What is a mobile-device-management log?¶

A mobile-device-management log records activity involving devices enrolled in an organisation’s management platform.

The platform may manage phones, tablets, laptops and other endpoints by applying policy, distributing software and reporting device status.

Avoid this assumption: That a mobile-device-management record is a complete history of what happened on the device or proves who was using it. It is neither.

An MDM log may show enrolment, device identifiers, assigned user, compliance status, policy deployment, application installation, remote lock or wipe commands, certificate changes and check-in times. This can help establish that a particular managed device was registered, received an instruction or reported a status.

But the platform usually sees management events, not every user action. A command marked as sent may not have reached the device. A command marked as successful may mean the management agent acknowledged it, not that every consequence has been independently verified.

The assigned user field may reflect an administrative association rather than the person physically holding the device at the relevant time. Devices may be shared, reassigned, lost, remotely accessed or used under another account.

Investigators should identify the MDM provider, tenant, device record and relevant policy. Ask how the device was enrolled, which identifiers were used and whether records show command creation, delivery, acknowledgement or completion.

Preserve device inventory, assignment history, compliance records, command logs and administrator audit entries. Correlate important events with identity-provider, endpoint, application, network and forensic device evidence.

Where a remote wipe or lock is relevant, establish exactly when it was requested, whether the device was online and what confirmation was returned.

Operational takeaway¶

A mobile-device-management log records selected management and status events, but it does not automatically prove device possession, user activity or the full effect of a command.