Mobile Device Management
in Allegheny County, PA

Allegheny County's mobile fleet is the most diverse in the four-state region MCR covers, and the MDM disciplines that fit one customer segment miss the next badly. The downtown legal and CPA practice population runs iPhones and iPads (mostly iPhones with a smaller iPad-for-document-review subset) under a trust-account-aware BYOD model where the partners' personal devices carry firm email and document access alongside family photos and iMessage. The AHN-orbit and UPMC-orbit medical and dental practice population runs high iPad density (chairside imaging, chart review, in-room patient-consent capture, lobby check-in) under HIPAA-grade configuration with chairside-imaging integration tied to the EHR vendor's certified envelope. The Strip District / Lawrenceville / East Liberty creative agency and tech-startup population runs the most mixed Apple-vs-Android-vs-rugged distribution in the county — Pixels and Samsungs alongside MacBooks alongside the occasional ruggedized field-survey tablet. The South Hills retail population (Galleria of Mt. Lebanon, Ross Park Mall, Waterfront, Robinson Town Centre, South Hills Village) runs point-of-sale tablets in supervised kiosk mode. The Mon Valley and Carnegie and Mt. Oliver and McKees Rocks industrial corridor population runs Zebra and Honeywell ruggedized scanners for warehouse and route-delivery workflows. Five operationally distinct patterns under one Allegheny County MSP umbrella.

MCR Business Tech Solutions deploys and manages mobile fleets across Allegheny County using Microsoft Intune, Google Workspace Endpoint Management, Jamf Pro, Mosyle, Apple Business Essentials, SOTI MobiControl, or VMware Workspace ONE depending on identity provider, fleet composition, and how ruggedized the use case gets. The platform picker is identity-first: a downtown firm running M365 Business Premium with Entra and Intune already licensed shouldn't be charged separately for Jamf when Intune does the iOS work in the console they already pay for. A North Hills 14-iPad Apple-pure dental practice with no in-house IT shouldn't be deployed under Jamf Pro Server when Apple Business Essentials covers MDM + iCloud storage + AppleCare in a single bill at a fraction of the operational overhead. A Carnegie distribution center running 60 Zebra TC52 scanners on a warehouse-management system shouldn't be deployed under generic Intune when SOTI MobiControl's Zebra-specific tooling (StageNow profiles, DataWedge intent routing, Velocity terminal-emulator settings) is what the workflow actually needs. We explain the situational call before the customer commits to a platform, and the platform recommendation falls out of what fits, not what we resell most.

BYOD on Allegheny County's professional services population is the highest-volume engagement type we run, and the privacy boundary discipline matters more here than anywhere else in the region. Downtown legal practices with IOLTA trust-account responsibility cannot afford the employment-law exposure of mishandled selective wipe at a partner or associate departure; the work-side data has to come off the device cleanly without the family-photo conversation that derails employment counsel. Apple User Enrollment (for the iPhone-and-iPad population) and Android work-profile mode (for the Pixel and Samsung population) both deliver kernel-isolated separation between the work container and the personal side, enforced by iOS and Android themselves rather than by admin courtesy. The MDM platform sees the work-side inventory, enforces the work-side passcode and encryption policy, and wipes the work container at offboarding; personal iMessage, WhatsApp, photos, browsing history, family iCloud, and personal social apps are invisible to the admin console. We document the boundary in a plain-English enrollment-time explanation each user reads and acknowledges; the firm's office manager stops fielding the 'can IT see my texts' question entirely.

Healthcare iPad density across the AHN-orbit and UPMC-orbit practice population is the second-largest MDM engagement type in Allegheny County, and the HIPAA discipline runs at every layer. Configuration profiles enforce screen-lock at one minute, passcode complexity, automatic encryption (default-on by hardware), screenshot suppression for managed apps containing PHI, AirDrop restrictions blocking the inadvertent PHI leak, jailbreak detection, and required-MFA on every clinical-system login. Chairside-imaging integration runs through the EHR vendor's certified deployment (Dentrix imaging on iPad, Eaglesoft on iPad, Sirona Dental Imaging, eClinicalWorks Mobile, NextGen Mobile) with the certified-iOS-version envelope tracked alongside the workstation envelope. Lost-device response runs through the MDM console rather than through consumer Find-My with the office manager's personal Apple ID — supervised iPads carry MDM-driven remote lock and remote wipe, the Apple Business Manager Activation Lock pairing prevents a lost device from being reset and resold, and the audit log shows exactly which device was wiped when. The annual HIPAA Security Risk Assessment artifact for the practice's mobile fleet drops out of the regular operational work as a side effect.