Apple, Windows, Android, ChromeOS and Linux, from one console
Each platform is managed the way its maker intends, and every setting comes from one library. Here is how Purple MDM manages each one, and what each gets.
- Apple
- Windows
- Android
- ChromeOS
- Linux
Every device in one console
macOS
Macs that arrive ready and stay in their desired state
A Mac bought through Apple Business Manager enrols at first switch-on, encrypts itself with its recovery key stored, gets its apps and WiFi certificate, and is kept in its desired state by the Purple agent.
How it is managed: Apple MDM and declarative management, plus the Purple agent.
- Zero-touch through Apple Business Manager, arriving supervised and configured
- FileVault switched on with its recovery key escrowed
- A managed local admin account, its password rotated after each use
- OS update deadlines, and Chrome, Edge, Firefox and other common apps patched by group
- Sign in with your company identity: Entra ID, Okta or Google
- Custom Mac packages alongside apps from Apps and Books
Sign in to enrol
- Device
- MacBook Air
- Work email
- sam@example.org
- Enrol this device
No links or profiles to send. The device enrols from the email alone.
iPhone and iPad
iPhones and iPads for staff, pupils and the shop floor
Company iPhones and iPads enrol at first switch-on and arrive supervised. Shared and frontline devices reset themselves between users with Return to Service, and apps install with no Apple ID on the device.
How it is managed: Apple MDM and declarative management.
- Zero-touch through Apple Business Manager, arriving supervised
- Sign in to enrol: a person types their work email in Settings
- Shared and frontline devices with Return to Service
- Lost mode with location, lock and wipe, and Activation Lock handled
- Apps from Apps and Books with no Apple ID on the device
- Personal iPhones enrol into a separate work area, with a transparency page
Windows 11
Windows PCs set up at first boot, with no IT visit
A provisioning package or an Entra ID join sets a new PC up at first boot, holding at the Enrollment Status Page until setup is done. BitLocker switches on with its key stored, Windows LAPS manages the local admin password, and the Purple agent keeps settings in place.
How it is managed: Windows MDM and declarative configuration, plus the Purple agent.
- Enrol by link, Entra ID or a provisioning package
- Zero-touch from a provisioning package or an Entra ID bulk join
- BitLocker with key escrow, and Windows LAPS for the local admin password
- Update rings with deadlines, and a Defender and firewall baseline
- Windows apps as MSI and MSIX packages, targeted by group
- WiFi and wired network certificates for EAP-TLS
- Claimed under your organisation
- Settings rendered for the platform
- Apps and WiFi certificate issued
- Encryption on, key stored
Android
Company Android devices fully managed, personal ones done fairly
Company phones and tablets enrol by QR code or zero-touch and are fully managed. A personal phone gets a work profile instead: a separate, managed area, with a plain page showing what IT can and cannot see.
How it is managed: Android Enterprise, through Google's Android Management API.
- Fully managed company phones and tablets, enrolled by QR code or zero-touch
- Work profiles on personal phones
- Apps through managed Google Play
- Lock, lost mode with location, reboot, passcode reset and wipe
- Managed WiFi with a device certificate held in the keystore
- A transparency page for every personal phone
ChromeOS
Chromebooks for schools, through the Google Admin you already have
Connect the school's Google Admin in a few clicks and keep your organisational units. Chromebooks get their Chrome policy and a WiFi certificate before anyone signs in, and a lost one is disabled with your message on screen.
How it is managed: Google's own Chrome management APIs, through the school's Google Admin connection.
- Chromebook inventory and Chrome policy, keeping your organisational units
- WiFi certificates before sign-in, so shared carts carry a device certificate, not a pupil's
- Lost-device disable with the school's message on screen, and powerwash
- Apps and extensions force-installed by policy
- Year-end moves between classes or year groups in one previewed step
- The auto-update expiry report, for replacement budgets
Settings library · Staff Macs
- WiFi: company network, EAP-TLSOn
- Passcode requiredOn
- FileVault with key escrowOn
- OS updates: 14-day deadlineOn
- Login window messageOn
- Custom profile: printersUploaded
Effective on this device
staff-baselinemac-network-certupdates-14dOverridden by a higher group
default-screensaverLinux
Ubuntu and RHEL machines held to the same checks as everything else
The Purple agent brings Linux into the same console: disk encryption and update checks, scripts and patching, and 802.1X WiFi certificates, with the same compliance verdicts as the rest of the fleet.
How it is managed: The Purple agent.
- Disk encryption and update checks
- Scripts on demand or on a schedule, with output and history
- Patching with deadlines
- 802.1X WiFi certificates, requested and renewed by the agent
- Screen lock and waiting-update checks
- Desired state kept on the device, even offline
- MacIn its desired state
- Windows PCOffline, still in its desired state
- Linux serverIn its desired state
Every platform
One settings library, one set of groups, one set of checks
A WiFi certificate, a passcode rule or an update deadline is set once and rendered to each platform the way that platform expects. Groups and compliance checks span every platform, so a mixed fleet is one fleet.
Platform questions
Can one group hold Macs, Windows PCs and iPads together?
Yes. Groups are built from device facts and the company directory, not per platform. A setting the group carries is rendered to each platform the way that platform expects, and a platform that cannot apply a setting says so.
Does Linux need anything special?
Only the Purple agent, one static binary for Ubuntu and RHEL. It runs the checks, scripts and patching, and requests and renews the WiFi certificate.
Is Windows Autopilot supported?
Not yet. Windows zero-touch runs from a provisioning package or an Entra ID join today, and sets a new PC up at first boot with no IT visit.
Do Chromebooks need the school to change its Google Admin setup?
No. Purple MDM connects through the school's existing Google Admin and keeps the organisational units it already has. Chromebooks move between units when their groups say so.
See every device in one console, on your own fleet
Tell us which devices you run, how many, and what you manage them with today. The Purple team shows you Purple MDM on a fleet like yours: zero-touch enrolment, a change previewed and undone, a failed check explained in a sentence, and a device moved off the network and back. Already a Purple customer? Sign in to the app with your Purple account.
- We map your fleetA Purple expert maps your platforms, your groups and how devices arrive today, and answers your questions on enrolment, data regions, roles and migration.
- You see it on devices like yoursA demo of zero-touch enrolment, a previewed change, a failed check explained in plain English and, with Purple Access, a device moved off the network and back.
- You get your quotePriced per device, per month, for the platforms you run, direct or through your Purple partner, with a move in waves planned if you are coming from another MDM.
Your demo
Tell us your fleet. We show you Purple MDM running it.
A Purple expert comes back to book a demo on devices like yours, from the team behind Purple WiFi and Purple Access.