as a QR code on the Enroll page — scan it from the device using the flow for your chosen mode.

4. Manage the device

Once enrolled, the device appears under Device Management → Devices. Open it to view hardware details, compliance, and an activity timeline, and to issue commands.

# Lock a device remotely
curl -X POST "https://api.simplr-ai.com/v1/mdm/devices/DEVICE_ID/commands?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "type": "LOCK" }'

Remote commands

Command	Effect
LOCK	Immediately locks the device screen
REBOOT	Reboots the device (fully managed)
RESET_PASSWORD	Resets / clears the device passcode
RELINQUISH_OWNERSHIP	Removes a work profile from a personally-owned device
CLEAR_APP_DATA	Clears data for specified apps
WIPE	Wipes and unenrolls the device

Groups

Organize devices into groups and manage them in bulk. A group can carry a policy — assigning a device to the group applies that policy to it automatically. You can also issue a command (lock, reboot, reset passcode) to every device in a group at once.

# Create a group with a policy
curl -X POST "https://api.simplr-ai.com/v1/mdm/groups?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Warehouse scanners", "policy_id": "POLICY_ID" }'

# Assign devices to it (their policy updates automatically)
curl -X POST "https://api.simplr-ai.com/v1/mdm/groups/GROUP_ID/devices?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "device_ids": ["DEVICE_ID_1", "DEVICE_ID_2"] }'

# Lock every device in the group
curl -X POST "https://api.simplr-ai.com/v1/mdm/groups/GROUP_ID/commands?org_id=YOUR_ORG_ID" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "type": "LOCK" }'

You can also tag devices with metadata — ownership_type (corporate / BYOD / shared), an assigned user, and arbitrary custom_attributes (asset tag, cost centre, location) — via PATCH /v1/mdm/devices/{id}.

Compliance & grace periods

Compliance is evaluated continuously — every device sync re-checks the device against its policy. Each device has a compliance state:

State	Meaning
compliant	Device meets its policy
grace_period	Newly non-compliant — still usable, with a countdown to enforcement
non_compliant	Grace window elapsed — enforcement active
unknown	Not yet reported

When a device first goes non-compliant it enters a grace period (default 24 hours, configurable per enterprise). During the window it keeps working while you remediate; if it's still non-compliant at expiry, it flips to non_compliant. The dashboard shows the exact reasons (from Android's nonComplianceDetails) and the enforcement time.

Subscribe to MDM events on any webhook to react in real time:

• mdm.device.enrolled — a new device finished enrollment
• mdm.device.compliance_changed — compliance state changed (compliant ⇄ grace ⇄ non-compliant)
• mdm.command.completed — a remote command finished

See Webhooks for delivery, signing, and retry details.

Audit log & reports

Every administrative action — policy changes, commands, enrollment, group assignments — is written to an append-only audit log (it is never modified or deleted). System actions (enrollment, compliance transitions) are recorded too.

Export fleet data and the audit trail as CSV:

• GET /v1/mdm/reports/fleet-inventory.csv — every device with identity, OS, mode, ownership, and compliance
• GET /v1/mdm/reports/compliance-summary.csv — device counts by compliance state
• GET /v1/mdm/audit-log/export.csv — the full audit trail

Pricing

Device Management is available on Starter and higher plans and billed per enrolled device, per month, separate from API check credits. Groups, policies, commands, and the audit trail are included — you only pay the device quantity. See Pricing for details.