baselineRFIWhat platforms and enrollment modes are supported — iOS (Automated Device Enrollment/DEP, user enrollment, BYOD), Android (Enterprise/Zero-touch, work profile), Windows/macOS — and which require separate licensing?weight 3
Answer key — what a strong answer shows
Look for a coverage matrix across enrollment modes, since BYOD vs. corporate-owned devices need genuinely different policy models, not the same profile applied everywhere.
baselineRFPDescribe the BYOD privacy/data-separation model — how is corporate data (managed apps, containers) kept separate from personal data, what visibility does the admin have into personal-side activity, and can a user verify what IT can and can't see?weight 3
Answer key — what a strong answer shows
BYOD adoption depends on credible privacy separation — look for a container/work-profile model with explicit, user-verifiable limits on admin visibility, not vague 'we respect privacy' assurances.
baselineRFIWhat compliance policy enforcement exists — passcode/encryption requirements, jailbreak/root detection, OS-version enforcement — and what automated remediation happens when a device falls out of compliance (warn, quarantine app access, selective wipe)?weight 3
Answer key — what a strong answer shows
Look for graduated, automated remediation tied to compliance state, not just a dashboard flag requiring manual admin follow-up on every non-compliant device.
baselineRFIHow does app management work — managed app catalog/store, per-app VPN, app-level data-loss-prevention (copy/paste restrictions between managed and personal apps), and silent deployment/update of required apps?weight 3
Answer key — what a strong answer shows
Per-app VPN and app-level DLP are what separate real enterprise mobility management from basic device-list MDM — look for these specifically, not just app push capability.
baselineRFPDetail conditional access integration — can device compliance status gate access to corporate resources (email, SaaS apps) via integration with the identity provider, and what is the typical time from a device going out of compliance to access being revoked?weight 3
Answer key — what a strong answer shows
Look for a real IdP integration (Entra ID Conditional Access, Okta) with a stated revocation latency — compliance policy without access enforcement is just a report nobody acts on.
baselineRFIWhat happens to corporate data on device loss, theft, or employee offboarding — selective wipe (corporate data only, BYOD) versus full wipe (corporate-owned), and what is the confirmed wipe success rate/timing when a device is offline at the time of the wipe command?weight 3
Answer key — what a strong answer shows
Look for an honest answer on offline-device wipe behavior (queued command executed on next check-in, with a stated typical delay) — a platform that implies instant wipe regardless of connectivity is overpromising.
baselineRFPExplain kiosk/dedicated-device support for shared or single-purpose devices (retail, warehouse, healthcare) — single-app lock, multi-app kiosk profiles, and remote troubleshooting without physical device access.weight 3
Answer key — what a strong answer shows
Shared/dedicated-device fleets are a distinct use case from BYOD/corporate-issued — look for specific kiosk-mode capability and remote diagnostics, not just standard MDM applied to a shared device.
baselineRFIWhat reporting and inventory visibility exists — real-time device inventory, OS/patch-level compliance dashboards, and exportable reports mapped to compliance frameworks relevant to us?weight 3
Answer key — what a strong answer shows
Look for real-time (not daily-batch) inventory and framework-mapped exportable reports — stale inventory data undermines every other compliance claim built on top of it.
baselineRFIWhat is the pricing model — per device, per user (covering multiple devices), or a flat enterprise tier — and does cost differ meaningfully between full MDM enrollment and lighter-weight app-level management for BYOD?weight 3
Answer key — what a strong answer shows
Look for transparent, tier-differentiated pricing; a vendor who can't distinguish full-MDM cost from lighter app-level-management cost may be overselling one for a use case that needs the other.
baselineRFPDescribe incident-response/forensic capability for a confirmed lost or stolen device that held sensitive corporate data — beyond remote wipe, can the platform determine what data was actually on the device and accessed before the wipe, and what is a customer-referenced example?weight 3
Answer key — what a strong answer shows
Remote wipe alone doesn't answer 'what was actually exposed before we wiped it' — ask for a real forensic-reconstruction capability and a concrete customer incident example.
baselineRFIDoes the platform integrate with a mobile threat defense (MTD) product for device-level threat detection (malicious apps, network attacks, OS exploits) beyond compliance-policy enforcement, or is security limited to policy compliance with no active threat detection?weight 3
Answer key — what a strong answer shows
Compliance-policy enforcement (encryption required, jailbreak detection) is distinct from active threat detection — a vendor should clarify whether real MTD-style detection exists natively or requires a separate product.
baselineRFPWhat is the app-level containerization option for accessing corporate resources on an unmanaged personal device WITHOUT requiring full MDM enrollment, and how does that model's security guarantees compare to full enrollment?weight 3
Answer key — what a strong answer shows
Full MDM enrollment is often a nonstarter for personal-device users (privacy concerns) — ask for a real lighter-weight containerization alternative and how its security posture compares.
baselineRFIHow does the platform handle data-residency requirements for device management data across international deployments — is device telemetry processed in-region for customers with regulatory constraints, or centralized in a single region regardless of device location?weight 3
Answer key — what a strong answer shows
A vendor with only single-region processing regardless of the managed device's actual location is a real compliance gap for a global, regulated workforce.
baselineRFPDetail rollout/adoption support for a large distributed workforce — self-service enrollment flows, bulk provisioning, and a customer-referenced measured enrollment completion rate (not just a provisioning target) for a comparable-sized deployment.weight 3
Answer key — what a strong answer shows
Ask for a real completion-rate figure from a customer reference, not just a provisioning capability — incomplete rollout leaves real coverage gaps.
baselineRFIWhat historical trend reporting exists on device-compliance rate over time (percentage of the fleet in-compliance, trending up or down), suitable for demonstrating program maturity to leadership and auditors?weight 3
Answer key — what a strong answer shows
Trend-over-time compliance reporting is a distinct capability from a real-time snapshot — confirm this exists as a maintained, exportable report.
baselineRFIWhat API/integration depth is available for custom enterprise workflows beyond the built-in admin console — can device data and compliance events be programmatically consumed by the customer's own SIEM, ITSM, or custom automation?weight 3
Answer key — what a strong answer shows
A real, documented API is materially more useful for a mature IT/security team than console-only access requiring manual export for every downstream use case.
baselineRFPLeverage Microsoft Intune as part of the endpoint protection and response architecture, including onboarding devices into Defender for Endpoint, enforcing security baselines, deploying configuration profiles, and supporting automated remediation actions.weight 3
baselineRFPZero Trust Phase 1: Contractor shall complete rollout/operationalization of the Microsoft 365 security suite including Microsoft Intune (device health/UEM), Defender for Endpoint (EDR/XDR), Microsoft Purview (DLP and sensitive data risk assessments), Mobile Access (ZTNA + Intune MAM), and Privileged Access Management (PAM) implementation using platforms including CyberArk, Microsoft Entra PIM, or Okta.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
