EU MDM Comparison 2026: Jamf vs Intune vs Workspace ONE vs Ivanti — GDPR, CLOUD Act, NIS2 Finale

Post #1207 in the sota.io EU Cyber Compliance Series — EU Mobile Device Management Serie #5/5

Mobile Device Management sits at the intersection of every major EU compliance framework. MDM agents run at kernel level — they hold device certificates, APNs tokens, enrollment profiles, and remote-wipe authority. Under NIS2 Article 21(2)(g), every MDM vendor is a critical supply-chain dependency for Essential Entities. Under GDPR Article 28, every employee device processed through a US MDM vendor is subject to CLOUD Act jurisdiction.

This finale post compares all four US MDM market leaders analysed in this series against EU-native alternatives. We assign CLOUD Act risk scores (0–25), map each vendor to NIS2 supply-chain risk tiers, and provide a decision framework for EU security teams choosing their MDM platform in 2026.

The EU MDM Landscape: Why US Vendors Dominate (and Why That's a Problem)

The global MDM market is dominated by four US-headquartered vendors: Jamf (Minnesota), Microsoft Intune (Washington State), VMware Workspace ONE (now Broadcom, California), and Ivanti UEM (Utah). Combined, they serve the vast majority of enterprise deployments in Europe.

Each vendor has a structural problem that EU-based alternatives do not share: US corporate parentage creates unavoidable CLOUD Act exposure.

The Electronic Communications Privacy Act (18 U.S.C. § 2703) and the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2713) require US-incorporated companies to produce data stored anywhere in the world when served with a valid US court order. EU server location, Standard Contractual Clauses, and even EU Data Boundary programmes do not override this statutory obligation.

For MDM vendors, this matters acutely because MDM data includes:

• Device enrollment credentials and certificates
• Remote-wipe and lock capability
• Application inventory (which apps employees use)
• Location data (where devices have been)
• Configuration profiles (network access, VPN, email)
• Compliance status and policy enforcement logs

All of this data flowing through a US-parent MDM vendor is subject to US intelligence access — structurally, regardless of contractual safeguards.

CLOUD Act Risk Score Methodology

Our 25-point CLOUD Act Risk Score measures how exposed a vendor's data is to US government access. Higher scores = greater risk for EU organisations.

Vendor Comparison: CLOUD Act Risk Scores

1. Jamf — CLOUD Act Score: 16/25

Corporate jurisdiction: Jamf Holding Corp., Nasdaq JAMF, Minneapolis, Minnesota, incorporated in Delaware. Score: 6/7.

Jamf is a pure-play MDM vendor with no intelligence contract history and no FedRAMP certification, which keeps the score lower than Intune. However, Jamf School and Jamf Now are SaaS platforms with US data residency by default. EU deployments require explicit EU region selection, and the US parent is legally obligated to comply with CLOUD Act warrants regardless of region.

Key GDPR risks: APNs push notification routing through Apple US servers (structural dependency); Jamf Cloud management data including device serial numbers processed under US jurisdiction; no EU Data Boundary programme equivalent.

NIS2 Art.21(2)(g) profile: Medium-high supply-chain risk. Essential Entities running Jamf are dependent on a US-parent vendor for device management across their entire mobile fleet.

2. Microsoft Intune — CLOUD Act Score: 21/25 (Highest in Series)

Corporate jurisdiction: Microsoft Corporation, Redmond, Washington State, incorporated in Washington. Score: 7/7.

Microsoft is a confirmed PRISM participant (PRISM slides, 2013 Snowden disclosures). Microsoft was the first company named in the original PRISM documentation. The company has received National Security Letters and Foreign Intelligence Surveillance Court orders across its product portfolio. Intune shares the Microsoft 365 infrastructure, placing device management data under the same jurisdictional umbrella as Exchange, SharePoint, and Teams.

EU Data Boundary: Microsoft's EU Data Boundary programme (launched 2023) commits to storing and processing EU customer data within the EU. However, EU Data Boundary does not override CLOUD Act obligations. Microsoft has explicitly acknowledged in DPA negotiations that it cannot guarantee immunity from US law enforcement access even for EU-stored data.

Key GDPR risks: Intune processes device compliance state, user identity (Azure AD/Entra ID integration), conditional access decisions, and application deployment data. All of this flows through Microsoft's identity infrastructure, which sits under US jurisdiction.

NIS2 Art.21(2)(g) profile: High supply-chain risk. Microsoft's PRISM participation history, combined with the deepest enterprise penetration in the EU market, makes Intune the highest-risk MDM choice for Essential Entities requiring supply-chain independence.

3. VMware Workspace ONE — CLOUD Act Score: 19/25

Corporate jurisdiction: Broadcom Inc., San Jose, California, incorporated in Delaware. Score: 7/7.

VMware was acquired by Broadcom in November 2023 for $61 billion. Broadcom has a history of aggressive post-acquisition changes: mandatory multi-year subscription bundles, elimination of perpetual licences, and forced migration to cloud-only tiers. Workspace ONE Intelligence — the analytics and automation layer — runs exclusively on US-hosted SaaS infrastructure with no EU data residency option.

PE Behaviour Risk: Broadcom's acquisition pattern (CA Technologies, Symantec) demonstrates 100–300% post-acquisition price increases and forced cloud migration. EU customers who built MDM infrastructure around on-premises VMware are now dependent on Broadcom's cloud timeline.

CFIUS precedent: Broadcom was blocked by CFIUS in 2018 from acquiring Qualcomm on national security grounds — the regulatory body explicitly cited concerns about Broadcom's relationships with Huawei and other entities. This CFIUS history is relevant for Essential Entities assessing supply-chain trustworthiness.

Key GDPR risks: Workspace ONE Intelligence US-SaaS-only (DEX analytics, ML-powered automation); FedRAMP Moderate authorisation; control plane jurisdiction US regardless of EU data centre selection.

4. Ivanti UEM — CLOUD Act Score: 17/25

Corporate jurisdiction: Ivanti Inc., South Jordan, Utah, incorporated in Delaware. Score: 6/7.

Ivanti is private-equity owned (Clearlake Capital + TA Associates) with a fragmented legacy codebase assembled from five major acquisitions: MobileIron ($872M, 2020), LANDesk ($1.1B, 2017), Pulse Secure ($400M, 2020), Heat Software (2017), and Cherwell ($1.65B, 2021).

2024 Zero-Day Cascade: In January–March 2024, Ivanti disclosed four critical CVEs (CVE-2024-21888, CVE-2024-21893, CVE-2024-21887, CVE-2024-22024) that were actively exploited in the wild. CISA issued Emergency Directive ED 24-01 on 19 January 2024 — one of the most severe directives in CISA history — requiring federal agencies to disconnect and rebuild Ivanti appliances. Mandiant attributed the campaign to UNC5221 with moderate confidence, assessing China-nexus espionage motivation. CISA confirmed that "threat actor persistent access survived factory reset" — a fundamental supply-chain compromise.

NIS2 DORA implication: The Ivanti zero-day cascade is a textbook example of what NIS2 Article 21(2)(g) and DORA Article 28 ICT third-party risk provisions are designed to prevent. An MDM/UEM vendor that was fundamentally compromised for months, with forensic confirmation that factory reset did not clear attacker persistence, represents catastrophic supply-chain risk for any NIS2-regulated Essential Entity.

Key GDPR risks: Neurons Intelligence US-SaaS-only (no EU data residency for analytics layer); fragmented codebase increases vulnerability surface; PE ownership prioritises exit over long-term security investment.

Side-by-Side CLOUD Act Risk Matrix

NIS2 Article 21(2)(g) Supply-Chain Risk Analysis

NIS2 Directive Article 21(2)(g) requires Essential and Important Entities to implement "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers."

MDM vendors are tier-1 ICT supply-chain dependencies under any reasonable NIS2 interpretation. An MDM agent has kernel-level access to every managed device — it can wipe, lock, install software, and access configuration. If the MDM vendor is compromised (as Ivanti was in 2024), attackers inherit that privileged position across the entire managed fleet.

NIS2 Risk Tier Assessment

Tier 1 — Critical Risk (avoid for NIS2-regulated entities):

• Ivanti UEM: Active exploitation confirmed, CISA ED 24-01 issued, factory-reset-persistent attack vectors confirmed. NIS2 Article 21(2)(g) due diligence would expose any Essential Entity using Ivanti to regulatory scrutiny after the 2024 incidents.

Tier 2 — High Risk (requires compensating controls):

• Microsoft Intune: Highest CLOUD Act score (21/25), PRISM confirmed, deepest enterprise penetration. For Essential Entities in critical infrastructure sectors, using Intune means building CLOUD Act compensating controls into security architecture.
• VMware Workspace ONE: Broadcom acquisition risk, CFIUS history, US-only Intelligence layer. Forced cloud migration timeline adds operational risk for on-premises deployments.

Tier 3 — Moderate Risk (manageable with controls):

• Jamf: Lowest CLOUD Act score among US vendors (16/25), no FedRAMP, no confirmed IC contracts. Still a US parent with structural CLOUD Act exposure, but the lowest-risk US-parent MDM option.

Tier 4 — Low Risk (recommended for Essential Entities):

• baramundi, ACMP, Cortado: EU-incorporated, no US parent, BayLDA/German DPA supervision, 0/25 CLOUD Act score. Recommended for NIS2-regulated Essential Entities with genuine supply-chain independence requirements.

GDPR Article 28 DPA — Per-Vendor Gap Analysis

GDPR Article 28 requires a Data Processing Agreement with every processor that handles personal data on behalf of a controller. MDM platforms process:

• Employee device identifiers (serial numbers, IMEI, MAC addresses)
• Location history (where managed devices have been)
• Application inventory (installed apps per user)
• Compliance status and policy violation logs
• Biometric authentication data (Face ID, fingerprint registration)

GDPR DPA Red Flags Per Vendor

Microsoft Intune:

• EU Data Boundary commitment covers data storage but not CLOUD Act access
• DPA template references US government access carve-outs
• Entra ID integration means AAD user identities also under Microsoft jurisdiction
• FedRAMP High authorisation requires Microsoft to cooperate with US government access requests

VMware Workspace ONE:

• Workspace ONE Intelligence Analytics: explicitly US-SaaS-only, no EU data residency
• Post-Broadcom DPA templates lack clarity on subsidiary data flows
• Forced cloud migration (2023) means previous on-premises DPAs need renegotiation

Ivanti UEM:

• Neurons Intelligence: US-SaaS-only analytics layer
• Post-breach DPAs need explicit scope of data accessed by UNC5221 during compromise period
• PE ownership (Clearlake Capital): DPA counterparty stability risk

Jamf:

• Strongest GDPR posture among US vendors
• EU region available (must be explicitly selected — not default)
• APNs push notification routing through Apple US remains structural dependency
• DPA covers EU region, but US parent retains CLOUD Act exposure

Apple APNs: The Structural Dependency Every EU MDM Shares

One critical point differentiates EU MDM from most other EU tech alternatives: the Apple Push Notification Service (APNs) structural dependency.

Every MDM solution that manages Apple devices — including EU-native vendors like baramundi, Cortado, and ACMP — must route push notifications through Apple's APNs servers in the United States. Apple Inc. is a US corporation. APNs is not available from EU infrastructure.

This means:

• Thin US exposure: Device enrollment push notifications travel through US infrastructure
• No MDM data in APNs: APNs carries only the push trigger, not device management payloads
• EU-native MDMs minimise this: baramundi, ACMP, and Cortado limit US exposure to this thin push channel
• US MDMs amplify it: Jamf, Intune, Workspace ONE, and Ivanti add all management data on top of the APNs dependency

For Android-only fleets, this dependency disappears entirely — EU-native MDMs with 0/25 CLOUD Act scores achieve true supply-chain independence.

Recommendation: EU organisations managing mixed Apple/Android fleets should:

1. Choose EU-native MDM (baramundi, ACMP, or Cortado)
2. Accept the thin APNs dependency as unavoidable for Apple device management
3. Document APNs as a managed residual risk in their NIS2 and GDPR records of processing
4. Evaluate whether Apple Business Manager enrolment can be configured for minimum data exposure through APNs

DORA Article 28 ICT Third-Party Risk — Financial Sector Implications

For EU financial entities regulated under DORA (Digital Operational Resilience Act, applicable from 17 January 2025), MDM/UEM qualifies as critical ICT third-party dependency under Article 28.

DORA Article 28 Requirements for MDM Vendors

• Register critical ICT third-party providers: MDM managing trading terminals, banking applications, or core systems must be registered
• Exit strategy: Financial entities must maintain viable exit plans from critical ICT providers
• Concentration risk: Multiple EU banks using the same US MDM creates sector-level concentration risk
• Incident reporting: MDM vendor incidents (cf. Ivanti 2024) trigger DORA incident notification obligations

DORA Risk Assessment by Vendor

TCO Analysis: US MDM vs EU-Native MDM

Total Cost of Ownership comparison for a 1,000-device enterprise deployment (3-year horizon):

Notes:

• Compliance overhead includes DPA legal review, NIS2 supply-chain documentation, and annual audit costs
• Ivanti breach risk provision reflects post-2024 incident remediation costs (CISA ED 24-01 resulted in rebuild costs for impacted organisations)
• EU-native MDMs have lower compliance overhead due to single-jurisdiction regulatory framework

Decision Framework: Choosing the Right MDM for EU Organisations in 2026

Framework: EU MDM Vendor Selection by Organisation Profile

Profile A: NIS2 Essential Entity (energy, transport, healthcare, financial infrastructure)

• Requirement: Genuine supply-chain independence, CLOUD Act immunity
• Recommendation: baramundi or ACMP (0/25)
• Rationale: NIS2 Article 21(2)(g) due diligence requires demonstrable supply-chain independence. US-parent MDM vendors cannot provide this. Regulatory scrutiny post-2025 ENISA NIS2 enforcement will focus on exactly this question.
• Migration Path: 12-week phased migration (device unenrolment → EU MDM onboarding → policy parity validation → decommission US MDM)

Profile B: DORA-regulated Financial Entity

• Requirement: ICT third-party risk management, concentration risk avoidance, exit strategy
• Recommendation: EU-native MDM (baramundi/ACMP for Windows/Android fleets; Cortado MDM for Apple-heavy deployments)
• Rationale: DORA Article 28 requires documented exit strategy. EU-native MDMs have simpler exit strategies and lower concentration risk.

Profile C: Enterprise with Apple-heavy fleet, compliance requirements moderate

• Recommendation: Jamf (16/25) if US MDM required; Cortado MDM if EU-native preferred
• Rationale: Jamf has lowest CLOUD Act score among US vendors, no FedRAMP, no confirmed IC contracts. For organisations that cannot migrate off US MDM, Jamf is the least-bad US option.

Profile D: Microsoft 365 shop, Azure AD/Entra ID integrated

• Consideration: Microsoft Intune has highest CLOUD Act score (21/25) but provides deepest Microsoft ecosystem integration
• If regulatory pressure low: Intune with EU Data Boundary + documented CLOUD Act residual risk
• If regulatory pressure high: Consider decoupling — Intune for policy, EU-native MDM for data, with SCCs documented

Profile E: Legacy Ivanti/MobileIron environment

• Immediate Action: Review 2024 compromise exposure. Any organisation using Ivanti during January–March 2024 should verify clean state.
• Migration Target: Given CISA ED 24-01 and UNC5221 attribution, migration away from Ivanti is the default recommendation. Target: any vendor with lower breach history — Jamf, baramundi, or ACMP.

EU-Native MDM Deep Dive: The 0/25 Options

baramundi Management Suite

Headquarter: Augsburg, Bavaria, Germany Parent: Freudenberg SE (Weinheim, Germany) — diversified German industrial conglomerate, no US parent, no PE ownership CLOUD Act Score: 0/25 Supervisory Authority: Bavarian State Office for Data Protection Supervision (BayLDA) Strength: Windows-first MDM with strong German KRITIS-sector penetration; local German support; Freudenberg SE as stable corporate parent Limitation: Apple management requires baramundi Apple Management module (full parity requires additional configuration); less well-known internationally than US vendors

ACMP by Aagon GmbH

Headquarter: Soest, North Rhine-Westphalia, Germany CLOUD Act Score: 0/25 Market: 500+ enterprise customers, strong in German KRITIS sectors (healthcare, public sector, utilities) Strength: Built specifically for enterprise Windows environments; strong on-premises deployment model; no cloud dependency Limitation: Primarily German-speaking market; international deployments require German-language support

Cortado MDM

Headquarter: Berlin, Germany CLOUD Act Score: 0/25 Data Centre: Berlin (Germany) Strength: Apple specialist — strongest EU-native option for Apple-heavy fleets; Berlin data centre; German DPA supervision Limitation: Less KRITIS-sector penetration than baramundi/ACMP; smaller vendor with correspondingly smaller support organisation

Matrix42 UEM

Headquarter: Frankfurt, Germany Parent: Vector Capital (San Francisco, CA) — US private equity CLOUD Act Score: 1/25 Note: 1 point reflects US PE ownership of Matrix42 AG. Vector Capital is a US fund; CLOUD Act could theoretically require Matrix42 AG to disclose data to US authorities via its US PE parent, though this is a weaker vector than direct US incorporation.

Migration Guide: Moving From US MDM to EU-Native MDM

Phase 1 — Assessment (Weeks 1–2)

1. Device inventory audit: Complete list of managed devices by OS (iOS/macOS/Android/Windows) and ownership model (BYOD/corporate-owned)
2. Policy documentation: Export all existing MDM policies as documentation (configuration profiles, compliance rules, conditional access)
3. Application catalogue: Document all MDM-deployed applications and their distribution models
4. APNs certificate audit: For Apple devices — document Apple Push Certificate expiry dates (cannot transfer between MDM vendors)
5. Integration dependencies: List every system that queries MDM API (SIEM, HR system, ticketing, identity providers)

Phase 2 — Parallel Deployment (Weeks 3–6)

1. Deploy EU-native MDM in parallel: Establish new MDM tenant without touching production devices
2. Policy parity validation: Recreate all critical policies in new MDM, validate against documented baseline
3. Pilot group: Migrate 50 devices (mix of OS types, device ownership) to new MDM first
4. Apple-specific: Generate new APNs certificate from Apple for new MDM vendor (old certificate is non-transferable)
5. Integration testing: Validate SIEM integration, identity provider connection, compliance reporting

Phase 3 — Production Migration (Weeks 7–10)

1. Department-by-department rollout: Migrate by business unit, not random sample
2. Zero-touch enrolment: Configure new MDM for automated enrolment for new devices
3. iOS/macOS: Re-enrol via Apple Business Manager (requires new APNs certificate)
4. Android: Re-enrol via Android Enterprise — migration is simpler than Apple (no APNs dependency)
5. Windows: Migrate via Autopilot (Intune) or manual re-enrolment for other vendors

Phase 4 — Decommission US MDM (Weeks 11–12)

1. Compliance validation: Confirm 100% device coverage in new MDM before decommissioning
2. Data export: Export compliance logs, device history from old MDM (GDPR Article 28 — keep records)
3. DPA termination: Formally terminate Data Processing Agreement with US MDM vendor
4. Certificate revocation: Revoke APNs certificates associated with old MDM
5. Documentation update: Update NIS2 supply-chain register, DORA ICT third-party register, GDPR Record of Processing Activities

NIS2 Supply-Chain Documentation Checklist

For EU organisations completing NIS2 Article 21(2)(g) supply-chain risk assessments:

• MDM vendor jurisdiction documented (US-parent flag)
• CLOUD Act exposure assessed and residual risk quantified
• Annual vendor security review scheduled (Ivanti 2024 is template for what to assess)
• Exit strategy documented and tested (can you migrate within 90 days if vendor compromised?)
• APNs dependency documented as managed residual risk (for Apple fleets)
• DPA in place with all MDM sub-processors
• Incident notification procedure in place (if MDM vendor reports breach)
• NIS2 audit trail: who approved MDM vendor, when, what controls were assessed

Conclusion: The EU MDM Risk Ladder

The four US MDM vendors analysed in this series form a clear risk ladder based on CLOUD Act exposure and security incident history:

Highest Risk: Microsoft Intune (21/25) — PRISM confirmed, FedRAMP High, deepest enterprise penetration, EU Data Boundary ≠ CLOUD Act immunity.

High Risk: VMware Workspace ONE (19/25) — Broadcom acquisition instability, US-only Intelligence layer, CFIUS-flagged parent.

Moderate Risk: Ivanti UEM (17/25) — Lowest PE-stability, catastrophic 2024 zero-day cascade, CISA ED 24-01, UNC5221 attribution. Security track record disqualifies for NIS2-regulated Essential Entities.

Lowest Among US Vendors: Jamf (16/25) — No FedRAMP, no confirmed IC contracts, EU region available. Still structurally CLOUD Act exposed but lowest-risk US option.

True EU-Native: baramundi (0/25), ACMP (0/25), Cortado (0/25) — No US parent, no CLOUD Act exposure, German DPA supervision. Recommended for NIS2 Essential Entities and DORA-regulated financial entities requiring genuine supply-chain independence.

The EU MDM market has viable, mature EU-native options. The question for EU security teams is no longer whether EU-native MDM exists — it does — but whether they are willing to accept the integration complexity of migrating from deeply embedded US MDM platforms. For NIS2-regulated Essential Entities, that migration is increasingly a compliance necessity, not a preference.

This analysis is based on publicly available corporate filings, CLOUD Act statutory text, vendor documentation, and regulatory guidance current as of May 2026. CLOUD Act risk scores are the author's assessment framework and not an official regulatory finding. Legal advice should be sought for specific compliance decisions.

This is Post #5/5 in the sota.io EU Mobile Device Management Series. Previous posts: Jamf EU Alternative, Microsoft Intune EU Alternative, VMware Workspace ONE EU Alternative, Ivanti UEM EU Alternative.