License & Deployment Mix: 30 tools – 13 OSS, 15 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Endpoint Management?
Endpoint management is the discipline of provisioning, configuring, securing, monitoring, and retiring all devices that connect to an organization’s network – laptops, desktops, smartphones, tablets, servers, kiosks, and IoT devices. It encompasses several overlapping domains:
- Mobile Device Management (MDM) – the original discipline focused on managing smartphones and tablets. MDM provides remote lock/wipe, policy enforcement, app distribution, and compliance checks for mobile devices.
- Unified Endpoint Management (UEM) – the evolution of MDM that extends management to desktops, laptops, and IoT devices alongside mobile. UEM provides a single console for all endpoint types across all operating systems.
- Remote Monitoring and Management (RMM) – MSP-oriented tools for remotely monitoring device health, deploying patches, running scripts, and providing remote support. RMM overlaps heavily with UEM but targets the MSP business model with multi-tenant management, PSA integration, and per-device billing.
- Patch Management – automated discovery and deployment of OS and third-party application updates. Patch management reduces the attack surface by ensuring endpoints run current, vulnerability-free software.
- OS Deployment / Imaging – provisioning new devices with standardized operating system images, drivers, and applications. Includes zero-touch enrollment where devices configure themselves on first boot via cloud services.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This evaluation covers UEM/MDM/RMM solutions across self-hosted and SaaS options.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol; the notes below assume Authentik as the IdP.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Fleet | Yes | No | No | Native OIDC support; Authentik as IdP; SSO login for Fleet UI |
| GLPI | Yes* | No | No | OIDC via plugin; not built-in; Authentik as IdP with plugin config |
| OpenUEM | Yes | No | No | Native OIDC support; Authentik as IdP |
| Tactical RMM | No | No | No | No SSO; local auth only; reverse proxy SSO possible |
| NanoMDM | No | No | No | CLI/API only; no web UI; no SSO; token-based API auth |
| Entgra | Yes | Yes | Yes | WSO2 Identity Server integration; OIDC and SAML native; SCIM 2.0 |
| Theopenem | No | No | No | Local auth and LDAP/AD; no OIDC/SAML |
| Rudder | Yes | Yes | No | Native OIDC and SAML; Authentik as IdP |
| Flyve MDM | No | No | No | GLPI-based auth; no native SSO |
| MeshCentral | Yes | No | No | OAuth2/OIDC login support; Authentik as IdP |
| ManageEngine | Yes | Yes | No | Native OIDC and SAML; AD/LDAP; Authentik as SAML IdP |
| SCCM/MECM | No* | No | No | Entra ID (Azure AD) integrated; no standard OIDC/SAML for console |
| Ivanti UEM | Yes | Yes | Yes | Native OIDC and SAML; SCIM provisioning; Authentik as IdP |
| Workspace ONE | Yes | Yes | Yes | Native OIDC (Workspace ONE Access); SAML; SCIM; Authentik as IdP |
| Quest KACE | No | Yes | No | SAML SSO for web console; AD/LDAP; no native OIDC |
| Baramundi | No | No | No | AD/LDAP integration only; no OIDC/SAML |
| NinjaOne | Yes | Yes | Yes | Native OIDC and SAML; SCIM directory sync; Authentik as IdP |
| ConnectWise RMM | Yes | Yes | No | OIDC and SAML via ConnectWise SSO; Authentik as IdP |
| Datto RMM | No | Yes | No | SAML SSO via Datto/Autotask portal; no native OIDC |
| N-able | No | Yes | No | SAML SSO for partner portal; no native OIDC |
| Intune | Yes* | Yes | Yes | Entra ID (Azure AD) native; OIDC federation; SAML; SCIM; Authentik as external IdP |
| Jamf Pro | Yes | Yes | Yes | Native OIDC and SAML; SCIM provisioning; Authentik as IdP |
| Kandji | Yes | Yes | Yes | Native OIDC and SAML; SCIM directory sync; Authentik as IdP |
| Mosyle | No | Yes | No | SAML SSO; Apple School/Business Manager; no native OIDC |
| Hexnode | Yes | Yes | No | OIDC and SAML SSO; AD/LDAP integration; Authentik as IdP |
| JumpCloud | Yes | Yes | Yes | Native OIDC/SAML (is itself an IdP); SCIM; can federate with Authentik |
| Scalefusion | No | Yes | No | SAML SSO; AD/LDAP integration; no native OIDC |
| Rippling | Yes | Yes | Yes | Native OIDC/SAML (is itself an IdP); SCIM; Authentik federation |
| Addigy | Yes | Yes | No | OIDC and SAML SSO; Authentik as IdP |
| Automox | Yes | Yes | Yes | Native OIDC and SAML; SCIM provisioning; Authentik as IdP |
* = requires specific configuration, plugin, or cloud identity federation
Best SSO support: Intune, Jamf, Kandji, JumpCloud, Workspace ONE, Ivanti, NinjaOne, Automox, Rippling (OIDC + SAML + SCIM)
No SSO: Tactical RMM, NanoMDM, Flyve MDM, Theopenem, Baramundi (local/AD auth only)
OIDC among OSS: Fleet, OpenUEM, Entgra, Rudder, MeshCentral support native OIDC
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs |
|---|---|---|---|---|
| Fleet | REST | API token | Yes (webhook/log) | Go (fleetctl), Python (community) |
| GLPI | REST | API token, Session | Yes (plugin) | Python, PHP (community) |
| OpenUEM | REST | API token | Yes | Go (internal) |
| Tactical RMM | REST | API key | Yes | Python (community) |
| NanoMDM | REST | API token | Yes (callback) | Go (internal) |
| Entgra | REST | OAuth2 | Yes | Java (official), Python |
| Theopenem | REST | API key | No | C# (official) |
| Rudder | REST v2 | API token | Yes | Python (community) |
| Flyve MDM | REST (GLPI) | API token | No | PHP (GLPI), Android SDK |
| MeshCentral | REST + WebSocket | Token, Cookie | Yes | Node.js (internal), Python (community) |
| ManageEngine | REST | API key, OAuth2 | Yes | Python (community), PowerShell |
| SCCM/MECM | WMI + REST (AdminService) | Windows auth | No | PowerShell (official), .NET |
| Ivanti UEM | REST | OAuth2, API key | Yes | PowerShell, Python (community) |
| Workspace ONE | REST v2 | OAuth2, API key | Yes | Python (official), PowerShell |
| Quest KACE | REST | Bearer token | No | PowerShell (community) |
| Baramundi | REST | API key | Yes | PowerShell (official) |
| NinjaOne | REST | OAuth2 | Yes | PowerShell (official), Python |
| ConnectWise RMM | REST | API key | Yes | Python, PowerShell (community) |
| Datto RMM | REST | API key | Yes | PowerShell (community) |
| N-able | REST + SOAP | API key | Yes | PowerShell (N-able), Python |
| Intune | Microsoft Graph | OAuth2 (Entra) | Yes (Event Grid) | Python, .NET, Java, JS, Go, PowerShell |
| Jamf Pro | REST + Classic | OAuth2, Bearer | Yes | Python (official), Swift, Ruby |
| Kandji | REST | Bearer token | Yes | Python (community) |
| Mosyle | REST | API token | Yes | Python (community) |
| Hexnode | REST | API key | Yes | None official |
| JumpCloud | REST v2 | API key | Yes | Python (official), Go, PowerShell |
| Scalefusion | REST | API key | Yes | None official |
| Rippling | REST | OAuth2 | Yes | Python (official) |
| Addigy | REST | API key | Yes | Python (community) |
| Automox | REST | Bearer token | Yes | Python (community), PowerShell |
Platform Support
| Tool | Windows | macOS | Linux | iOS | Android | ChromeOS | IoT |
|---|---|---|---|---|---|---|---|
| Fleet | Yes | Yes | Yes | No | No | Yes | No |
| GLPI | Yes | Yes | Yes | No | No | No | No |
| OpenUEM | Yes | Yes | Yes | No | No | No | No |
| Tactical RMM | Yes | Yes | Yes | No | No | No | No |
| NanoMDM | No | Yes | No | Yes | No | No | No |
| Entgra | Yes | Yes | Yes | Yes | Yes | No | Yes |
| Theopenem | Yes | No | No | No | No | No | No |
| Rudder | Yes | No | Yes | No | No | No | No |
| Flyve MDM | No | No | No | Yes | Yes | No | No |
| MeshCentral | Yes | Yes | Yes | No | No | No | No |
| ManageEngine | Yes | Yes | Yes | Yes | Yes | Yes | No |
| SCCM/MECM | Yes | Yes* | No | No | No | No | No |
| Ivanti UEM | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Workspace ONE | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Quest KACE | Yes | Yes | Yes | No | No | Yes | No |
| Baramundi | Yes | Yes | Yes | Yes | Yes | No | No |
| NinjaOne | Yes | Yes | Yes | No | No | No | No |
| ConnectWise RMM | Yes | Yes | Yes | No | No | No | No |
| Datto RMM | Yes | Yes | Yes | No | No | No | No |
| N-able | Yes | Yes | Yes | No | No | No | No |
| Intune | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Jamf Pro | No | Yes | No | Yes | No | No | No |
| Kandji | No | Yes | No | Yes | No | No | No |
| Mosyle | No | Yes | No | Yes | Yes | No | No |
| Hexnode | Yes | Yes | Yes | Yes | Yes | Yes | No |
| JumpCloud | Yes | Yes | Yes | Yes | Yes | No | No |
| Scalefusion | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Rippling | Yes | Yes | Yes | Yes | Yes | No | No |
| Addigy | No | Yes | No | Yes | No | No | No |
| Automox | Yes | Yes | Yes | No | No | No | No |
* = limited macOS support via co-management with Intune
Broadest platform support: Ivanti, Workspace ONE, Intune, ManageEngine, Hexnode, Scalefusion (Windows, macOS, Linux, iOS, Android, ChromeOS)
Apple-only: Jamf, Kandji, Addigy (macOS + iOS); Mosyle (macOS + iOS + limited Android)
Desktop-only RMM: NinjaOne, ConnectWise RMM, Datto RMM, N-able, Tactical RMM (Windows + macOS + Linux; no mobile MDM)
IoT support: Entgra (designed for IoT), Ivanti, Workspace ONE
Device Lifecycle
| Tool | Zero-Touch | DEP/ABM | Autopilot | Imaging | Retirement/Wipe |
|---|---|---|---|---|---|
| Fleet | No | Yes (MDM) | No | No | Yes (MDM commands) |
| GLPI | No | No | No | No | No (inventory only) |
| OpenUEM | Limited | No | No | No | Yes |
| Tactical RMM | No | No | No | No | Yes (remote wipe script) |
| NanoMDM | Yes | Yes | No | No | Yes (MDM commands) |
| Entgra | Yes | Yes | Yes | No | Yes (full + selective) |
| Theopenem | No | No | No | Yes (PXE/WinPE) | No |
| Rudder | No | No | No | No | Yes (decommission) |
| Flyve MDM | No | Limited | No | No | Yes (wipe, lock) |
| MeshCentral | No | No | No | No | Yes (remote wipe script) |
| ManageEngine | Yes | Yes | Yes | Yes (OS deploy) | Yes (full + selective) |
| SCCM/MECM | Yes* | No | Yes* | Yes (OSD/PXE) | Yes (full + selective) |
| Ivanti UEM | Yes | Yes | Yes | Yes (OS deploy) | Yes (full + selective) |
| Workspace ONE | Yes | Yes | Yes | No | Yes (full + selective) |
| Quest KACE | Yes* | No | No | Yes (imaging) | Yes (retire) |
| Baramundi | Yes | Yes | Yes | Yes (OS install) | Yes (full + selective) |
| NinjaOne | Yes* | No | No | No | Yes (remote wipe script) |
| ConnectWise RMM | No | No | No | No | Yes (remote wipe script) |
| Datto RMM | No | No | No | No | Yes (remote wipe script) |
| N-able | No | No | No | No | Yes (remote wipe script) |
| Intune | Yes | Yes | Yes | Yes (Autopilot) | Yes (full + selective) |
| Jamf Pro | Yes | Yes | No | Yes (PreStage) | Yes (full + selective) |
| Kandji | Yes | Yes | No | No | Yes (full + selective) |
| Mosyle | Yes | Yes | No | No | Yes (full + selective) |
| Hexnode | Yes | Yes | Yes | No | Yes (full + selective) |
| JumpCloud | Yes* | Yes | No | No | Yes (full + selective) |
| Scalefusion | Yes | Yes | Yes | No | Yes (full + selective) |
| Rippling | Yes | Yes | Yes | No | Yes (full + selective) |
| Addigy | Yes | Yes | No | No | Yes (full + selective) |
| Automox | No | No | No | No | Yes (remote wipe script) |
* = requires additional configuration or third-party integration
Best zero-touch enrollment: Intune (Autopilot
- DEP), Jamf (DEP), Workspace ONE (all three programs), ManageEngine, Ivanti
Best imaging / OS deployment: SCCM/MECM (OSD), Theopenem (WinPE/PXE), ManageEngine, Ivanti, Jamf (PreStage Enrollments)
No lifecycle management: GLPI (inventory only), Automox (patch only), standard RMM tools (script-based wipe only)
Patch Management
| Tool | OS Patching | 3rd-Party | Approval Workflows | Rollback | Compliance Reporting |
|---|---|---|---|---|---|
| Fleet | No | No | No | No | Yes (osquery queries) |
| GLPI | No | No | No | No | Yes (inventory-based) |
| OpenUEM | Yes | Limited | Yes | No | Yes |
| Tactical RMM | Yes | Yes (Chocolatey/winget) | Yes | Limited | Yes |
| NanoMDM | Yes* (macOS only) | No | No | No | No |
| Entgra | Yes | Limited | Yes | No | Yes |
| Theopenem | Yes (WSUS-like) | No | Yes | No | Yes |
| Rudder | Yes | Yes | Yes | Yes | Yes |
| Flyve MDM | No | No | No | No | No |
| MeshCentral | No | No | No | No | No |
| ManageEngine | Yes | Yes (500+ apps) | Yes | Yes | Yes |
| SCCM/MECM | Yes | Yes (SCUP) | Yes | Yes | Yes |
| Ivanti UEM | Yes | Yes (extensive) | Yes | Yes | Yes |
| Workspace ONE | Yes | Yes | Yes | Limited | Yes |
| Quest KACE | Yes | Yes | Yes | Yes | Yes |
| Baramundi | Yes | Yes | Yes | Yes | Yes |
| NinjaOne | Yes | Yes (broad catalog) | Yes | Yes | Yes |
| ConnectWise RMM | Yes | Yes | Yes | Limited | Yes |
| Datto RMM | Yes | Yes | Yes | Limited | Yes |
| N-able | Yes | Yes | Yes | Limited | Yes |
| Intune | Yes | Yes (Winget/Store) | Yes | Limited | Yes |
| Jamf Pro | Yes | Yes (Jamf App Catalog) | Yes | Limited | Yes |
| Kandji | Yes | Yes (auto-apps) | Yes | Limited | Yes |
| Mosyle | Yes | Yes (app catalog) | Limited | No | Yes |
| Hexnode | Yes | Yes | Yes | Limited | Yes |
| JumpCloud | Yes | Yes (limited) | Yes | No | Yes |
| Scalefusion | Yes | Yes | Yes | No | Yes |
| Rippling | Yes | Yes | Yes | Limited | Yes |
| Addigy | Yes | Yes (custom scripts) | Yes | Limited | Yes |
| Automox | Yes | Yes (broad catalog) | Yes | Yes | Yes |
* = OS updates via MDM commands; not full patch management
Best patch management: ManageEngine, Ivanti, SCCM/MECM, Automox, NinjaOne (broad OS + 3rd- party coverage with approval and rollback)
Patch-focused: Automox is purpose-built for patch management and endpoint hardening
No patching: Fleet, GLPI, MeshCentral, Flyve MDM (inventory/MDM only; no patch capabilities)
App Management
| Tool | Silent Deploy | App Store | Self-Service | MAM/Container | Allow/Block |
|---|---|---|---|---|---|
| Fleet | No | No | No | No | No |
| GLPI | No | No | No | No | No |
| OpenUEM | Yes | No | Limited | No | No |
| Tactical RMM | Yes (script) | No | No | No | No |
| NanoMDM | Yes (MDM) | No | No | No | No |
| Entgra | Yes | Yes | Yes | Yes | Yes |
| Theopenem | Yes | No | No | No | No |
| Rudder | Yes | No | No | No | No |
| Flyve MDM | Limited | No | No | No | Yes |
| MeshCentral | Yes (script) | No | No | No | No |
| ManageEngine | Yes | Yes | Yes | Yes | Yes |
| SCCM/MECM | Yes | Yes | Yes | No | Yes |
| Ivanti UEM | Yes | Yes | Yes | Yes | Yes |
| Workspace ONE | Yes | Yes | Yes | Yes | Yes |
| Quest KACE | Yes | Yes | Yes | No | No |
| Baramundi | Yes | Yes | Yes | No | Yes |
| NinjaOne | Yes | No | Limited | No | No |
| ConnectWise RMM | Yes | No | No | No | No |
| Datto RMM | Yes | No | No | No | No |
| N-able | Yes | No | No | No | No |
| Intune | Yes | Yes | Yes | Yes | Yes |
| Jamf Pro | Yes | Yes | Yes | Yes | Yes |
| Kandji | Yes | Yes | Yes | No | Yes |
| Mosyle | Yes | Yes | Yes | Yes | Yes |
| Hexnode | Yes | Yes | Yes | Yes | Yes |
| JumpCloud | Yes | No | Limited | No | No |
| Scalefusion | Yes | Yes | Yes | Yes | Yes |
| Rippling | Yes | Yes | Yes | No | Yes |
| Addigy | Yes | Yes | Yes | No | Yes |
| Automox | Yes | No | No | No | No |
Best app management: Intune, Jamf, Workspace ONE, ManageEngine, Ivanti, Hexnode, Scalefusion (silent deploy, app store, self-service, MAM, allow/block lists)
MAM / containerization: Intune (App Protection Policies), Workspace ONE (Boxer, Content), ManageEngine, Ivanti, Hexnode, Scalefusion, Entgra, Mosyle, Jamf
RMM tools: NinjaOne, ConnectWise, Datto, N-able deploy apps via scripts but lack app stores, self-service portals, and MAM
Security & Compliance
| Tool | Compliance Rules | Conditional Access | Encryption Enforce | Remote Wipe | DLP |
|---|---|---|---|---|---|
| Fleet | Yes (osquery policies) | No | Yes (monitor) | Yes | No |
| GLPI | No | No | No | No | No |
| OpenUEM | Yes | No | Yes | Yes | No |
| Tactical RMM | Limited (scripts) | No | No | Yes (script) | No |
| NanoMDM | Yes (profiles) | No | Yes (FileVault) | Yes | No |
| Entgra | Yes | Yes | Yes | Yes | Yes |
| Theopenem | No | No | No | No | No |
| Rudder | Yes | No | Yes | No | No |
| Flyve MDM | Yes (basic) | No | Yes | Yes | No |
| MeshCentral | No | No | No | Yes (script) | No |
| ManageEngine | Yes | Yes | Yes | Yes | Yes |
| SCCM/MECM | Yes | Yes* | Yes | Yes | No |
| Ivanti UEM | Yes | Yes | Yes | Yes | Yes |
| Workspace ONE | Yes | Yes | Yes | Yes | Yes |
| Quest KACE | Limited | No | Yes | Yes | No |
| Baramundi | Yes | No | Yes | Yes | No |
| NinjaOne | Limited | No | Yes (BitLocker) | Yes (script) | No |
| ConnectWise RMM | Limited | No | No | Yes (script) | No |
| Datto RMM | Limited | No | No | Yes (script) | No |
| N-able | Limited | No | Yes (BitLocker) | Yes (script) | No |
| Intune | Yes | Yes (Entra CA) | Yes | Yes | Yes (Purview) |
| Jamf Pro | Yes | Yes | Yes (FileVault) | Yes | No |
| Kandji | Yes | Yes* | Yes (FileVault) | Yes | No |
| Mosyle | Yes | Limited | Yes (FileVault) | Yes | No |
| Hexnode | Yes | Yes | Yes | Yes | Yes |
| JumpCloud | Yes | Yes | Yes | Yes | No |
| Scalefusion | Yes | Yes | Yes | Yes | Yes |
| Rippling | Yes | Yes | Yes | Yes | No |
| Addigy | Yes | Limited | Yes (FileVault) | Yes | No |
| Automox | Yes | No | Yes | Yes (script) | No |
* = requires integration with Entra ID Conditional Access or partner solution
Best compliance and security: Intune (Conditional Access + Purview DLP), Workspace ONE, ManageEngine, Ivanti, Hexnode, Scalefusion (compliance rules, conditional access, encryption, wipe, DLP)
Conditional access leaders: Intune (Entra CA), Workspace ONE, ManageEngine, Ivanti, Jamf (via Entra integration), JumpCloud, Hexnode, Rippling
RMM tools: Limited compliance – rely on scripts and basic monitoring; no native conditional access or DLP
MSP / Multi-Tenant
| Tool | Multi-Tenant | Per-Customer Isolation | Centralized Console | White-Label | RMM Features |
|---|---|---|---|---|---|
| Fleet | Yes (teams) | Yes | Yes | No | Yes (osquery monitoring) |
| GLPI | Limited (entities) | Yes | Yes | No | No |
| OpenUEM | Limited | Limited | Yes | No | Limited |
| Tactical RMM | Yes (clients/sites) | Yes | Yes | No | Yes (full RMM) |
| NanoMDM | No | No | No | No | No |
| Entgra | Yes | Yes | Yes | Yes | Limited |
| Theopenem | No | No | Yes | No | No |
| Rudder | Limited | Limited | Yes | No | No |
| Flyve MDM | Limited (GLPI entities) | Yes | Yes | No | No |
| MeshCentral | Yes (device groups) | Yes | Yes | No | Yes (monitoring) |
| ManageEngine | Yes (MSP ed.) | Yes | Yes | No | Yes (RMM features) |
| SCCM/MECM | Limited | Limited | Yes | No | No |
| Ivanti UEM | Yes | Yes | Yes | No | No |
| Workspace ONE | Yes | Yes | Yes | No | No |
| Quest KACE | Limited | Limited | Yes | No | No |
| Baramundi | Limited | Limited | Yes | No | No |
| NinjaOne | Yes (native) | Yes | Yes | Yes | Yes (full RMM) |
| ConnectWise RMM | Yes (native) | Yes | Yes | Yes | Yes (full RMM) |
| Datto RMM | Yes (native) | Yes | Yes | Yes | Yes (full RMM) |
| N-able | Yes (native) | Yes | Yes | Yes | Yes (full RMM) |
| Intune | Yes (multi-tenant) | Yes | Yes (Lighthouse) | No | No |
| Jamf Pro | Limited | Limited | Yes | No | No |
| Kandji | Limited | Limited | Yes | No | No |
| Mosyle | Yes (MSP ed.) | Yes | Yes | No | No |
| Hexnode | Yes (MSP ed.) | Yes | Yes | Yes | Limited |
| JumpCloud | Yes (MSP ed.) | Yes | Yes | No | Limited |
| Scalefusion | Yes | Yes | Yes | Yes | Limited |
| Rippling | Limited (PEO) | Limited | Yes | No | No |
| Addigy | Yes (MSP native) | Yes | Yes | Yes | Limited |
| Automox | Yes (zones) | Yes | Yes | No | No |
Best MSP platforms: NinjaOne, ConnectWise RMM, Datto RMM, N-able (purpose-built MSP RMM with multi-tenant, white-label, PSA integration, full monitoring and management)
Best OSS MSP option: Tactical RMM (client/site hierarchy, full RMM features, multi-tenant by design)
UEM with MSP editions: ManageEngine, Mosyle, Hexnode, JumpCloud, Addigy (MDM + multi-tenant for MSP use cases)
Deployment & Licensing
| Tool | License | Self-Hosted | Language | Min RAM | Docker | Pricing Model |
|---|---|---|---|---|---|---|
| Fleet | MIT | Yes | Go | 2 GB | Yes | Free; Fleet Premium per-device |
| GLPI | GPL-2.0 | Yes | PHP | 512 MB | Yes | Free; GLPI Network subscription optional |
| OpenUEM | Apache-2.0 | Yes | Go | 1 GB | Yes | Free |
| Tactical RMM | MIT/Apache-2.0 | Yes | Django/Vue/Go | 4 GB | Yes | Free; sponsors get priority support |
| NanoMDM | MIT | Yes | Go | 128 MB | Yes | Free |
| Entgra | Apache-2.0 | Yes | Java/WSO2 | 4 GB | Yes | Free; Entgra Cloud paid |
| Theopenem | GPL-2.0 | Yes | C#/.NET | 4 GB | No (Windows) | Free |
| Rudder | GPL-3.0 | Yes | Scala/C | 4 GB | No | Free; subscription for enterprise plugins |
| Flyve MDM | GPL-3.0 | Yes | PHP (GLPI) | 512 MB | Yes | Free |
| MeshCentral | Apache-2.0 | Yes | Node.js | 512 MB | Yes | Free |
| ManageEngine | Proprietary | Yes | Java | 4 GB | No | Free (25 devices); paid per-device |
| SCCM/MECM | Proprietary | Yes | C++/.NET | 8 GB | No (Windows) | Per-device or per-user; SA license |
| Ivanti UEM | Proprietary | Yes | .NET/Java | 8 GB | No | Per-device; subscription |
| Workspace ONE | Proprietary | Yes/SaaS | Java | 8 GB | No | Per-device or per-user; subscription |
| Quest KACE | Proprietary | Appliance | – | – | – | Per-device; perpetual or subscription |
| Baramundi | Proprietary | Yes | .NET | 4 GB | No (Windows) | Per-device; perpetual or subscription |
| NinjaOne | Proprietary | No (SaaS) | – | – | – | Per-device; usage-based |
| ConnectWise RMM | Proprietary | No (SaaS) | – | – | – | Per-device; subscription |
| Datto RMM | Proprietary | No (SaaS) | – | – | – | Per-device; subscription |
| N-able | Proprietary | No (SaaS) | – | – | – | Per-device; tiered |
| Intune | Proprietary | No (SaaS) | – | – | – | Per-user ($8-16/mo with M365); standalone available |
| Jamf Pro | Proprietary | Yes/SaaS | – | 4 GB | No | Per-device ($4-12/mo); volume discounts |
| Kandji | Proprietary | No (SaaS) | – | – | – | Per-device; tiered pricing |
| Mosyle | Proprietary | No (SaaS) | – | – | – | Per-device ($1-4/mo); aggressive pricing |
| Hexnode | Proprietary | No (SaaS) | – | – | – | Per-device ($1-6/mo); tiered |
| JumpCloud | Proprietary | No (SaaS) | – | – | – | Per-user ($7-24/mo); free tier (10 users) |
| Scalefusion | Proprietary | No (SaaS) | – | – | – | Per-device ($2-6/mo); tiered |
| Rippling | Proprietary | No (SaaS) | – | – | – | Per-user ($8+/mo); modular pricing |
| Addigy | Proprietary | No (SaaS) | – | – | – | Per-device; MSP-tiered |
| Automox | Proprietary | No (SaaS) | – | – | – | Per-device ($3-5/mo); volume discounts |
Lightest deployment: NanoMDM, MeshCentral, GLPI, Flyve MDM (minimal RAM, Docker-ready)
Heaviest deployment: SCCM/MECM, Ivanti, Workspace ONE (Windows Server, SQL Server, 8+ GB RAM, complex infrastructure)
Free tiers: All OSS tools; ManageEngine (25 devices); JumpCloud (10 users); Fleet (free core)
Tools
30 tools.
Addigy
Addigy is an Apple device management platform designed specifically for MSPs and IT service providers.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Atera
Atera is a cloud-native IT management platform that combines RMM, PSA, remote access, patch management, and billing in a single SaaS solution.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Automox
Automox is a cloud-native endpoint management platform focused on automated patch management across Windows, macOS, and Linux.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ConnectWise Automate
ConnectWise Automate (formerly LabTech) is a Remote Monitoring and Management platform designed for MSPs.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Datto RMM
Datto RMM is a cloud-native remote monitoring and management (RMM) platform for MSPs, providing endpoint monitoring, patch management, remote access, and scripted automation.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
Fleet
Fleet is an open-source platform for device visibility, policy compliance, and vulnerability management built on top of osquery.
License: MIT (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Foreman
Foreman is an open-source lifecycle management tool for physical and virtual servers, providing provisioning, configuration management (Puppet/Ansible/Salt/Chef), and patch/content management via Katello.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
FusionInventory
FusionInventory is an open-source inventory agent and GLPI plugin that provides automated hardware and software inventory collection, network discovery, SNMP device inventory, and software deployment capabilities.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: package · SSO: none
GLPI
GLPI (Gestionnaire Libre de Parc Informatique) is a comprehensive open-source IT asset management and helpdesk platform.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: SAML
Hexnode UEM
Hexnode UEM is a unified endpoint management platform that manages Windows, macOS, iOS, Android, tvOS, and FireOS devices from a single console.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Ivanti Neurons
Ivanti Neurons is a cloud-native platform for unified endpoint management, patch management, discovery, security, and digital employee experience (DEX).
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Jamf Pro
Jamf Pro is the leading Apple device management platform, providing comprehensive MDM, zero- touch deployment, app management, and security for macOS, iOS, iPadOS, and tvOS devices.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
JumpCloud
JumpCloud is a cloud directory and endpoint management platform that unifies identity management, device management, and SSO in a single SaaS solution.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
Kandji
Kandji is a modern Apple device management and security platform that emphasizes automation, pre-built security controls, and an intuitive interface.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Landscape
Landscape is Canonical’s systems management tool for Ubuntu deployments. It provides package management, security patching, compliance monitoring, and remote administration for Ubuntu desktops and servers through a web-based management cons…
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
ManageEngine Endpoint Central
ManageEngine Endpoint Central (formerly Desktop Central) is a unified endpoint management solution that combines patch management, software deployment, remote control, asset management, and MDM capabilities.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
MeshCentral
MeshCentral is an open-source, web-based remote management and remote desktop tool offering browser-based desktop, terminal, file transfer, and Intel AMT management for Windows, Linux, and macOS.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
MicroMDM
MicroMDM is a minimal, open-source Apple MDM server written in Go. It implements the core Apple MDM protocol including Device Enrollment Program (DEP) support, push notifications, and command execution.
License: MIT (OSS) · Kind: web · Deploy: native · SSO: none
Microsoft Intune
Microsoft Intune is a cloud-based unified endpoint management (UEM) platform that manages Windows, macOS, iOS, Android, and Linux devices.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Mosyle
Mosyle is an Apple-focused device management platform offering MDM, identity management, endpoint security, encrypted DNS, and app management in an integrated solution branded as the “Apple Unified Platform.” It serves both business and edu…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
NanoMDM
NanoMDM is a lightweight, open-source Apple MDM server written in Go, created by Jesse Peterson as a spiritual successor and evolution of the concepts behind MicroMDM.
License: MIT (OSS) · Kind: web · Deploy: native · SSO: none
NinjaOne
NinjaOne (formerly NinjaRMM) is a cloud-native endpoint management platform designed for IT teams and MSPs.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
OCS Inventory NG
OCS Inventory NG (Open Computers and Software Inventory Next Generation) is an open-source IT asset inventory and software deployment solution.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
openSUSE Manager
openSUSE Manager is the openSUSE community distribution of Uyuni, providing Linux systems management capabilities including patch management, configuration management, system provisioning, and compliance monitoring.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Rudder
Rudder is an open-source IT infrastructure automation and compliance platform that provides continuous configuration management, compliance auditing, and drift detection for servers and endpoints.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: OIDC, SAML
Scalefusion
Scalefusion is a multi-platform device management solution that provides MDM, kiosk lockdown, BYOD management, and application management for Android, iOS, Windows, macOS, and Linux devices.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
SimpleMDM
SimpleMDM is a streamlined Apple device management platform that emphasizes simplicity and ease of use.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Tactical RMM
Tactical RMM is an open-source Remote Monitoring and Management platform designed for MSPs and IT administrators.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
Uyuni
Uyuni is an open-source systems management solution for Linux infrastructure, providing software management, patch management, configuration management, and system provisioning.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
VMware Workspace ONE
VMware Workspace ONE (now under Omnissa after Broadcom’s acquisition of VMware) is a unified endpoint management platform that combines device management, application delivery, and identity access management.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
