You have two free ways to lock down company iPhones. The first is Apple's own MDM, which is built into Apple Business and has been free since April 2026. The second needs no MDM server and no account: you supervise each iPhone once by cable and install a locked profile that blocks the apps and websites you choose.
This post is for an owner or office manager with 1 to 20 company iPhones and no IT department.
What MDM is
MDM means mobile device management. It is a server that sends settings to your phones over the internet. With an MDM you can change rules from your desk, install apps on every phone, see a list of all devices, and lock or erase a phone that is lost.
When a real MDM is the right answer
Use a real MDM if one of these is true:
- You have many phones, or the number grows every month.
- You need to change rules often, without collecting the phones.
- You must erase a lost or stolen phone from far away.
- You need to install and update work apps on every phone.
Your options, named in no order:
- Apple Business. Apple's own platform. It replaced Apple Business Manager and Apple Business Essentials on April 14, 2026, and it has device management built in. Apple lists it as free. Extra iCloud storage and AppleCare+ cost money.
- Jamf Now, SimpleMDM, Mosyle. Apple-only tools made for small teams.
- Microsoft Intune. Common in offices that already use Microsoft 365.
Check current pricing and free plan limits on each site. They change.
An MDM is also more work: an account, company verification, and a dashboard to learn. If you only want phones that are for work, the cable way is smaller.
Start with the built-in settings
Every iPhone has Screen Time. In Settings, open Screen Time. These are its parts on iOS 27:
- Content & Privacy Restrictions blocks content and built-in features.
- Time Allowances (called App Limits before iOS 27) sets daily time for categories like social apps and games.
- Screen Time Schedule (called Downtime before iOS 27) chooses when those apps are available.
- Manage Screen Time, then Lock Screen Time Settings, sets a four-digit passcode.
This is enough if you trust the team and only want a light rule. It is weak as a company policy. The passcode can be reset with the Apple Account that is signed in on the phone, and that is usually the employee's account. You also set it by hand on every phone.
What a supervised iPhone is
Supervision is Apple's mode for devices that a company or school owns. Apple says supervision "generally denotes that the device is owned by the organization, which provides additional control over its configuration and restrictions."
A supervised iPhone accepts restrictions that a normal iPhone refuses. It also accepts a profile that the user cannot remove in Settings. Most people get supervision through an MDM. You can also turn it on by cable from a Mac, with no MDM server.
What you can do without a server
You supervise each iPhone once, by cable. Then you install one locked profile. The profile can:
- Block the apps you choose, such as social, games, betting and shopping apps. They stay blocked even if someone installs them.
- Block the websites you choose.
- Turn on Apple's adult website filter. It works in Safari and in apps that use the system web view. It is a filter and does not catch everything.
Phone, Messages, Mail, Maps, the camera and your work apps keep working. The App Store stays on.
A locked profile cannot be removed on the iPhone itself. Undoing it takes erasing the iPhone, or a Mac with Apple Configurator.
The two free ways to do it
| The free Mac app | Manually via Apple Configurator | |
|---|---|---|
| Data on the phone | Stays. The app makes a backup, changes one setting, and restores it | Erased first. Only what syncs to iCloud comes back |
| Good for | Phones already in use | New company phones, where erasing is normal |
| You need | Mac with Apple Silicon, macOS 14 or later, a cable | Mac, Apple Configurator (free from Apple), a cable |
| Effort | The app does the steps | You follow a written guide |
| Account | None | None |
The Mac app is at attentionawareness.com. The manual steps are in the manual guide, and the profile builder is at /build.
How this compares to an MDM
| Cable and locked profile | MDM | |
|---|---|---|
| Change the rules | You need the phone and the cable again | From your desk |
| Erase a lost phone | No. Use Find My with the Apple Account on the phone | Yes |
| List of all devices | No | Yes |
| Install work apps for everyone | No | Yes |
| Set up many phones at once | No. One phone at a time | Yes |
| See or track the phone | Nobody can | The admin sees device details |
| MDM server, account, monthly fee | None | An account, sometimes a fee |
With no MDM server, nothing on the phone reports back to you or to me. The phone is limited, and the employee keeps their privacy.
Set up 5 phones, step by step
- Write the list. Decide which apps and websites to block. Keep one list for all phones.
- Tell the team. Say what will be blocked and why, before you touch a phone.
- Get ready. You need the Mac, a good cable, each phone's passcode and its Apple Account password.
- Pick the way. Use the Mac app for phones with data. Use Apple Configurator for new phones in the box.
- Do one phone first, in trial mode. A trial profile can be removed in Settings. Give the phone back for a day and check that every work app opens.
- Fix the list. Remove anything that blocked real work.
- Do the other four. Plug in, supervise, install the profile. New phones are quick. A phone with many photos takes longer, because the backup and restore take time.
- Lock it. Plug in each phone once more and make the profile permanent.
- Keep a note. Write down the date and the list for each phone.
What this cannot do
- It does not change anything from a distance. Adding a block needs the cable. Removing a block from a locked phone means erasing the phone and setting it up again.
- It does not erase, find, or list phones.
- It does not block everything. Only the apps and sites on your list are blocked, and the adult filter misses some sites.
- It does not install or update apps for you.
- It is iPhone only today, and you need a Mac.
The people side
Do this only on phones the company owns, and tell employees in writing before you do it. This is not legal advice, and rules differ by country, so ask a lawyer if you are unsure.
FAQ
Is there a free Apple MDM?
Yes. Apple Business has device management built in, and Apple lists it as free in more than 200 countries and regions. Some other MDM tools have free plans with limits. Check each site for current terms.
Can I supervise an iPhone without MDM?
Yes. Apple Configurator on a Mac can supervise an iPhone by cable with no MDM. Apple says this erases the device. The free Mac app from attention awareness supervises an iPhone and keeps its data.
Can an employee remove the locked profile?
Not on the iPhone itself. An employee who erases the iPhone removes it, and so does restoring a backup made before supervision. A Mac with Apple Configurator can remove it too.
Can I see what employees do on the phone?
No. The phone is not enrolled in an MDM server, so nobody can see or track it. If you need device reports, you need an MDM.
What happens when an employee leaves?
Erase the iPhone. Then supervise it again and install the profile for the next person.
Next step
Start with one phone and trial mode. Back up each phone first. Get the free Mac app if the phones have data on them, or do it manually via Apple Configurator for new phones.