Mobile Device Management (MDM), Mobile Application Management (MAM), and Virtual Desktop Infrastructure (VDI) sit at three different layers of control, and none of them is a synonym for another. MDM manages the entire device — enrollment, configuration, and device-wide policy. MAM manages only specific applications and the data inside them, without necessarily enrolling the device at all. VDI does not manage the personal device in any persistent sense; it streams a remote, centrally hosted desktop or application session to the device and, by design, keeps data from being written to local storage. For DoD BYOD purposes, current policy names MAM and VDI as the two approved architectures for accessing DoD environments or data from a personal mobile device — MDM as full-device enrollment of a personally owned device is a materially different (and more invasive) posture not covered by that same use case.
Definitions
MDM (Mobile Device Management)
What it is: Enterprise technology that enrolls a device into a management platform, issuing device-level policy and, in Microsoft's implementation, an X.509 certificate to the enrolled device. What it controls: Device enrollment, OS configuration, Wi-Fi/VPN settings, encryption enforcement, remote lock/locate/wipe of the entire device, compliance monitoring. What it does not control: Nothing is out of scope by design — MDM's premise is whole-device oversight, which is also its main privacy drawback in BYOD settings.
MAM (Mobile Application Management)
What it is: Technology that wraps, containerizes, or otherwise manages specific business applications and their data, deployable with or without device enrollment ("MAM-WE" = MAM without enrollment).What it controls: App-level authentication, data-sharing restrictions between managed and unmanaged apps, selective wipe of business app data, per-app configuration and updates. What it does not control: The rest of the device — MAM cannot enforce OS-level settings, block installation of unrelated apps device-wide, or manage anything outside its own managed container.
VDI (Virtual Desktop Infrastructure)
What it is: Infrastructure that hosts a standardized virtual desktop or application on centralized servers and streams the session to an endpoint over a remote-display protocol. What it controls: The remote session itself — access authentication, session routing, and centrally managed virtual desktop images. What it does not control: The physical device is not enrolled or managed; VDI's premise is that no application or business data is written to local device storage, so device-side management is largely moot.
Why these are evaluated under different frameworks
NIAP (the National Information Assurance Partnership) certifies these categories under separate Common Criteria protection profiles rather than one umbrella standard: the Protection Profile for Mobile Device Management (PP_MDM) certifies the management server and agent, while the Protection Profile for Mobile Device Fundamentals (MDF PP) certifies the device itself. No NIAP protection profile currently exists specifically for "mobile application management" as its own category, so a product's MDM-scope certification does not automatically extend to its MAM capability, and a Security Target must be checked to see what Target of Evaluation (TOE) boundary a given certificate actually covers. VDI is addressed by a distinct technical body of guidance entirely — NIST treats it under its own glossary term and standards track (NIST SP 800-125B, NISTIR 8196), reflecting that VDI is a virtualization and remote-access architecture rather than an endpoint-management category.
Practical distinctions that matter for BYOD
Ownership model and privacy impact separate MDM from the other two most sharply: MDM's device-wide reach makes it best suited to organization-owned hardware, since it can access location, usage, and personal-app data on the same device it protects. MAM is designed for BYOD specifically because it isolates its footprint to managed corporate apps, leaving personal content and settings untouched. VDI takes a different approach again — rather than isolating a container on the device, it avoids placing enterprise data on the device at all, which is why it is sometimes described as a "zero-data-at-rest" or remote-rendering architecture.
Sanitization and data-residency obligations also diverge by architecture. Selective wipe under MAM removes app data from a managed application on its next policy check-in, which aligns with a logical ("Clear"-tier) delete rather than a cryptographic purge. MDM's device-wide wipe can reach the full device but still depends on the same underlying storage-sanitization tier unless separately documented. VDI sidesteps the sanitization question for the endpoint altogether in most implementations, since session data is not persisted to local storage in the first place.
Combining the models
MDM and MAM are frequently deployed together rather than as competitors: MDM enforces baseline device compliance (encryption, OS patch level) while MAM layers app-specific authentication and data-loss controls on top, a combination common in modern enterprise mobility management (EMM) platforms. VDI is typically deployed as an alternative to both, particularly where an organization wants to avoid enterprise data ever residing on a personally owned endpoint, regardless of whether that endpoint is separately enrolled in MDM or MAM.
This entry restates publicly available technical and policy sources and asserts nothing beyond them. It is not legal or compliance advice. BYODPolicy.org is not affiliated with, endorsed by, or accredited by NIAP, NIAP-CCEVS, or any government body.
Related entries: Q-000 — Can MAM be used for CUI on a BYOD device? · Q-001 — Can Microsoft MAM be used on a DoD network? · Q-011 — Is Microsoft Intune NIAP-certified, and does that cover MAM?