Mobile Management Is Not Free

Mobile Management Is Not Free

What MAM and MTD actually cost on a personal device, who pays, and how to calculate the full cost

The bottom line

Mobile application management (MAM) on a personal device (BYOD) is often presented as the low-cost mobility option. The organization pays for software licensing, often bundled with other productivity software, and nothing for hardware or the cellular plan, so the number looks small. That accounting leaves out several things: the operational labor required to run the program around the clock, the costs the program shifts onto employees, and the liability and risk of a solution architecture that stores data on a personal device. All of these costs are real. Once they are accounted for, MAM on a personal device can land in the same range as a managed subscription or a corporate-owned device. The question then changes from which option costs less to who is paying, and whether they agreed to pay.

Where the costs go

Every mobile management program has costs. The only question is where they land.

• The organization pays for licensing (mobile device/application management, mobile threat defense) and for the staff who run the program.
• The employee pays for device wear and tear, cellular data consumed by background activity, data sync, interactive calls (e.g., Teams, Zoom), and any out-of-pocket repair or replacement.
• Nobody’s budget shows the full total, so nobody has to defend it. That gap is why the “Intune is free” claim survives.

The cost layers

• Licensing. Intune and Mobile Threat Defense (MTD) fees. This is the only line most budgets capture, and it is the easiest to quote. Given the common practice of bundling (e.g., E3 or E5), most organizations assume Intune is free and often report the same for Defender for Endpoint (MDE).
• Operations. Policy lifecycle management, conditional access policy management, enrollment, troubleshooting, user support, and triage of threat alerts. Because MAM and MTD protect users at all hours, coverage is not a business-hours function. This layer scales with user count and shift coverage.
• Device acceleration. Policy checks, app-level encryption and sync, notifications, and background threat scanning all draw on battery, storage, and processor capacity. This load can shorten the replacement cycle, so the employee’s device cost per month rises even though no one wrote a check for it.
• Individual-borne costs. Cellular data used for background sync and attachment downloads, overages, out-of-pocket repair, and exposure if the device is lost, seized, or searched at a border. Some of this is hard to price, but it belongs in the analysis. Background cellular use should be measured in a pilot rather than estimated.
• Incident response. Responding to an incident, gathering forensic evidence, remediation, and cyber insurance. Handling an exposure at the edge is very different from handling one where no data resides on the device, so this cost belongs in the total.

How to calculate it

Use one formula for every option so the comparison stays apples to apples:

Total monthly cost per user = Licensing + Operations allocation + Device acceleration delta + Work-attributable cellular + Expected incident cost + Expected out-of-pocket exposure

• Operations allocation: annual loaded cost of administration staff, including shift coverage, divided by enrolled users, divided by 12.
• Device acceleration delta: device price divided by the shortened lifecycle, minus device price divided by the baseline lifecycle. Only the difference is attributable to the program. The baseline device cost is the same with or without MAM.
• Work-attributable cellular: the portion of the plan cost driven by work activity. Measure it on a pilot cohort rather than estimating it. If you offer a stipend to employees, include it here.
• Expected incident cost: probability-weighted cost of an incident involving a device that holds work data. Use the insurance and response figures from your own risk assessment.

Illustrative model: 5,000 users

The figures below are placeholders built from the assumptions in the inputs table. Replace each with a quote, a measured value, or a validated estimate before using the result externally.

Under these assumptions, MAM on a personal device costs about $46 per user per month. About $24 of that falls on the organization and about $22 on the employee. A $58 managed subscription, which assumes 5,000 users, comes in about 27% more than the full MAM total, and the organization knows its number in advance. Device acceleration is the most sensitive input. At an $800 device price the line drops to about $4.44, and a smaller reduction in lifecycle would lower it further.

What the math does not price

Some exposure is a risk cost rather than a budget line. It should be weighed in the risk assessment rather than dropped from the analysis:

• Border and device-search exposure for personal phones holding work data.
• Incident reporting obligations if a device containing work data is lost or compromised.
• Residual cached data on personal devices after an employee leaves.
• Potential export-control exposure for data accessed while traveling abroad, to be reviewed with counsel.
• Limited access to apps not supported by the Intune SDK. Most B2B apps do not support Intune MAM, so additional accommodations, expenses, and risks must be considered.

Questions to answer before choosing

• What does our 24/7 support model cost, and who staffs it?
• How much of our cellular spend is work-driven, and have we measured it?
• What does a shorter device refresh cycle cost us, in dollars and in employee goodwill?
• What happens to cached work data when someone leaves?
• Who pays if a personal device holding work data is searched, lost, or compromised abroad?

Mobile management can be the right choice for some populations. The point is that its cost should be counted in full, with every layer visible, before it is chosen as the cheap option.

‍