Why is managing company mobile devices and mail apps so frustrating?
Enterprise mobile device management tools struggle with basic tasks like app deployment and clearing PIN codes across platforms. At the same time, sysadmins constantly deal with recurring user friction, such as iOS calendars failing to sync every 90 days due to re-authentication loops and difficult decisions regarding whether to support native mail apps or enforce Outlook-only environments.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Using alternative hardware like Chromebooks or Macbooks with MDM solutionsDid this help you?
- 2Relying on MAM (Mobile Application Management) rather than strict MDMDid this help you?
- 3Buying test devices to evaluate management capabilities firsthandDid this help you?
- 4Enforcing Outlook-only to simplify security and policy managementDid this help you?
- 5Setting up contact-only sync alongside the Outlook clientDid this help you?
- 6Allowing native apps with basic support while refusing to troubleshoot edge-case issuesDid this help you?
- 7Using alternative dedicated Apple MDM tools like Jamf, Kandji, or ScalefusionMDMDid this help you?
- 8Using companion GitHub resources and configuration templates via XML files to handle gapsDid this help you?
- 9Switching from Microsoft MFA to alternative providers like DuoDid this help you?
- 10Setting up passkeys inside the Authenticator app before initiating the web UI processDid this help you?
- 11Having users register a personal Apple ID using non-business info and signing into just the App StoreDid this help you?
- 12Getting the user to register an icloud.com account and purchase apps that wayDid this help you?
- 13Pulling sign-in logs and filtering out joined devicesDid this help you?
- 14Blocking access from unmanaged devices using Conditional AccessDid this help you?
- 15Implementing Mobile Application Management (MAM) on BYOD devicesDid this help you?
- 16Cross-referencing Entra sign-in logs with application filters or Exchange online shell commandsDid this help you?
- 17Updating the enforcement time and version settings within the configuration profileDid this help you?
- 18Ensuring devices are connected to power, WiFi, and signed out of all user accountsDid this help you?
- 19Using dynamic groups based on custom extension attributes or device categories set during a separate provisioning pipeline.Did this help you?
- 20Using on-demand VPN rules that trigger based on the active network type (e.g., Wi-Fi only).Did this help you?
- 21Deploying per-app VPN profiles for sensitive applications to prevent traffic from leaking during network transitions.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“I'm looking for reasons/advice regarding whether we should continue to support the native Mail/Calendar apps or go the Outlook-only route.”source ↗
“looking in Intune, I see only one iPad that has gotten an OS update within the past 12 months; the remainder are drastically behind.”source ↗
“The part I am struggling with the most is setting one up on iPhone in a way that's not a PITA for the end user.”source ↗
“We are running into a design question regarding how to handle devices differently based on whether they have a carrier-side Mobile Private Network (MPN) provisioned.”source ↗
“We have an upcoming audit, and we've been asked to provide an inventory of mobile devices that are actually being used to access company resources such as Outlook and Teams.”source ↗
“Where do I even start untangling this ball of yarn?”source ↗
“We migrated from Android devices to iOS due to one of the reasons being Android was a pain in the ass to manage - especially with things like deploying apps and removing PIN codes (yes, i've tried multiple MDM solutions and all of them has the same problem).”source ↗
“I've got a few VIP users who come to me every 90 days complaining that their iOS calendar isn't updating. Every single time, it's just that they need to re-auth.”source ↗
“The biggest reason to go Outlook only is addin support. Addins will only work with Outlook. I think Outlook also works better with conditional access, and it's more secure.”source ↗
“It’s still missing some basic functionality that other vendors have had for years. I won’t recommend at all. Until it supports bootstrap app packages, it’s a non starter.”source ↗
“i'd be real careful trying to split that logic with just static groups, it works fine for a pilot but you're gonna hate life when someone gets a device swapped and suddenly the carrier provisioning doesn't match the group membership anymore”source ↗
“had a similar setup with a different gateway last year and ended up having to push a per-app VPN profile for the sensitive stuff just to cover that gap”source ↗
“one thing that'll bite you regardless of the group design: intune can't see carrier side provisioning at all. the MPN lives on the sim/apn so there's no device attribute to hang a dynamic rule on”source ↗
“Does anybody use intune for macos? I know its a question that I shot myself on the foot with, how does it work with end users and do you think a separate mdm tool like jamf/kandji is needed to support apple devices for mdm?”source ↗
“Maybe 50% of them can get away without needing to purchase any apps but the rest of them could be anywhere in the world, at any time day/night and need to download an app.”source ↗
“There's no way we can instantly find and install an app for them on a 24 hour helpdesk.”source ↗
“You cannot do this with Apple Business and it's against TOS to use a personal account for business.”source ↗
Where this came up
People with this problem also raised
- 5How to handle rapid laptop and desktop deployments for mixed workforces?
- 2How to secure vendor emails on personal devices without MDM
- 6Unified tool for zero-touch provisioning and IT asset management
- 14How to stop students from scrolling phones during class
- 3How to manage multiple accounts on one platform without logging out?
- 2Ex monitoring child location during my custody time