Free MDM software: what you get, what you risk, and when to upgrade

Free Mobile Device Management (MDM) software exists in three distinct forms. Commercial vendors run perpetual free tiers on their hosted infrastructure, with device limits or feature ceilings. Some commercial vendors bundle MDM into broader subscriptions, where the MDM is free at the margin once you pay for the bundle. Open-source projects publish code that you install and operate on your own servers, with no licensing cost but with maintenance overhead. The three categories share the word “free” but carry different cost structures, support models, and risk profiles.

This post separates them. The first section profiles free MDM options across three categories: hosted free tiers, bundled MDM, and open-source self-hosted projects. The second section names what each free option leaves out, where the limits sit, and which gaps matter most. The third section identifies five triggers that signal commercial MDM has become the better choice, regardless of which free tool you started with.

Before the vendor profiles, here is how the three free-MDM categories compare, plus the free-trial category they are often confused with.

Type	What it means	Best for	Main risk
Commercial free tier	Hosted SaaS with device or feature limits	Small fleets, pilots, micro-businesses	Hitting a device cap or feature wall
Bundled MDM	Included in another paid subscription, such as Microsoft 365	Teams already paying for the bundle	Not truly free if you do not already need the bundle
Open-source MDM	Self-hosted software with no license fee	Technical teams with server and admin skills	Maintenance, security, uptime, and support burden
Free trial	Time-limited access to paid software	Vendor evaluation before purchase	Expires and is not a long-term free option

What you get from free MDM software

Free MDM divides into three categories with very different cost structures. Commercial free tiers are vendor-hosted SaaS with a free plan that has a device limit or feature ceiling. Bundled MDM is included in a broader paid subscription, such as Microsoft 365, where the MDM is free at the margin for organizations already paying for the bundle. Open-source MDM is community-maintained software that you install on your own infrastructure, with the codebase available under permissive or copyleft licenses.

All three are free in some sense, but in different senses. Commercial free tiers are free with device or feature limits. Bundled MDM is free at the margin if you already pay for the parent subscription. Open-source MDM is free at the licensing layer but not at the operational layer. The categories differ in where the cost actually sits and what kind of support you can expect when something breaks.

Commercial free tiers: vendor-hosted SaaS

Commercial free tiers are the easiest way to evaluate MDM. You sign up on the vendor’s site, enroll devices through their console, and use the platform within the free limit. When you outgrow the limit, you move to a paid tier on the same console with the same data.

Miradore Free. Miradore offers a perpetual free tier with no time limit. The free plan covers basic device management across Android, iOS, Windows, and macOS, including enrollment, basic policy enforcement, and inventory. Advanced features such as automation, business policy templates, and integrations are available in the Premium and Enterprise tiers. Miradore was acquired by GoTo in 2022 and now sits alongside GoTo Resolve in a broader IT management portfolio. Best for micro-businesses and pilots that want a SaaS MDM with no commitment.

ManageEngine Mobile Device Manager Plus Free. ManageEngine offers free MDM for up to 25 devices, with feature depth that is unusually generous for a free tier. Cross-platform coverage spans Android, iOS, Windows, macOS, ChromeOS, and tvOS. The free edition includes profile management, app management, asset tracking, and basic security policies. The 25-device hard cap is the constraint. Best for SMBs that may grow into the paid Standard or Professional tiers within 12 to 24 months.

Jamf Now. Jamf Now is the SMB-tier product from Jamf, separate from the enterprise Jamf Pro. The first three devices are free, which makes Jamf Now easy to evaluate before committing to a budget. Beyond three devices, Jamf Now moves to per-device monthly pricing. Coverage is Apple-only: iOS, iPadOS, and macOS. Best for very small Apple-only teams testing MDM, or for evaluating whether Jamf is the right vendor before committing to Jamf Pro.

AirDroid Business Free. AirDroid Business offers a free tier focused on Android device management. The free plan covers a limited number of devices and includes basic remote control, app management, and policy enforcement. iOS coverage exists but is secondary to the Android focus. The free tier is valuable for organizations testing remote-control workflows on Android fleets, particularly in delivery, logistics, and POS contexts. Beyond the free limit, paid tiers offer higher device counts and additional features.

Bundled MDM: included with broader subscriptions

Bundled MDM is included in a subscription you are already paying for, where the MDM itself adds no incremental license cost. The most common example is Microsoft Intune within Microsoft 365.

Microsoft Intune (with Microsoft 365). Microsoft Intune is not free as a standalone MDM. It is included with Microsoft 365 Business Premium and Enterprise E3 and E5 licenses, which means the MDM is free at the margin for organizations already paying for one of those Microsoft 365 tiers. For an organization not on the Microsoft stack, Intune should be compared to a paid per-user tool, not to free MDM. Coverage spans Android, iOS, Windows, and macOS, with strong depth in Windows endpoints. Best for SMBs already standardized on Microsoft 365, where adopting Intune adds no incremental license cost.

Open-source self-hosted MDM: community project.s

Open-source MDM is free at the licensing layer but not at the operational layer. You install the MDM server on your own infrastructure, manage TLS certificates, run database backups, apply security patches to the MDM server itself, and scale the deployment as your fleet grows. The codebase is community-maintained. Support is community forums plus whatever your team can figure out.

Headwind MDM. Headwind MDM is an open-source MDM platform primarily focused on Android, including rugged devices and kiosk scenarios. The project publishes its source code under a community license and offers a paid commercial edition for organizations that want vendor support. Headwind is one of the more actively maintained open-source MDM projects, with regular releases and a documented installation path. Best for Android-heavy organizations with internal Linux server expertise.

MicroMDM. MicroMDM is a Go-based, open-source MDM server focused on Apple devices, with its origins in Square’s IT team. The codebase is MIT-licensed and well-documented. MicroMDM speaks the Apple MDM protocol directly, which means it integrates with Apple Business Manager and Apple School Manager workflows. The project requires comfort with the command line, server administration, and the Apple MDM specification. Best for technically capable Apple-only IT teams that want to own their MDM infrastructure.

Other open-source MDM projects. Several other open-source MDM projects exist, including Flyve MDM (cross-platform, integrated with the GLPI asset management ecosystem), WSO2 IoT Server (enterprise-grade but complex), and smaller community projects on GitHub. Maintenance status varies widely. Before committing to any open-source MDM, verify the last commit date, the number of active maintainers, and the size of the community. A project that looked promising two years ago may be effectively abandoned today.

The table below summarizes the four commercial free tiers across five attributes.

Vendor	Free duration	Device limit	Platforms	Support model	Best for
Miradore Free	Perpetual	No device cap on free tier (limited features)	Android, iOS, Windows, macOS	Community plus paid support tiers	Micro-businesses and pilots
ManageEngine MDM Plus Free	Perpetual	25 devices	Android, iOS, Windows, macOS, ChromeOS, tvOS	Community plus paid options	SMBs growing into enterprise
Jamf Now	Perpetual (3 devices free)	3 Apple devices	iOS, iPadOS, macOS	Email plus community	Apple-only micro-teams
AirDroid Business Free	Perpetual	Small device count (verify current limit)	Android primary, iOS secondary	Community plus paid options	Android-heavy small fleets

The open-source MDM projects above differ enough in focus, maintenance, and technical burden that a side-by-side view is useful before adopting any of them.

Project	Primary focus	Technical burden	Support model	Best for	Check before adopting
Headwind MDM	Android, kiosk, rugged	Medium to high	Community plus paid commercial edition	Android-heavy teams with Linux admin skills	Last release date, docs quality, paid support option
MicroMDM	Apple MDM protocol (iOS, iPadOS, macOS)	High	Community only	Apple-only technical teams that want to own their infrastructure	GitHub activity, current Apple protocol coverage, community size
Other GitHub projects	Varies (Flyve MDM, WSO2 IoT Server, smaller projects)	High or unknown	Usually community only	Testing, labs, narrow use cases	Last commit date, active maintainer count, issue activity, security history

What you risk with free MDM software

Free MDM works for some teams and fails for others. The difference is usually not the software itself but a mismatch between what the free option provides and what the operation actually needs. Five risk categories account for most failures.

Feature gaps that matter most

Free tiers usually exclude the features that take an MDM deployment from “basic device management” to “production-ready operations.” The most common omissions are:

Pre-built compliance templates. Templates for CIS Benchmarks, NIST, HIPAA, CJIS, and PCI-DSS are usually paid-tier features. Without them, your team has to build compliance policies from scratch, which is error-prone and slow.

Remote view and remote control. The ability to see what is on a device screen and interact with it for support is often gated. Free tiers may include remote lock and wipe, but not live remote screen sharing.

Automated device enrollment at scale. Apple Automated Device Enrollment, Android Zero-Touch, and Windows Autopilot integrations may work on free tiers, but with limits on batch enrollment, configuration depth, or device count.

BYOD work-profile depth. Work profile separation on Android and managed app configurations on iOS are often partial on free tiers. Per-app VPN, selective wipe, and managed app catalogs are typically paid-tier features.

Tamper-resistant audit logging. Comprehensive audit logs that document every admin action and policy change, in a format that satisfies compliance auditors, are usually paid-tier features. Basic event logs may be available, but exportable, retained, and tamper-evident logs are not.

Support and SLA differences

Free MDM rarely includes meaningful support. Commercial free tiers typically offer community forums, knowledge base articles, and email with no response SLA. Open-source projects offer community Slack or Discord channels, GitHub issues, and whatever expertise your own team can build.

Paid MDM, including Bento MDM, includes dedicated support with response SLAs, onboarding assistance, and training resources. The cost of an unresolved MDM incident, a botched enrollment for 200 new hires, a wipe that did not propagate, a compliance gap discovered mid-audit, can easily exceed the per-device licensing cost for the year.

Compliance and audit exposure

For regulated industries, free MDM is rarely sufficient. HIPAA-covered entities, government contractors under CJIS, payment processors under PCI DSS, and EU organizations under GDPR all need MDM capabilities that map directly to specific regulatory requirements.

The capability gap is the issue. Pre-built compliance templates, mandatory audit logging with retention controls, role-based access control with separation of duties, and encryption enforcement reports for auditors. These are paid-tier features for most vendors. Running free MDM in a regulated environment usually means custom-building these compliance layers, which is slower and more error-prone than using vendor-provided templates.

Self-hosting risk for open-source MDM

Open-source MDM transfers the operational burden from the vendor to your team. The MDM server itself needs patching for security vulnerabilities. TLS certificates need rotation. Database backups need scheduling and testing. The deployment needs scaling as the device fleet grows.

Total cost of ownership for open-source MDM is often higher than that of commercial SaaS within 12 to 24 months, once engineering hours are factored in. An SRE or systems administrator spending 5 hours per week maintaining the MDM server costs more annually than a commercial SaaS solution for small-to-mid-sized fleets.

Self-hosting also creates a single point of failure that the team owns. If the MDM server goes down at 2 AM, your team responds. With commercial SaaS, the vendor responds, and an SLA defines the response time.

The scale cliff

Every commercial free tier has a hard limit. ManageEngine MDM Plus is free for 25 devices, then charges per device. Jamf Now is free for three Apple devices. AirDroid Business Free caps the number of devices. Crossing the limit triggers an immediate licensing decision, often during a critical growth period when the team is too busy to evaluate alternatives carefully.

The scale cliff also affects features, not just device count. Some vendors include basic policy enforcement on free tiers, but gate kiosk mode, compliance templates, or remote control. When you need one of these gated features, the upgrade is immediate.

Plan for the cliff before you hit it. Evaluate paid tiers from your current free vendor and at least two alternatives while you are still under the cap. Decisions made under deadline pressure tend to be expensive.

When to upgrade from free MDM

Five triggers tend to signal that free MDM is no longer the right tool. Each trigger maps to an operational threshold that directly addresses MDM. Recognizing the trigger before the operation breaks is the difference between a planned upgrade and a forced one.

Trigger 1: Device count crosses the free-tier ceiling

This is the most obvious trigger and the easiest to plan for. If your fleet is approaching the free-tier limit (25 devices for ManageEngine, 3 for Jamf Now, small caps for AirDroid Business), start evaluating paid tiers six months before you expect to hit the cap.

The upgrade path within the same vendor is usually the path of least resistance, since enrollment, policies, and admin training carry over. But the moment you upgrade is also a good moment to compare against alternatives. Pricing, feature gating, and platform coverage shift between vendors over time. The vendor that gave you the best free tier may not be the best paid option.

Trigger 2: A compliance requirement appears

A new client in a regulated industry, an expansion into healthcare or government, or an audit notice. Any event that requires you to demonstrate specific MDM controls within a defined timeline. Pre-built compliance templates for CIS, NIST, HIPAA, CJIS, and PCI DSS are paid-tier features offered by almost every vendor.

Building compliance policies from scratch on free MDM is possible, but slow and error-prone. A paid vendor that includes compliance templates can shorten audit preparation from weeks to days. For regulated industries, the cost calculus favors paid MDM even at small device counts.

Trigger 3: A BYOD program launches or expands

BYOD requires specific MDM capabilities: Android work profiles, iOS managed app configurations, per-app VPN, selective wipe, and managed app catalogs. Free tiers usually provide partial BYOD support, often gating the deeper features behind paid tiers.

If a BYOD program is launching or growing, the features that make BYOD viable are likely to be gated. Evaluate paid tiers before announcing the BYOD program to employees, so the enrollment experience is consistent.

Trigger 4: Remote workforce needs deeper management

Remote view and remote control let IT support employees in different cities access devices without shipping the devices. Automated enrollment lets IT ship a sealed device to a new hire’s home, where it configures itself on first boot. Offline management lets IT push policies to devices that lose connectivity for extended periods.

These capabilities are usually paid-tier features. For a fully remote or hybrid team, the productivity gains from remote troubleshooting alone often justify the upgrade. The alternative, shipping devices back and forth for IT to touch them, is operationally untenable above a small headcount.

Trigger 5: Self-hosting maintenance burden exceeds team capacity

For open-source MDM users specifically: when your team spends more time maintaining the MDM server than managing devices, the math has shifted. The point at which the labor cost of self-hosting exceeds the licensing cost of commercial SaaS varies with team rate and fleet size, but it typically occurs between 50 and 200 devices.

The transition from self-hosted open-source MDM to commercial SaaS often happens during a critical growth period. Plan the migration before it becomes urgent. Export device data, re-enroll devices through the new vendor’s automated enrollment workflow, and decommission the open-source server once the new platform is stable.

How to choose your upgrade path

When one of the five triggers fires, the upgrade decision is no longer optional. The remaining question is which paid MDM to upgrade to. Three approaches reduce the cost of a wrong choice:

First, list the specific capabilities the trigger requires. If the trigger is compliance, list the required compliance templates. If the trigger is BYOD, list the required work profile features. Vendors then qualify or disqualify based on whether they include those capabilities at a price you can afford.

Second, evaluate at least three options. The vendor whose free tier you used is one option, not the default option. Pricing, feature gating, and platform coverage vary between vendors and change over time. Three options give you negotiation leverage and a fallback.

Third, calculate the three-year total cost of ownership, not the monthly cost. Per-device per-month pricing is the headline number, but implementation services, premium support, additional admin seats, and feature add-ons can add 30 to 50 percent to that figure. Run the TCO math against every vendor on the same basis. The cheapest headline price is rarely the cheapest three-year cost.

Frequently asked questions

What is the difference between free MDM and an MDM free trial?

Free MDM is a perpetual offering with no expiration date, but with feature or device limits. Free MDM trials are time-limited evaluations of the full paid product, typically 14 to 30 days, after which the trial expires unless converted to a paid plan. Free MDM is for organizations that may never pay for MDM. MDM free trials are for organizations evaluating a specific vendor before committing to a budget.

Is Microsoft Intune actually free?

Microsoft Intune is not free as a standalone product. It is included with Microsoft 365 Business Premium and Enterprise E3 and E5 licenses. If your organization already pays for one of these M365 tiers, Intune adds no incremental license cost. If you do not have M365 Business Premium or higher, standalone Intune licensing is a per-user monthly fee, not free. For most SMBs, the Intune-bundled path makes sense only if M365 is already the standard.

Is open-source MDM secure?

Open-source MDM is as secure as your team can keep it. The code itself is reviewable, which is an advantage. But your team is responsible for patching the MDM server when vulnerabilities are disclosed, rotating TLS certificates, hardening the operating system, and monitoring for compromise. Commercial SaaS shifts these responsibilities to the vendor. For teams with strong DevOps and security expertise, open-source MDM can be more secure than poorly configured commercial MDM. For teams without that expertise, commercial SaaS is usually safer.

Can a small business use free MDM forever?

Yes, if the operation stays within the free tier limits and never triggers an upgrade requirement. Some businesses run on free MDM indefinitely with 10 to 20 devices, no BYOD, no compliance mandates, and no need for remote control. The forever case is real but narrow. Most growing organizations hit one of the five upgrade triggers within 18 to 36 months. Planning for the upgrade in advance is cheaper than reacting to a forced one.

What is the best free MDM for iPads?

Jamf Now is the most established free iPad management option, with the first 3 iPads free. Miradore Free covers iPads as part of its cross-platform coverage. ManageEngine MDM Plus Free supports iPads within its 25-device cap. For Apple-only fleets that want open-source, MicroMDM is a credible option for technically capable teams. The right choice depends on fleet size and platform mix. If iPads are alongside Windows or Android devices, cross-platform options like Miradore or ManageEngine are a better fit than Apple-only Jamf Now.

What is the best free MDM for Android?

Several options handle Android well. Miradore Free covers Android as part of its cross-platform free tier. ManageEngine MDM Plus Free includes Android within its 25-device cap. AirDroid Business Free is Android-focused and includes remote control features that are usually paid-tier elsewhere. Headwind MDM is the leading open-source option for Android-heavy deployments. The right choice depends on whether you want hosted SaaS or self-hosted open-source software, and whether you need cross-platform coverage or Android-only.

How long does free MDM last before you have to pay?

Commercial free tiers last indefinitely as long as you stay within the device and feature limits. There is no expiration date for Miradore Free, ManageEngine MDM Plus Free, Jamf Now’s 3-device entry, or AirDroid Business Free, as long as you remain under the cap. Open-source MDM incurs no licensing costs and has no time limit. The point at which you pay is when one of the five upgrade triggers fires: device count, compliance, BYOD, deeper remote management, or self-hosting burden. For some operations, that point never arrives. For most, it arrives within two years.