Skip to content
Book a demo
Features

Everything Purple MDM enrols, configures, secures and proves

Zero-touch enrolment, a settings library with preview and undo, apps and patching with deadlines, encryption with key escrow, compliance checks that fix themselves, one small agent, reports over time and an audit log of everything. Every capability here is in the product today.

Book a demoSee how a device enrols itself
  • Apple, Windows, Android, ChromeOS and Linux
  • Zero-touch from the box
  • Every change previewed, staged and undoable
  • Device health feeds Purple Access
Book a demo

Enrolment

Zero-touch from the box, on every platform

Devices set themselves up for work the first time they are switched on. Personal devices enrol into a separate work area, with a plain page showing what IT can and cannot see.

  • Zero-touch for Apple: devices bought through Apple Business Manager enrol at first switch-on and arrive supervised and configured
  • Sign in to enrol: on recent iPhones, iPads and Macs a person types their work email in Settings and the device enrols
  • Windows zero-touch: a provisioning package or Entra ID join sets a new PC up at first boot with no IT visit
  • Android by QR code, and work profiles for personal phones
  • Chromebooks connected through the school's Google Admin in a few clicks, keeping the existing organisational units
  • Enrolment links and QR codes for everything else, and devices imported from Jamf, Intune or JumpCloud to move in waves

Configuration and policies

A settings library, smart groups, and every change previewed

Settings as forms rather than hand-written profiles, groups that keep themselves up to date, security baselines in one click, and preview, stage and undo on every change.

  • Settings library: restrictions, WiFi, wired network, VPN, email, certificates, login window, browser settings and more, with custom profiles still allowed
  • Static groups and smart groups built from rules, using device facts and the company directory
  • Security baselines applied to a group in one click, with a report of what each device still misses
  • Every change shows which devices it affects and which would fall out of compliance before it is saved
  • Roll out to a test group first, restore any earlier version, export and import whole configurations
  • Self-correcting settings: if someone removes a setting, the device puts it back, even offline

Apps, updates and patching

Apps, OS updates and third-party patches, by group and with deadlines

Apple apps with no Apple ID on the device, Windows packages targeted by group, managed Google Play, Chrome policy, OS update deadlines on every platform and a self-service catalogue.

  • Apple apps from Apps and Books with no Apple ID on the device, plus custom Mac packages
  • Windows apps as MSI and MSIX packages, targeted by group and removed when a device leaves the group
  • Android apps through managed Google Play; Chromebook apps and extensions force-installed by policy
  • OS updates with deadlines on Apple, Windows, Linux and ChromeOS
  • Chrome, Edge, Firefox and other common apps kept current by group, with deadlines and deferrals
  • A self-service catalogue: people install approved apps and run simple fixes, such as rejoin WiFi, without calling IT

Security

Encryption, admin rights, lock and wipe, certificates

Disk encryption with its recovery keys escrowed, managed local admin passwords, time-limited admin rights, lock and wipe with location, Activation Lock handled, and WiFi certificates renewed before they expire.

  • FileVault and BitLocker switched on, recovery keys stored securely, shown only to permitted admins and logged
  • Managed local admin passwords on Mac and Windows, rotated after each use
  • Time-limited admin rights: a person asks, gets them for a set time on approval, and loses them automatically
  • Lock, wipe and lost mode on Apple, Android and Chromebooks, with location for lost devices; a wipe can require a second admin's approval
  • Activation Lock handled, so wiped Macs and iPhones can be reused instead of being locked to a leaver's Apple ID
  • Sign in with your company identity on Macs and Windows (Entra ID, Okta or Google), and WiFi and wired network certificates issued and renewed automatically

Compliance and network access

Checks that explain themselves, fixes that send themselves

Compliance checks for encryption, OS version, passcode, jailbreak or developer mode, patch status, certificate health and last check-in. When a check fails and a fix exists, it is sent, and the person is told what to do.

  • Compliance checks for encryption, OS version, passcode, jailbreak or developer mode, patch status, certificate health and last check-in
  • Automatic fixes where one exists, sent without waiting for IT, with the person told what to do and an honest time
  • Plain-English diagnosis: why a device is non-compliant or a command failed, in two sentences, with the evidence
  • Works with Purple Access: device health moves an unhealthy device to a safe network and lets it back once fixed, with no admin involved
  • Compliance can be shared with identity providers so cloud apps can check it too

Scripts and the Purple agent

One small, signed agent for Mac, Windows and Linux

The agent keeps devices in their desired state, reports changes instantly and runs scripts, on demand or on a schedule, with output and history per device.

  • One static, signed binary per platform, holding an always-on connection
  • Desired state kept on the device: drift is corrected even offline
  • Scripts on demand or on a schedule, with output and history per device
  • Only admins with the scripts permission can see script contents and output
  • On Linux: disk encryption and update checks, patching and 802.1X WiFi certificates

Visibility and reports

Inventory, reports over time, alerts and an audit log

Hardware, apps, users, storage and certificates for every device, searchable and exportable. Compliance, OS versions, patch status, enrolment and certificates over time, emailed on a schedule.

  • Inventory: hardware, apps, users, storage and certificates for every device, searchable and exportable
  • Reports over time: compliance, OS versions, patch status, enrolment and certificates, emailed on a schedule
  • Chromebook auto-update expiry report for replacement budgets
  • Alerts for expiring certificates, silent devices and failing commands
  • An audit log of every admin action and every command, with who did it
  • A full REST API with keys per role, rate limits, safe retries and bulk actions, plus signed webhooks and an event stream for SIEM tools

Trust and data

Your data, in your region, apart from everyone else's

Every customer's data is kept apart from every other's at the database level and stays in its region. Encryption keys are held in a cloud key management service and rotated. Three roles decide who can do what.

  • Every customer's data kept apart at the database level
  • Data stays in its region, Europe or the United States; everyone signs in at one address and is taken to their own region
  • Encryption keys held in a cloud key management service and rotated
  • Customers can export or delete all their data on request
  • Roles: Admin, Helpdesk (lock and fix, no wipe, no recovery keys) and Read only
  • Personal devices get a transparency page showing exactly what IT can and cannot see

Feature questions

Ask the Purple MDM team anything else

Can Purple MDM manage Windows and Mac together?

Yes. Windows 11 is managed through Windows MDM and declarative configuration plus the Purple agent; Macs through Apple MDM and declarative management plus the agent. Both read the same settings library and the same groups.

Does Purple MDM store disk encryption recovery keys?

Yes. FileVault and BitLocker are switched on by policy and their recovery keys are stored securely, shown only to admins with permission, with every view logged.

Can people get admin rights without a ticket?

A person asks for admin rights, gets them for a set time on approval, and loses them automatically. Managed local admin passwords on Mac and Windows rotate after each use.

Does it include remote screen sharing or antivirus?

No. Purple MDM does not offer remote control, and it is not a security agent: it does not scan for malware. It manages, secures and proves devices alongside the security tools you already run.

Which identity providers does it work with?

Entra ID, Okta and Google Workspace for signing in to Macs and Windows with a company identity and for groups. Compliance can be shared with identity providers so cloud apps can check it too.

Can I script against Purple MDM?

Yes. A full REST API with keys per role, rate limits, safe retries and bulk actions, plus signed webhooks and an event stream for every enrolment, command, compliance change and admin action.

See every device in one console, on your own fleet

Tell us which devices you run, how many, and what you manage them with today. The Purple team shows you Purple MDM on a fleet like yours: zero-touch enrolment, a change previewed and undone, a failed check explained in a sentence, and a device moved off the network and back. Already a Purple customer? Sign in to the app with your Purple account.

Book a demoAlready a Purple customer? Sign in to Purple MDM
  1. We map your fleetA Purple expert maps your platforms, your groups and how devices arrive today, and answers your questions on enrolment, data regions, roles and migration.
  2. You see it on devices like yoursA demo of zero-touch enrolment, a previewed change, a failed check explained in plain English and, with Purple Access, a device moved off the network and back.
  3. You get your quotePriced per device, per month, for the platforms you run, direct or through your Purple partner, with a move in waves planned if you are coming from another MDM.

Your demo

Tell us your fleet. We show you Purple MDM running it.

A Purple expert comes back to book a demo on devices like yours, from the team behind Purple WiFi and Purple Access.