An MDM or UEM platform decides which laptops and phones are trusted to reach corporate data, so when its enrolment, compliance data or administrator access drifts, every access decision built on it drifts too. This health check gives you thirteen quarterly metrics, each with a formula, a data source type and thresholds, to measure whether your mobile device management or unified endpoint management platform still covers the fleet, reports accurate posture and is itself protected as the privileged system it is. It is written for the endpoint or workplace engineering team that runs the platform and the security lead who relies on its compliance signal for conditional access. Device hardening settings and ownership models are covered in the Mobile Device Security Guide and the Mobile Device Management Security Guide; this page measures whether the platform is doing its job across the estate.
What this health check covers
The scope is the device management platform and everything it depends on: enrolment of corporate and personally owned laptops, phones, tablets and shared devices; the compliance and configuration policies it assigns; the posture signal it sends to the identity provider; the app protection policies for unmanaged devices; remote lock and wipe; and the platform's own administrators, connector certificates, enrolment tokens and API credentials. It applies to cloud-hosted and on-premises platforms and to estates that run more than one platform for different operating systems. NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise, frames the lifecycle this check follows: deployment, use and disposal.
The review is run by the endpoint or workplace platform owner and approved by the security lead responsible for endpoint risk. Results feed device trust decisions, so share the compliance accuracy figures with the identity team; see the Device Trust and Posture Guide for how the signal is used in access policy.
Key takeaways
- Enrolment coverage is the denominator for everything. Measure enrolled devices against an independent source such as purchase records and identity provider sign-ins, not against the platform's own count.
- A stale check-in is a false compliant. Devices that have not reported in days keep their last status, so freshness matters as much as the compliance rate.
- Compliance must gate access. A compliance policy that is not enforced by the identity provider is a report, not a control.
- The platform can wipe your fleet. Administrator roles, remote wipe rights and API credentials are high-impact privileged access and need the tightest review on the page.
- Platform certificates and tokens expire. An expired push certificate or enrolment token stops management silently, so track their validity.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this MDM and UEM platform health check at the cadence below. Collect each figure from the data source types described, score it against the green, amber and red bands, and record every amber or red result as a finding with an owner and a due date. Report each metric per operating system and per ownership type (corporate, personally owned, shared) as well as in total, because a blended figure hides the weakest group. Replace bracketed placeholders such as [Organisation] and [Name, role] with your own values.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full thirteen-metric health check | Quarterly | Endpoint platform owner | Security lead for endpoint risk | Metric workbook, device and policy exports, findings log |
| Enrolment and check-in freshness (MDM-01, MDM-03) | Weekly | Endpoint engineering | Endpoint platform owner | Device inventory export with last check-in |
| Platform certificate and token expiry (MDM-12) | Monthly, with alerts at 60 and 30 days before expiry | Endpoint engineering | Endpoint platform owner | Certificate and token register with expiry dates |
| Administrator and remote action review (MDM-10, MDM-11) | Quarterly | Identity security lead | Security lead for endpoint risk | Role assignment export, remote action audit log |
| Ad hoc rerun | After a lost device incident involving data exposure, a platform migration, an operating system major release or an acquisition | Endpoint platform owner | CISO delegate | Same as quarterly |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. Bands are contiguous: a value sits in exactly one band. Use a 14-day window for check-in freshness and a 30-day window for sign-in activity, and state both in the workbook.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| MDM-01 | Corporate device enrolment coverage | Active corporate-owned devices enrolled in the platform / active corporate-owned devices in the asset register or purchase records | Platform device inventory compared with asset register | 98% or above | 90% to below 98% | Below 90% |
| MDM-02 | Unmanaged devices reaching corporate data | Distinct devices that accessed corporate applications in 30 days and were neither enrolled nor covered by an app protection policy / distinct devices that accessed corporate applications | Identity provider sign-in logs with device identifiers | Below 2% | 2% to 10% | Above 10% |
| MDM-03 | Check-in freshness | Enrolled devices that checked in within 14 days / total enrolled devices not marked retired | Device inventory with last check-in timestamp | 95% or above | 85% to below 95% | Below 85% |
| MDM-04 | Compliance policy assignment | Enrolled devices with at least one compliance policy assigned for their operating system / total enrolled devices | Policy assignment report | 99% or above | 95% to below 99% | Below 95% |
| MDM-05 | Device compliance rate | Enrolled, checked-in devices evaluated as compliant / enrolled, checked-in devices | Compliance status report | 95% or above | 85% to below 95% | Below 85% |
| MDM-06 | Compliance enforced at sign-in | Corporate applications whose access policy requires a compliant or app-protected device / corporate applications in scope for device-based access | Identity provider conditional access policy export, application register | 95% or above | 80% to below 95% | Below 80% |
| MDM-07 | Operating system currency | Enrolled devices on an operating system version still receiving security updates and within [30] days of the latest security update / total enrolled devices | Device inventory with OS version and patch level, vendor support lifecycle list | 90% or above | 75% to below 90% | Below 75% |
| MDM-08 | Encryption and screen lock enforced | Enrolled devices reporting storage encryption on and a passcode or screen lock meeting policy / total enrolled devices | Device configuration status report | 98% or above | 92% to below 98% | Below 92% |
| MDM-09 | Retired devices wiped and removed | Devices marked lost, stolen or retired in the quarter that were remotely wiped or confirmed sanitised and removed from the platform and identity provider within [7] days / devices marked lost, stolen or retired in the quarter | Remote action audit log, asset disposal records, identity provider device list | 95% or above | 85% to below 95% | Below 85% |
| MDM-10 | Platform administrators on the approved list | Platform administrator accounts that are named people on the approved list, sign in through corporate SSO with phishing-resistant MFA, and hold a role scoped to their duty / total platform administrator accounts | Platform role assignment export, identity provider assignment export | 100% | 90% to below 100% | Below 90% |
| MDM-11 | Bulk and destructive actions with approval | Wipe, retire and bulk policy actions affecting more than [10] devices that carried a second-person approval or change record / total such actions in the quarter | Platform audit log, change management records | 100% | 90% to below 100% | Below 90% |
| MDM-12 | Platform credentials in date and owned | Push certificates, enrolment tokens, connector certificates and API credentials with a named owner and more than 30 days to expiry / total platform credentials | Platform certificate and token register, API client list | 100% | 90% to below 100% | Below 90% |
| MDM-13 | Audit log delivery | Days in the quarter on which the platform audit log was received by the SIEM / days in the quarter | SIEM ingestion report for the platform audit source | 100% | 97% to below 100% | Below 97% |
Read MDM-03 with MDM-05: a high compliance rate across a fleet where one in five devices has not checked in for weeks overstates posture. MDM-10 to MDM-12 measure the platform as a privileged system; abuse of a device management console or its API credentials to push software or commands across the fleet maps to MITRE ATT&CK T1072 Software Deployment Tools.
How to collect the data
- Asset register and purchase records (MDM-01): build the denominator from procurement, the asset register or the device vendor's enrolment programme list, not from the platform. Exclude devices with a recorded disposal date.
- Identity provider sign-in logs (MDM-02, MDM-06): take 30 days of sign-ins to corporate applications with device identifiers and device state, and the current conditional access policy set. Count each device once.
- Device inventory export (MDM-03 to MDM-05, MDM-07, MDM-08): export every enrolled device with ownership type, operating system and version, patch level, last check-in, assigned policies, compliance state, encryption and lock state. Use one export for all of these metrics so the denominators agree.
- Remote action and disposal records (MDM-09, MDM-11): join the platform's remote action audit log to the asset disposal record and the identity provider's device list, and check change records for bulk actions.
- Platform security data (MDM-10, MDM-12, MDM-13): export role assignments with scope, the identity provider assignment for the platform's console, every push certificate, enrolment token, connector certificate and API client with owner and expiry, and the SIEM's daily ingestion count.
Personally owned devices enrolled for work carry privacy limits on what the platform may collect; collect only the attributes your BYOD policy allows, as set out in the BYOD Policy Template.
Red flags that need action now
- A push certificate or enrolment token within 30 days of expiry with no named owner, or already expired.
- Platform administrators with global wipe rights who sign in with local accounts or without MFA.
- API clients or integration credentials with full write access to the platform and no owner or rotation date.
- A bulk wipe or retire action with no change record.
- Compliance policies set to report only, or applications that accept non-compliant devices without an approved exception.
- Lost or stolen devices still listed as active in the identity provider.
- Large groups of devices on an operating system version that no longer receives security updates.
- Days with no platform audit log in the SIEM.
If a red flag suggests the platform console or its credentials have been misused, switch to If your MDM and UEM platform is compromised. For individual lost devices use the Lost or Stolen Device Response Checklist.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-MDM-01 | [Number] corporate devices not enrolled | MDM-01 | [Critical / High / Medium / Low] | [Name, role] | [YYYY-MM-DD] | [Open / In progress / Closed / Risk accepted] |
| HC-MDM-02 | [Number] applications not requiring a compliant device | MDM-06 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-MDM-03 | [Certificate or token] expiring on [date] with no owner | MDM-12 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-MDM-04 | [Finding] | [MDM-nn] | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
Suggested severity: red on MDM-06, MDM-10, MDM-11 or MDM-12 is critical with a 30-day due date; other reds are high at 60 days; ambers are medium at 90 days.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Enrolment gaps and unmanaged access (MDM-01, MDM-02) | Mobile Device Security Guide, enrolment and app protection sections |
| Compliance and enforcement (MDM-04 to MDM-06) | Device Trust and Posture Guide |
| Operating system currency and baseline settings (MDM-07, MDM-08) | Endpoint Hardening Checklist; Mobile Device Management Policy Template |
| Retired and lost devices (MDM-09) | Device Reassignment and Reimaging; Lost or Stolen Device Response Checklist |
| Administrators, destructive actions and platform credentials (MDM-10 to MDM-12) | Mobile Device Management Security Guide |
| Audit log gaps (MDM-13) | Endpoint Telemetry Guide |
Framework mapping
| Metric | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| MDM-01 to MDM-03 | CM-8 System Component Inventory; AC-19 Access Control for Mobile Devices | ID.AM-01 |
| MDM-04 to MDM-06, MDM-08 | CM-6 Configuration Settings; AC-19 Access Control for Mobile Devices; SC-28 Protection of Information at Rest | PR.PS-01 |
| MDM-07 | SI-2 Flaw Remediation | PR.PS-01 |
| MDM-09 | MP-6 Media Sanitization | ID.AM-01 |
| MDM-10, MDM-11 | AC-2 Account Management; AC-6 Least Privilege | PR.AA-05 |
| MDM-12 | IA-5 Authenticator Management | PR.AA-01 |
| MDM-13 | AU-2 Event Logging; AU-6 Audit Record Review, Analysis, and Reporting | DE.CM-09 |
In CIS Controls v8.1 the metrics sit mainly in Control 1 (Inventory and Control of Enterprise Assets), Control 4 (Secure Configuration of Enterprise Assets and Software) and Control 7 (Continuous Vulnerability Management), with administrator metrics in Control 5 and Control 6.
Related guides
- Mobile Device Management Security Guide: how to secure the platform these metrics measure.
- Endpoint Security Maturity Model: the maturity levels this evidence supports.
- Identity Security Metrics Guide: rolling device trust figures into identity reporting.
- If your MDM and UEM platform is compromised: response when the platform itself is misused.
- UEM Buyer's Guide: if the health check shows the platform cannot meet these measures.
References
- NIST: SP 800-124 Rev. 2 Guidelines for Managing the Security of Mobile Devices in the Enterprise
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls Version 8.1
- MITRE ATT&CK: Software Deployment Tools
Related NHI Mgmt Group resources: Endpoint Security Guide, BYOD Security Programme, EDR and XDR platform health check, MDM and UEM platform rollout playbook.