QUME · Device management · MDM and UEM
MDM and UEM for every endpoint, on five platforms
Android, Windows, macOS, iOS and Linux enrol into the same record, carry the same identity and move through the same states. The differences between platforms live in the agent, not in the operator’s head.
- The device presents hardware-backed attestation: Android Key Attestation, Windows TPM 2.0, Apple App Attest.
- The server supplies the nonce and the certificate request is bound to the attested key, so a captured enrolment token cannot enrol a second machine.
- What the device could prove decides its trust tier, and every dangerous command checks the tier rather than flattening the fleet into “enrolled”.
Capabilities
What QUME does for device management
Enrolment that proves the device
A device presents hardware-backed attestation before it is issued a certificate: Android Key Attestation, Windows TPM 2.0, Apple App Attest. Enrolment tokens are single-use, server-nonced and bound to the attested key, so a captured token cannot enrol a second machine.
Trust tiers, not a binary
An attested device, a device with a software key and a device that could prove neither are three different things. The tier is recorded and every dangerous command checks it.
Ownership decides what is permitted
Corporate, corporate-with-personal-use and personal devices reach different control sets. A personally owned device is never fully wiped, and the restriction is enforced on the server.
A lifecycle that includes reality
Pending, enrolled, active, restricted, quarantined, in service, retired, wiped. Service is its own state, because “silent in a repair depot” and “silent because it was stolen” must not look the same.
Asset register and inventory
Hardware, installed software, certificates and ownership, collected on a schedule and on demand, with a fingerprint so an unchanged estate costs nothing to re-report.
Zero-touch programmes
Apple Automated Device Enrollment, Windows Autopilot, and Android QR and NFC provisioning, so new devices enrol themselves on first start.
In the console
And in day-to-day use
Remote commands, signed and queued
Lock, wipe, restrict, install and more: each command is hybrid-signed and queued per device, and destructive ones need two-person approval and a security-key step-up.
Groups, sites and geofences
Dynamic groups, sites with their own time zone, and geofences ranked by what a location signal actually proves.
Offline and provisioning-package enrolment
Devices on isolated networks enrol from a provisioning package, with the same attestation and the same certificate.
Questions
What buyers ask
Which devices can QUME manage?
Android, Windows, macOS, iOS and Linux: phones, tablets, laptops, desktops and servers, corporate-owned or personal.
How are personal devices treated?
Ownership is recorded at enrolment and decides the control set. A personal device is never fully wiped; only its work data can be removed.
Can devices enrol without the internet?
Yes. Offline and provisioning-package enrolment use the same attestation and certificate issuance as online enrolment.
See device management in QUME
On your own devices, with your team.