Every device in one console, healthy devices on the network, unhealthy ones fixed
Macs, iPhones, iPads, Windows PCs, Android devices, Chromebooks and Linux machines, managed from one place. Purple MDM enrolls devices with no hands-on setup, keeps their settings, apps and updates right, proves they are secure and fixes them when they drift. Because it is made by Purple, the company behind Purple WiFi and Purple Access, a device's health can decide whether it gets on the network, automatically and in seconds.
- MacBook Air · C02XY…Staff MacsEnrolled
- iPad · DMPZ…Frontline iPadsConfigured
- OFFICE-PC-041Office PCsFixing
- Chromebook · 5CD1…Year 7 ChromebooksCompliant
- Pixel · work profileField phonesFlagged
- ubuntu-build-02LinuxCompliant
- MacBook Pro · FVFG…Staff MacsFixing
- iPhone · personalWork areaEnrolled
Priced per device, per month. Book a demo on devices like yours, or sign in with your Purple account if you are already a customer.
- Apple, Windows, Android, ChromeOS and Linux
- Zero-touch from the box
- Every change previewed, staged and undoable
- Device health feeds Purple Access
For schools and colleges, small and mid-sized businesses, IT partners and existing Purple customers.
- MacBook Air · C02XY…Staff MacsEnrolled · supervised
- iPad · DMPZ…Frontline iPadsConfigured · apps installed
- OFFICE-PC-041Office PCsFixing · BitLocker switching on
- Chromebook · 5CD1…Year 7 ChromebooksCompliant · certificate issued
- Pixel · work profileField phonesFlagged · update past deadline
- ubuntu-build-02LinuxCompliant · encrypted
- MacBook Pro · FVFG…Staff MacsFixing · certificate renewed
- iPhone · personalWork areaEnrolled · transparency page shown
- Zero-touch
- from the box
- Previewed
- every change
- Plain English
- every verdict
Every platform, one console
- macOS
- iPhone and iPad
- Windows 11
- Android
- ChromeOS
- Linux
The gap
Device management that explains itself and never breaks half the fleet
Most MDMs make three promises they struggle to keep: one console for every platform, a change you can trust before it ships, and a device you can prove is safe. Purple MDM is built around all three.
One console, not one per platform
Apple, Windows, Android, ChromeOS and Linux share a settings library. A WiFi certificate, a passcode rule or an update deadline is set once and rendered the way each platform expects: Apple declarations, Windows configuration, Android policy, Chrome policy or the Purple agent.
- Apple
- Windows
- Android
- ChromeOS
- Linux
Every device in one console
See every change before it happens
Every change shows which devices it would affect and which would fall out of compliance before it is saved, rolls out to a test group first, and any earlier version can be restored in one click.
What the preview shows
- Devices the change reaches
- Devices that would fall out of compliance
- Rolled out to the test group first
- Restore any earlier version
Healthy devices on, unhealthy devices fixed
Device health feeds Purple Access, which can move an unhealthy device to a safe network and let it back once it is fixed, with no admin involved. Many problems fix themselves before anyone raises a ticket.
What Purple MDM does
Three jobs, every platform, one console
Enroll devices with no hands-on setup. Keep their settings, apps and updates right. Prove they are secure and fix them when they drift.
Zero-touch from the box
Devices bought through Apple Business Manager enroll themselves at first switch-on and arrive supervised and configured. A new Windows PC sets itself up from a provisioning package or an Entra ID join. Android phones enroll by QR code, Chromebooks connect through the school's Google Admin, and on recent iPhones, iPads and Macs a person types their work email in Settings and the device enrolls.
- Zero-touch for Apple through Apple Business Manager
- Windows zero-touch from a provisioning package or Entra ID join
- Android by QR code, with work profiles for personal phones
- Chromebooks connected through Google Admin in a few clicks, keeping your organizational units
- Import devices from Jamf, Intune or JumpCloud and move in waves
- Claimed under your organization
- Settings rendered for the platform
- Apps and WiFi certificate issued
- Encryption on, key stored
Settings, apps and updates as forms, not hand-written profiles
Restrictions, WiFi, wired network, VPN, email, certificates, login window and browser settings come from a settings library. Smart groups built from device facts and your directory keep themselves up to date. Apps come from Apps and Books, MSI and MSIX packages, managed Google Play and Chrome policy, and OS updates carry deadlines on every platform.
- A settings library, with custom profiles still allowed
- Static groups and smart groups built from rules and the company directory
- Security baselines applied to a group, with a report of what each device still misses
- OS updates with deadlines, and Chrome, Edge, Firefox and other common apps patched by group
- A self-service catalog so people install approved apps and run simple fixes themselves
Settings library · Staff Macs
- WiFi: company network, EAP-TLSOn
- Passcode requiredOn
- FileVault with key escrowOn
- OS updates: 14-day deadlineOn
- Login window messageOn
- Custom profile: printersUploaded
Effective on this device
staff-baselinemac-network-certupdates-14dOverridden by a higher group
default-screensaverPlain-English answers, and fixes that send themselves
Compliance checks cover encryption, OS version, passcode, jailbreak or developer mode, patch status, certificate health and last check-in. When a check fails, Purple MDM says why in a sentence, not an error code, sends a known fix without waiting for IT, and tells the person what to do with an honest time.
- Checks for encryption, OS version, passcode, patching, certificates and check-in
- Automatic fixes where one exists, with the person told what to do
- Why a device is non-compliant or a command failed, in two sentences, with the evidence
- Device health shared with Purple Access, and with identity providers so cloud apps can check it too
- An audit log of every admin action and every command, with who did it
Every change
See every change before it happens, and undo it in one click
The commonest MDM horror story is a setting that broke half the fleet. Purple MDM previews who a change affects, rolls it out to a small group first, and keeps every earlier version to restore.
Groups that keep themselves up to date
Static groups and smart groups built from rules, for example "Sales Macs on macOS 15", using device facts and the company directory. A device moves group when its facts change.
- Staff MacsIn compliancemacOS 15, EAP-TLS WiFi, FileVault
- Frontline iPadsPreviewing changeSupervised, shared, Return to ServiceRoll-outTest groupRolled outWhole groupWaiting for you
- Office PCsIn complianceWindows 11, BitLocker, LAPS
Revisions
Settings layered by group
When several groups set the same thing, Purple MDM shows the effective result for each device, so you know what a Mac in two groups will actually get.
- Staff MacsIn compliancemacOS 15, EAP-TLS WiFi, FileVault
- Frontline iPadsPreviewing changeSupervised, shared, Return to ServiceRoll-outTest groupRolled outWhole groupWaiting for you
- Office PCsIn complianceWindows 11, BitLocker, LAPS
Revisions
One policy for frontline devices
Shared iPads and Chromebooks carry a device policy rather than a person's, so a classroom cart or a shop floor tablet is ready for whoever picks it up.
- Staff MacsIn compliancemacOS 15, EAP-TLS WiFi, FileVault
- Frontline iPadsPreviewing changeSupervised, shared, Return to ServiceRoll-outTest groupRolled outWhole groupWaiting for you
- Office PCsIn complianceWindows 11, BitLocker, LAPS
Revisions
Preview, then stage
Before a change is saved you see which devices it would affect and which would fall out of compliance. It rolls out to a test group first.
- Staff MacsIn compliancemacOS 15, EAP-TLS WiFi, FileVault
- Frontline iPadsPreviewing changeSupervised, shared, Return to ServiceRoll-outTest groupRolled outWhole groupWaiting for you
- Office PCsIn complianceWindows 11, BitLocker, LAPS
Revisions
Undo in one click
Any earlier version of your configuration can be restored. Whole configurations can be exported and imported, so a change is a document you can read, review and keep.
- Staff MacsIn compliancemacOS 15, EAP-TLS WiFi, FileVault
- Frontline iPadsPreviewing changeSupervised, shared, Return to ServiceRoll-outTest groupRolled outWhole groupWaiting for you
- Office PCsIn complianceWindows 11, BitLocker, LAPS
Revisions
See and prove
One console to see every device, prove it is healthy and explain what went wrong
Inventory for every device: hardware, apps, users, storage and certificates, searchable and exportable. Reports over time for compliance, OS versions, patch status, enrollment and certificates, emailed on a schedule. Alerts for expiring certificates, silent devices and failing commands. And an audit log of every admin action and every command.
Signed webhooks and an event stream carry every enrollment, command, compliance change and admin action to your SIEM. See every integration.
- InventoryHardware, apps, users, storage and certificates for every device, searchable and exportable.
- Compliance over timeEncryption, OS versions, patch status, enrollment and certificates, emailed on a schedule.
- AlertsExpiring certificates, silent devices and failing commands, before they become tickets.
- Audit logEvery admin action and every command, with who did it and when.
How it is different
The complaints people make about their MDM, and what Purple MDM does instead
Every row is a thing we heard from IT teams running other MDMs. The right-hand column is what Purple MDM does about it.
| The complaint | What Purple MDM does | How it usually goes |
|---|---|---|
| "I changed a setting and broke half the fleet." | What Purple MDM doesPreviews the impact, stages the change to a test group and restores any earlier version in one click. | How it usually goesThe change goes straight to every device in scope. |
| "It says non-compliant and I don't know why." | What Purple MDM doesExplains why in plain English, in two sentences, with the evidence. | How it usually goesAn error code and a search of the vendor forums. |
| "Fixing devices is all manual." | What Purple MDM doesSends known fixes automatically and tells the person what to do, with an honest time. | How it usually goesA ticket, a remote session and a wait. |
| "Device health and network access are separate products." | What Purple MDM doesHealth feeds Purple Access directly, so an unhealthy device is moved to a safe network and let back once fixed. | How it usually goesTwo consoles, two vendors and an integration project. |
| "Personal phones feel like spyware." | What Purple MDM doesA transparency page per person shows exactly what IT can and cannot see on their device. | How it usually goesA consent screen nobody reads and a rumour mill. |
| "Changes take ages to reach devices." | What Purple MDM doesDeclarative management on Apple and Windows, and an always-connected agent that reports changes instantly. | How it usually goesWait for the next check-in and hope. |
Who it is for
Built for the fleets schools, businesses and IT partners actually run
Chromebook carts and staff laptops in a school. A mix of Mac, Windows and phones in a business with no device team. Many customers at once for an IT partner. Find your sector and see how Purple MDM is set up for it.
- EducationChromebooks, iPads and staff laptops ready on day one, safe for pupils and on the right WiFi.4 industries
- BusinessA mix of Mac, Windows and phones with no full-time device team, managed without the complexity.8 industries
- Care and healthShared clinical devices, personal phones and encrypted laptops, with the evidence to show for it.3 industries
- Public sector and charitiesStaff laptops and phones across sites and services, with data kept in your region.2 industries
- IT partnersMany customers' devices run from Purple's partner portal, each action logged in that customer's account.1 industry
Personal devices, done fairly
Personal iPhones and Android phones enroll into a separate work area, and each person gets a plain page showing exactly what IT can and cannot see on their device. On a personal device the retire button is theirs.
FAQ
What IT teams ask before they switch
Which devices does Purple MDM manage?
Macs, iPhones and iPads through Apple MDM and declarative management plus the Purple agent on the Mac; Windows 11 through Windows MDM and declarative configuration plus the agent; Android through Android Enterprise; Chromebooks through Google's Chrome management APIs and the school's Google Admin connection; and Linux (Ubuntu and RHEL) through the Purple agent.
How do devices enroll with no hands-on setup?
Apple devices bought through Apple Business Manager enroll at first switch-on. A new Windows PC sets itself up from a provisioning package or an Entra ID join. Android phones enroll by QR code. Chromebooks connect through Google Admin. On recent iPhones, iPads and Macs a person types their work email in Settings and the device enrolls. Enrollment links and QR codes cover everything else.
What happens when a device fails a check?
Purple MDM says why in a sentence, with the evidence. If a fix exists it is sent without waiting for IT, and the person is told what to do and how long it takes. With Purple Access, the device can be moved to a safe network until it is fixed, then let back automatically.
Do I need Purple WiFi or Purple Access?
No. Purple MDM manages your devices on its own. If you run Purple Access, device health ties to network access with no extra setup, and existing Purple customers sign in with the account they already have.
Can we move from Jamf, Intune or JumpCloud?
Yes. Import your device list from Jamf, Intune or JumpCloud, see where each device stands, and move them over in waves with no WiFi outage. Your IT partner can run the move for you.
What can IT see on a personal phone?
Personal iPhones and Android phones enroll into a separate work area, and each person gets a plain page showing exactly what IT can and cannot see on their device. A wipe of a personal device removes the work area, and the person can retire the device themselves.
Where is our data kept?
Every customer's data is kept apart from every other's at the database level, and stays in its region: Europe or the United States. Everyone signs in at one address and is taken to their own region. Encryption keys are held in a cloud key management service and rotated, and you can export or delete all your data on request.
Does Purple MDM include remote control or antivirus?
No. Purple MDM is not a remote screen-sharing tool and not a security agent: it does not scan for malware. It manages, configures, secures and proves devices, and it works alongside the security tools you already run.
How is it priced?
Per device, per month, every platform included, direct from Purple or through a Purple partner. Prices are not published; tell us your fleet and we send a quote.
See every device in one console, on your own fleet
Tell us which devices you run, how many, and what you manage them with today. The Purple team shows you Purple MDM on a fleet like yours: zero-touch enrollment, a change previewed and undone, a failed check explained in a sentence, and a device moved off the network and back. Already a Purple customer? Sign in to the app with your Purple account.
- We map your fleetA Purple expert maps your platforms, your groups and how devices arrive today, and answers your questions on enrollment, data regions, roles and migration.
- You see it on devices like yoursA demo of zero-touch enrollment, a previewed change, a failed check explained in plain English and, with Purple Access, a device moved off the network and back.
- You get your quotePriced per device, per month, for the platforms you run, direct or through your Purple partner, with a move in waves planned if you are coming from another MDM.
Your demo
Tell us your fleet. We show you Purple MDM running it.
A Purple expert comes back to book a demo on devices like yours, from the team behind Purple WiFi and Purple Access.