Microsoft Intune alternatives and competitors

We have two main use cases of Desktop Central. The first is patching, because we want to keep our systems secure. We install Microsoft security updates using ManageEngine Desktop Central every month. The second case is to deploy applications. We want to install applications to the machines from a central location. Also, we want to give access to users so they can install whatever applications they need using the self-service portal option. When there is a common application used by many users, we publish it to the self-service portal so users can install it themselves instead of contacting local IT. Those are our two main use cases of ManageEngine, but we also use it for other tasks, such as remote connection. Our local IT uses two products: ManageEngine Desktop Central and TeamViewer. We use both to connect to the remote machines. 

We have the on-premise version, but we are looking to move forward to the cloud version once they start supporting data migration—at the moment, they don't support it. 

One of the benefits of Desktop Central is it made the provisioning process simpler because now we have a provisioning package. We have around 1,500 laptops at the moment and all these PCs were provisioned by a provisioning package. In the provisioning package, we have integrated every aspect of renaming, deploying applications, patching, etc., so we simply execute the provisioning package and as soon as it's executed, it will install the management agent. Once the agent is installed, it will take care of all the tasks, so we don't have to sit in front of the computer to prepare the machine. This really helps us to provision the PC quickly with our agent. 

Now, we are going to do a PC refresh. It's a big project for next year. We are going to replace all of our PCs—1,500 PCs—with a new one, for all the users, so we have big requirements for ManageEngine. ManageEngine does a lot of scripting work in the backend—including renaming the computer according to our conventions, distributing applications, patching—so when we prepare the machine, we want everything to be installed and ready to give to the user. We don't want to wait or take more time, so we've now combined ManageEngine with Microsoft's Autopilot and Intune to provision the PCs. PC provisioning is made easier with ManageEngine. 

Another benefit is we have the option to pilot updates with some machines before distributing them to production, and this can be completely automated. We don't have to create said task every time for testing and deployment, so once we scope it, it relieves the time we spend each month deploying patches. It regularly runs in our schedule with the reboot options. We give reboot notifications in a user-friendly manner to employees, with the option to postpone the reboot. This relieves the time that we spend with end users since it's user-friendly. 

One of the most valuable features is patching. They support third-party patching as well, so we don't have to use another product. They support both Microsoft and third-party updates, and this is one of the main functionalities that we use regularly. 

The software deployment feature is also valuable because, once in a while, we need to distribute applications, such as VCO, Office applications, etc. For example, when we prepare a PC for users. We use ManageEngine to perform lots of tasks. 

We also have the option to deploy scripts via ManageEngine. We use some scripts that are to be deployed during the machines' provisioning, to make sure our machines are renamed properly according to the naming conventions we want. For example, for the France region, we want FRP, France Paris, and then the serial number. We want to deploy some script that renames the PC after the machine is provisioned, and we also want to deploy background images, logon screen, logout screen, etc. So we deploy all these policies using ManageEngine.

ManageEngine could be improved by giving customers an option to perform certain actions proactively. Since I was a consultant, I worked on different products and some had advantages over ManageEngine. For example, proactive remediation—you want to proactively check something on the computers and run the script. In ManageEngine, you have the option to run the script, but Intune has the option to do so proactively. ManageEngine doesn't have this. You should have the option to act proactively, not just going ahead and fixing it once it's done. Proactive remediation should be a feature. 

Another thing is, with PC provisioning, they have to make it in a modern way. They have deployment, but it's a very outdated process right now. It's a modern workplace, so you have to provision a PC live, on the go—it's not that you create images and then distribute the image to the machines. Many customers are not using this and, in fact, we are not using it. We use a modern way of PC provisioning. So they have to concentrate on that more. 

There are small glitches, but it's not going to stop you from using the product. For example, when you open the configuration, you may not see the details, but if you refresh the page, you will see them. There are small glitches here and there that we can see. 

I began using this solution about a year ago. In the past, I implemented this solution for different customers, but now I am an end user.

This solution is very stable. It depends on the size of the company, though. For us, it's very stable because we don't have many machines. The overall count is 1,800 to 1,900 machines—our license is for 2,050, but we've currently only utilized 1,900. So our infrastructure is medium-sized, I would say. If you go for 10,000, 20,000, you might have some lagging in the performance, but I'm not sure. 

It doesn't really require much maintenance. You just keep it as you want and regularly do a cleanup of old applications—when you delete, you have a new version of the package, so you might want to clean up the old packages—and that's it. You have automatic cleanup functionalities in the product itself. For example, if you download an update for this month and, after three months, none of the machines require this patch anymore, it automatically cleans up. You have some settings to enable so that you don't have to manually work on the cleanup. 

This solution is very easy to scale. We are trying to create lots of virtual machines in Azure Virtual Desktop, so we might increase our machines by another 100 or 200. 

ManageEngine's support is one of the best, I would say. We have chat support, so I can immediately ping someone in support, from my end product console, and get assistance very quickly. If I have a question, I can ask them directly; if I have technical questions, I can ask them, and they will provide an answer right away. If I write an email, it will take three to four hours. Since I was a support engineer before, I don't normally raise questions, but when I do, I normally get quick replies. Because it's a one-to-one chat, you get immediate responses from the chat window. 

In the past, when I first joined this company, we were using WSUS to patch all of our machines, but we didn't have any control over what patches were installed. We didn't have a proper reporting aspect in WSUS—we could have, but it's very complicated. We'd have to connect the information using SQL Server and pull the information, and that's lots of querying. But with ManageEngine, it's explicit. You go and collect the reports as you want, such as the number of patches installed on a machine or how many machines got a particular update. We even have the option to uninstall patches once they're installed, so we can go back to the previous patch version of the application. 

Another drawback with WSUS is that you don't have the option to scale a reboot. With ManageEngine, we can give reboot notifications in a user-friendly manner to employees, with the option to postpone, and after a certain number of days, you can reboot forcefully. This relieves the time that we spend with end users, who now get a pop-up. You don't have many options with WSUS, but with ManageEngine, you do. 

The deployment process is very easy. It's a combined product, so when you install the Desktop Central EXE, you install the database on the same machine, as well as the web server components like Apache Tomcat and Observer. Basically, when you install the EXE, you just click "next," "next," "next," and then it's done. It's not a big deployment. In terms of planning, you might need a little bit of time, but that's it. It's a half-day or one-day task, not like SCCM where you have to spend a lot of effort and there are lots of technical guides, technical architectural documents, etc. So it's very user-friendly in terms of deployment, I would say. 

The number of people involved in deployment depends on the size of the company. As I was a consultant before, I worked with two people, sometimes with one to six people. So it depends on the company. For example, in our company, we have only two people who manage the platform. To be honest, I cannot say that only one person can install this solution. 

For us, the deployment took two to three days, but it's not a continuous three days. We installed the server component and we installed the distribution server component after two days. So on the whole, we would've spent two to three days, maximum. 

We implemented through an in-house team. 

The pricing is very low, compared to other products. Compared to Intune or SCCM, it's much less. I can say it's a good product for less of a price. 

Intune doesn't really have a price, at the moment, because they integrated Intune with another license for Microsoft. If you purchase M365, you get the license. They've made everything a combo now, so obviously any company will go for M365, which includes everything. That's what our company has, and we don't pay anything extra for it. If you split the money, it would be much less than Desktop Central, so you can't technically compare the two. 

ManageEngine's licensing is not as good. They add new features and they ask for money. For example, they introduced Browser Security, which is an extra add-on. Compared to Intune, you just buy the Intune product and that's it, you have everything in place—browser security, endpoint management, etc. Everything's included with the Intune license, which isn't the case with ManageEngine. That's something they really need to take care of. 

We also use Intune, which offers many functionalities since it's integrated with Office 365. In terms of the experience, it's very light, but since ManageEngine is a completely different product, you have to integrate a lot of things. For example, installing the ManageEngine agent to all the machines if you want to onboard them. In comparison, with Intune, normally when you prepare the machine, it's automatically included, so onboarding is easy. 

Also, since Intune is a cloud service, you don't need to manage any infrastructure and you don't need a server to host the solution. With Desktop Central, you need a server, and that server should be managed by someone else as well, like a GDC team, a server team. 

Both solutions have advantages and disadvantages. For example, creating packages in ManageEngine is easier than Intune. In Intune, you have to create a package and convert it to a package format supported by Intune. In ManageEngine, you can create EXE or MSI—both are supported—and you just upload and create the package. 

ManageEngine Desktop Central is a product that's worth the money. It's easy to install and quicker in action. If you start installing the product today, in a small environment, you will be able to deploy the application in two hours. 

I rate ManageEngine a seven out of ten. They have a lot of improvements to make. 

We used AirWatch or VMware Workspace ONE to protect mobile devices on a large scale. They were known for being focused on mobile, more than desktops. They may not be as good on desktops, but the main use case is to monitor and manage mobile endpoints, e.g. wireless devices such as  tablets and phones. AirWatch became well known for being really good at monitoring and managing mobile endpoints.

VMware Workspace ONE isn't that good with patching and fixing, especially when compared to BigFix. This is an area for improvement. BigFix did a really good job in terms of patching and fixing, but it had a lot to do with IBM's integration to virtually every other platform out there. That integration really helped from just a server patching and endpoint management situation.

They (IBM) are very good at doing discovery, which is basically surveying the endpoint asset and finding out what vulnerability was there. It might be you're running Windows 10.647, and there are known vulnerabilities below that, so the prioritization of that patching became easy to create rules for, and make sure that you patched all devices with that current OS expeditiously.

Training for VMware Workspace ONE could also be improved, especially when compared to HCL who did a good job, either remote or self-paced.

VMware support has always been good, even if they became a really large company. They have what I call "Amazonitus", e.g. there's a lot of level two triage or level one triage, but you definitely get a response back, though a lot of people have moved away towards self-service. The goal is never to take a phone call if they don't have to, which I understand.

Their tech support is still rock solid on both sides, but would really depend on the kind of problem you have.

The setup for VMware Workspace ONE is good, e.g. there are no complexities, and they all have good discovery now. You plug them in, make sure the nodes are aligned on the network, then you can get to them. The setup process for VMware Workspace ONE and one of its competitors IBM, is very good. They've both done a very good job of it.

I was able to evaluate HCL (BigFix), Microsoft, Blackberry, and Ivanti.

AirWatch evolved into VMware Workspace ONE, so it's the same product. AirWatch was more of a competitor of mobile device management and security, so they weren't as good in patching and fixing.

There's another type of solution now that we call unified endpoint management (UEM), and that's a whole new category. I actually have quadrants in that. I know that AirWatch, even when they were acquired by VMware, e.g. it's now VMware Workspace ONE, was still highly rated. HCL is still highly rated. Microsoft was also good. Ironically, another company that was very good for mobile device management and one of the security companies out there is BlackBerry. They're still alive.

I've worked on most of the UEM solutions, including VMware Workspace ONE. For Blackberry, we haven't touched that lately. We have touched BigFix. I do have customers that are still running BlackBerry Spark®. I know even Google is trying to get in the game. Ivanti is also another UEM solution we've been dealing with. There are a number of different ones, e.g. even IBM has moved their MaaS360® platform to try to do unified endpoint management now.

The advice I'd like to give to others looking into implementing VMware Workspace ONE, is for them not to have any qualms about implementing it. Things are quick to set up, even if our team does some very hardcore security things, e.g. identity and access management, all kinds of threat landscape stuff, attack surface monitoring and modeling, etc. VMware Workspace ONE is one of the easier technologies that can be implemented for what we do, so I'm recommending it to others.

In terms of rating VMware Workspace ONE, there are a lot of "mini-categories", so they don't do some of the things I was talking about, or they're just newer into it. If I look at unified endpoint management, e.g. mobile, desktop, and everything combined, I would probably put BigFix high up there. For mobile, I would put VMware Workspace ONE high up there along with some others. Some of the SaaS ones, e.g. Tanium, do a good job, too. BlackBerry actually does a really good job with unified endpoint management, too. They just don't have billions of their devices out there, but in terms of managing their own devices, they were really the best in the early days, with a very secure platform.

HCL for UEM could be rated the best. For mobile, VMware Workspace ONE would rate the best, because they were really focused on that from the very beginning. They led the way, even if in that space you'll see 500 competitors, with people jumping up and jumping down, and constantly moving. VMware Workspace ONE in the mobile space has been very sustained in terms of how they've been rated and how they've grown over time. They owned the market with four or five of these solutions, and they were able to maintain the lead.

I could rate VMware Workspace ONE eight out of ten, but it would still depend on the use cases. BigFix is better for unified endpoint management, the ability to patch all assets, etc. VMware, on the other hand, is more focused on mobile. VMware being an infrastructure company and everybody inexpensively spinning up VMs all over the place: they've tried to pull that side a little more toward the infrastructure side, desktops, and PCs, and even on the networks, but both of them have grown tremendously.

In the last two or three years, for obvious reasons, with all the resiliency planning we do now for mobile workforces, it's really important for them to develop new capabilities, which I think they have, but this has been really good for their development. They've seen everything at this point.

We were attempting to safeguard corporate data as it leaves our walls. We already have encrypted laptop hard drives, so we were trying to extend that to cell phones for One Drive, Outlook, and One Note. All that is corporate data. And if you lose your cell phone or somebody steals it or you dump it in the toilet or any number of things that could happen to your cell phone, we want to be able to block access, delete the corporate data, do all those things that good security people are supposed to do.

In terms of valuable features, we liked the lock feature, the roll-out white feature, and the find feature. I think that Sophos had a GPS locator, so you could figure out where the phone was from a GPS location.

In terms of what could be improved, the initial configuration and setup of the environment could probably be made a little bit easier. There are so many pieces that go into it. Intune is absolutely insane and Sophos is better, but it still is a bit complex to get it all set up correctly because you need to have certain certificates for Apple in order for you to connect to their device. And then you've got to have policies for this and rules for that and it is very complicated. We eventually get there, but their wizards just keep asking you questions, "Well, I don't know what that is." It's like, "Why do I need that?" Or "Where does that come from?" It's just so much.

I would like to have seen them, like several other packages I've seen, give you a set of basic rules and policies that most people use, so that in 10 minutes I could have the environment set up and have basic protection.

For most of the mobile device management, you pop the box and you've got to figure out what your policy is going to be, what your rules are going to be, and what software are you going to use. Are you going to do the full phone or a container? You've got to go figure out all these things because nobody tells you anything. My experience is that even after reading manuals and trying to figure out what pieces of data go where, or checking the support website, then you go look at the wizard or the interface, and it's different. They described things differently. There's a piece of data that you need that's required that the documentation doesn't say that is supposed to go in there. And it just drives me insane when the documentation doesn't exactly match what I'm looking at on the screen.

We have been using Sophos Mobile for the last 12 months.

I called their technical support on occasion, but calling tech support is like pulling teeth or having a root canal. It's painful because you have to go through level one and you explain in excruciating detail exactly what your problem is. And then they write it all down and they give you a support case number. And then they have to pass it on to level two. Who knows what their technical acumen is, because level one can't fix the problem. Then they have to pass it on to level two. And it's not, "Hold the phone a minute and I'll go get this person for you." It's hang up and they'll call you when they get to you.

It's absolutely terrible. Like I said, I've been in the business for a long time so I do not call tech support until I'm really, really stuck or it's really, really broken. And it's offensive to me to have to go through a level one and answer juvenile questions of stuff I've already done and not even be able to speak to a level two or an actual engineer about fixing my problem. I could get it fixed in five minutes if they just let me have a phone call.

The initial implementation was done by me and I'll tell you why. It's money. Budgets are extremely tight right now, especially with this COVID stuff that's been going on. I don't have the luxury of a budget to spend a thousand dollars on a consultant to come in and do stuff that I have the technical capability to do. So if I spend money on a license, I've got to be able to handle the configuration. Plain and simple.

On a scale of one to ten, I would rate Sophos Mobile a four.

They need to make it easier.

I've been in this industry for 30 years, so I'm not stupid by any manner of means. But like most IT personnel, I've got more on my plate than I can shake a stick at. I don't have time to spend the three or four days to read volumes of support articles and figure out configurations and then mess with the GUI and screw it up and have to figure out how to fix it and how to push out rules that I really need. I don't have time to do all that. So the easier they can make an out of the box solution, the better. I suppose I could delegate it to somebody, but they are busier than I am. So it's the same situation.

Microsoft Endpoint Manager is simply a desktop, a laptop, a smartphone, or a tablet. An endpoint is exactly what it sounds like. Microsoft, on the other hand, makes use of that tool.

Endpoint allows you to deploy the operating system level. It enables the packaging and deployment of applications. It enables you to secure systems with BitLocker and incorporate things with Active Directory.

We are a consulting firm.

Our clients use it to simplify desktop builds and to maintain the patch management on their servers and desktops, as well as to have an easy mechanism for both rolling out BitLocker, which is a Microsoft tool and publishing new updates for their various software packages.

Microsoft is investing significantly more in the cloud. For our use and our clients' use, and again, our clients who use Endpoint number over 500, with an increase of 1,000 users. It is effective. It significantly reduces the overhead associated with providing support. It actually works quite well.

The installation could be improved to be simplified.

I have been working with Microsoft Endpoint Manager for the last 12 months.

We are Microsoft partners. 

We have been working for well over a decade with SCCM, and now with Microsoft Endpoint Manager.

They are deployed both on the cloud, and on-premises.

Microsoft Endpoint Manager is quite stable.

Microsoft's cloud has a capacity of 100,000 users. Depending on what you are dealing with, it's highly scalable, depending on how and where you deploy it.

It's from Microsoft. However, we are a Microsoft Premier partner. As a result, we are quite familiar with the product. Again, there isn't much of a need for it. However, our clients call us if they run into problems, which happens very rarely.

You do not have to maintain the Microsoft Endpoint that is built into their cloud, it's a cloud-based service. Locally, there is now maintenance every 16 months if you are deploying the local endpoint or creating a hybrid to Microsoft's cloud. You have to upgrade if you are deploying the local deployment. The current build changes every 16 months, but the upgrade is a very low skill set, you don't need anyone to upgrade it.

SCCM is no longer known as SCCM. It's known as Endpoint. Microsoft no longer recognizes that product. Endpoint refers to both the local and cloud-based installations. And, prior to their acquisition by Dell, we were a long-term partner with Quest. We've had clients use Quest products, but we haven't.

According to Microsoft, SCCM is no longer in use. Microsoft Endpoint is the new name for the current build. You can now deploy an Endpoint structure locally or pull Endpoint from Azure.

SCCM is no longer active.

I have worked with both Microsoft Endpoint Manager as well as Quest in the last 12 months. We have clients running the Quest Software.

The most recent Quest software we've seen is the Exchange PTS, or mail migration tool. That is probably the tool that we've had clients deal with twice. However, that is apples to oranges in comparison to SCCM.

It is the mail migration utility. According to my understanding, Quest recently sold that to a different company. So it's an old Quest product.

The initial setup is complex.

You have to appreciate two points with Microsoft Endpoint Manager. Microsoft Endpoint is based in Microsoft's cloud, 365 Azure. And Microsoft has simplified it quite a bit. They also work well with Intune. Many of their services are complementary to the solution. Autopilot is being sent out. You can have a machine auto-built from a remote location, or you can order an Autopilot deployment from your HP, Dell, or Lenovo. They've simplified it considerably since the old days, but there is still a technical element. For those with a technical nature, it is quite simple. Anything is simple if you understand the product.

You should probably consider cloud deployment before local deployment because Microsoft has made significant investments in the cloud. The local deployment is still in place. Microsoft's cloud comes with a lot of extra features that are free of charge. Furthermore, if you deploy it locally, you must own SQL, whereas, in the cloud, SQL is not required.

I would rate Microsoft Endpoint Manager a nine out of ten.

We primarily use the solution for our organization's phones and iPads.

We use the solution for locking down the phone. If it gets lost or stolen, we deploy apps. We have an internal app that will be deployed. It's connected to Apple DEP VPP, and we do document deployments through it as well.

Maas360 uses distribution groups to deploy apps, which makes it a bit easier than, for example, Intune.

Overall, I haven't been happy with it.

Their licensing platform is absolutely awful. We've got locked out of our own account several times and that just has put a bad taste in my mouth. 

The initial setup is not exactly straightforward.

There have been some changes in its software. The portal, for example, has changed. One nuisance feature is that, when you login, you have to always press enter, which is annoying. With most sites, you just click on the login and you go. With this portal, you have to specifically hit enter.

The solution needs to offer live technical support. Right now, it's just a chat window and it's rather unhelpful.

I've been using this solution for about six years. It's been a while. We have some good experience with it.

The solution is scalable. A company shouldn't have any issues in that regard.

We use the solution on about 600 different devices across the organization. Everyone from sales and distribution to the president of the company uses it.

The only way you can get technical support is through a chat window. They weren't exactly friendly. I wouldn't say that we have been happy with technical support.

I wasn't aware of anything being used previously to this solution.

Anything you set up is going to be a bit challenging. However, this was not straightforward per se. It's not cut and dry. You have the rules and regulations on everything that you have to contend with.

I didn't handle the initial implementation. I took it over after the fact.

The initial setup was handled in-house. The company did not require the assistance of consultants or integrators.

We are charged on a monthly basis. It's my understanding that the pricing is the same as or similar to Intune. If we do switch over, the pricing will be pretty much the same.

With IBM, you had to have a certain type of license inside of Microsoft for it to work, however, I don't have too much detail on that.

We are also looking into Intune. The one thing I did notice with Maas360 versus Intune was that Maas360 uses distribution groups to deploy apps. Intune does not have that. With Intune, you have to use security groups. That's causing us a little headache that we've got to get around.

I'm getting my feet wet on it right now. I'm beginning to learn how to use it. We're in the POC stage.

We are a customer and end-user.

The solution is deployed onto the actual device itself.

I wouldn't recommend the solution. We're pretty much working to move off of it. We haven't been too happy with the solution in general. How it was described to us ultimately wasn't how it worked.

Overall, I would rate it at a six out of ten.