Microsoft Intune alternatives and competitors

We have two main use cases of Desktop Central. The first is patching, because we want to keep our systems secure. We install Microsoft security updates using ManageEngine Desktop Central every month. The second case is to deploy applications. We want to install applications to the machines from a central location. Also, we want to give access to users so they can install whatever applications they need using the self-service portal option. When there is a common application used by many users, we publish it to the self-service portal so users can install it themselves instead of contacting local IT. Those are our two main use cases of ManageEngine, but we also use it for other tasks, such as remote connection. Our local IT uses two products: ManageEngine Desktop Central and TeamViewer. We use both to connect to the remote machines. 

We have the on-premise version, but we are looking to move forward to the cloud version once they start supporting data migration—at the moment, they don't support it. 

One of the benefits of Desktop Central is it made the provisioning process simpler because now we have a provisioning package. We have around 1,500 laptops at the moment and all these PCs were provisioned by a provisioning package. In the provisioning package, we have integrated every aspect of renaming, deploying applications, patching, etc., so we simply execute the provisioning package and as soon as it's executed, it will install the management agent. Once the agent is installed, it will take care of all the tasks, so we don't have to sit in front of the computer to prepare the machine. This really helps us to provision the PC quickly with our agent. 

Now, we are going to do a PC refresh. It's a big project for next year. We are going to replace all of our PCs—1,500 PCs—with a new one, for all the users, so we have big requirements for ManageEngine. ManageEngine does a lot of scripting work in the backend—including renaming the computer according to our conventions, distributing applications, patching—so when we prepare the machine, we want everything to be installed and ready to give to the user. We don't want to wait or take more time, so we've now combined ManageEngine with Microsoft's Autopilot and Intune to provision the PCs. PC provisioning is made easier with ManageEngine. 

Another benefit is we have the option to pilot updates with some machines before distributing them to production, and this can be completely automated. We don't have to create said task every time for testing and deployment, so once we scope it, it relieves the time we spend each month deploying patches. It regularly runs in our schedule with the reboot options. We give reboot notifications in a user-friendly manner to employees, with the option to postpone the reboot. This relieves the time that we spend with end users since it's user-friendly. 

One of the most valuable features is patching. They support third-party patching as well, so we don't have to use another product. They support both Microsoft and third-party updates, and this is one of the main functionalities that we use regularly. 

The software deployment feature is also valuable because, once in a while, we need to distribute applications, such as VCO, Office applications, etc. For example, when we prepare a PC for users. We use ManageEngine to perform lots of tasks. 

We also have the option to deploy scripts via ManageEngine. We use some scripts that are to be deployed during the machines' provisioning, to make sure our machines are renamed properly according to the naming conventions we want. For example, for the France region, we want FRP, France Paris, and then the serial number. We want to deploy some script that renames the PC after the machine is provisioned, and we also want to deploy background images, logon screen, logout screen, etc. So we deploy all these policies using ManageEngine.

ManageEngine could be improved by giving customers an option to perform certain actions proactively. Since I was a consultant, I worked on different products and some had advantages over ManageEngine. For example, proactive remediation—you want to proactively check something on the computers and run the script. In ManageEngine, you have the option to run the script, but Intune has the option to do so proactively. ManageEngine doesn't have this. You should have the option to act proactively, not just going ahead and fixing it once it's done. Proactive remediation should be a feature. 

Another thing is, with PC provisioning, they have to make it in a modern way. They have deployment, but it's a very outdated process right now. It's a modern workplace, so you have to provision a PC live, on the go—it's not that you create images and then distribute the image to the machines. Many customers are not using this and, in fact, we are not using it. We use a modern way of PC provisioning. So they have to concentrate on that more. 

There are small glitches, but it's not going to stop you from using the product. For example, when you open the configuration, you may not see the details, but if you refresh the page, you will see them. There are small glitches here and there that we can see. 

I began using this solution about a year ago. In the past, I implemented this solution for different customers, but now I am an end user.

This solution is very stable. It depends on the size of the company, though. For us, it's very stable because we don't have many machines. The overall count is 1,800 to 1,900 machines—our license is for 2,050, but we've currently only utilized 1,900. So our infrastructure is medium-sized, I would say. If you go for 10,000, 20,000, you might have some lagging in the performance, but I'm not sure. 

It doesn't really require much maintenance. You just keep it as you want and regularly do a cleanup of old applications—when you delete, you have a new version of the package, so you might want to clean up the old packages—and that's it. You have automatic cleanup functionalities in the product itself. For example, if you download an update for this month and, after three months, none of the machines require this patch anymore, it automatically cleans up. You have some settings to enable so that you don't have to manually work on the cleanup. 

This solution is very easy to scale. We are trying to create lots of virtual machines in Azure Virtual Desktop, so we might increase our machines by another 100 or 200. 

ManageEngine's support is one of the best, I would say. We have chat support, so I can immediately ping someone in support, from my end product console, and get assistance very quickly. If I have a question, I can ask them directly; if I have technical questions, I can ask them, and they will provide an answer right away. If I write an email, it will take three to four hours. Since I was a support engineer before, I don't normally raise questions, but when I do, I normally get quick replies. Because it's a one-to-one chat, you get immediate responses from the chat window. 

In the past, when I first joined this company, we were using WSUS to patch all of our machines, but we didn't have any control over what patches were installed. We didn't have a proper reporting aspect in WSUS—we could have, but it's very complicated. We'd have to connect the information using SQL Server and pull the information, and that's lots of querying. But with ManageEngine, it's explicit. You go and collect the reports as you want, such as the number of patches installed on a machine or how many machines got a particular update. We even have the option to uninstall patches once they're installed, so we can go back to the previous patch version of the application. 

Another drawback with WSUS is that you don't have the option to scale a reboot. With ManageEngine, we can give reboot notifications in a user-friendly manner to employees, with the option to postpone, and after a certain number of days, you can reboot forcefully. This relieves the time that we spend with end users, who now get a pop-up. You don't have many options with WSUS, but with ManageEngine, you do. 

The deployment process is very easy. It's a combined product, so when you install the Desktop Central EXE, you install the database on the same machine, as well as the web server components like Apache Tomcat and Observer. Basically, when you install the EXE, you just click "next," "next," "next," and then it's done. It's not a big deployment. In terms of planning, you might need a little bit of time, but that's it. It's a half-day or one-day task, not like SCCM where you have to spend a lot of effort and there are lots of technical guides, technical architectural documents, etc. So it's very user-friendly in terms of deployment, I would say. 

The number of people involved in deployment depends on the size of the company. As I was a consultant before, I worked with two people, sometimes with one to six people. So it depends on the company. For example, in our company, we have only two people who manage the platform. To be honest, I cannot say that only one person can install this solution. 

For us, the deployment took two to three days, but it's not a continuous three days. We installed the server component and we installed the distribution server component after two days. So on the whole, we would've spent two to three days, maximum. 

We implemented through an in-house team. 

The pricing is very low, compared to other products. Compared to Intune or SCCM, it's much less. I can say it's a good product for less of a price. 

Intune doesn't really have a price, at the moment, because they integrated Intune with another license for Microsoft. If you purchase M365, you get the license. They've made everything a combo now, so obviously any company will go for M365, which includes everything. That's what our company has, and we don't pay anything extra for it. If you split the money, it would be much less than Desktop Central, so you can't technically compare the two. 

ManageEngine's licensing is not as good. They add new features and they ask for money. For example, they introduced Browser Security, which is an extra add-on. Compared to Intune, you just buy the Intune product and that's it, you have everything in place—browser security, endpoint management, etc. Everything's included with the Intune license, which isn't the case with ManageEngine. That's something they really need to take care of. 

We also use Intune, which offers many functionalities since it's integrated with Office 365. In terms of the experience, it's very light, but since ManageEngine is a completely different product, you have to integrate a lot of things. For example, installing the ManageEngine agent to all the machines if you want to onboard them. In comparison, with Intune, normally when you prepare the machine, it's automatically included, so onboarding is easy. 

Also, since Intune is a cloud service, you don't need to manage any infrastructure and you don't need a server to host the solution. With Desktop Central, you need a server, and that server should be managed by someone else as well, like a GDC team, a server team. 

Both solutions have advantages and disadvantages. For example, creating packages in ManageEngine is easier than Intune. In Intune, you have to create a package and convert it to a package format supported by Intune. In ManageEngine, you can create EXE or MSI—both are supported—and you just upload and create the package. 

ManageEngine Desktop Central is a product that's worth the money. It's easy to install and quicker in action. If you start installing the product today, in a small environment, you will be able to deploy the application in two hours. 

I rate ManageEngine a seven out of ten. They have a lot of improvements to make. 

We were attempting to safeguard corporate data as it leaves our walls. We already have encrypted laptop hard drives, so we were trying to extend that to cell phones for One Drive, Outlook, and One Note. All that is corporate data. And if you lose your cell phone or somebody steals it or you dump it in the toilet or any number of things that could happen to your cell phone, we want to be able to block access, delete the corporate data, do all those things that good security people are supposed to do.

In terms of valuable features, we liked the lock feature, the roll-out white feature, and the find feature. I think that Sophos had a GPS locator, so you could figure out where the phone was from a GPS location.

In terms of what could be improved, the initial configuration and setup of the environment could probably be made a little bit easier. There are so many pieces that go into it. Intune is absolutely insane and Sophos is better, but it still is a bit complex to get it all set up correctly because you need to have certain certificates for Apple in order for you to connect to their device. And then you've got to have policies for this and rules for that and it is very complicated. We eventually get there, but their wizards just keep asking you questions, "Well, I don't know what that is." It's like, "Why do I need that?" Or "Where does that come from?" It's just so much.

I would like to have seen them, like several other packages I've seen, give you a set of basic rules and policies that most people use, so that in 10 minutes I could have the environment set up and have basic protection.

For most of the mobile device management, you pop the box and you've got to figure out what your policy is going to be, what your rules are going to be, and what software are you going to use. Are you going to do the full phone or a container? You've got to go figure out all these things because nobody tells you anything. My experience is that even after reading manuals and trying to figure out what pieces of data go where, or checking the support website, then you go look at the wizard or the interface, and it's different. They described things differently. There's a piece of data that you need that's required that the documentation doesn't say that is supposed to go in there. And it just drives me insane when the documentation doesn't exactly match what I'm looking at on the screen.

We have been using Sophos Mobile for the last 12 months.

I called their technical support on occasion, but calling tech support is like pulling teeth or having a root canal. It's painful because you have to go through level one and you explain in excruciating detail exactly what your problem is. And then they write it all down and they give you a support case number. And then they have to pass it on to level two. Who knows what their technical acumen is, because level one can't fix the problem. Then they have to pass it on to level two. And it's not, "Hold the phone a minute and I'll go get this person for you." It's hang up and they'll call you when they get to you.

It's absolutely terrible. Like I said, I've been in the business for a long time so I do not call tech support until I'm really, really stuck or it's really, really broken. And it's offensive to me to have to go through a level one and answer juvenile questions of stuff I've already done and not even be able to speak to a level two or an actual engineer about fixing my problem. I could get it fixed in five minutes if they just let me have a phone call.

The initial implementation was done by me and I'll tell you why. It's money. Budgets are extremely tight right now, especially with this COVID stuff that's been going on. I don't have the luxury of a budget to spend a thousand dollars on a consultant to come in and do stuff that I have the technical capability to do. So if I spend money on a license, I've got to be able to handle the configuration. Plain and simple.

On a scale of one to ten, I would rate Sophos Mobile a four.

They need to make it easier.

I've been in this industry for 30 years, so I'm not stupid by any manner of means. But like most IT personnel, I've got more on my plate than I can shake a stick at. I don't have time to spend the three or four days to read volumes of support articles and figure out configurations and then mess with the GUI and screw it up and have to figure out how to fix it and how to push out rules that I really need. I don't have time to do all that. So the easier they can make an out of the box solution, the better. I suppose I could delegate it to somebody, but they are busier than I am. So it's the same situation.

Microsoft Endpoint Manager is simply a desktop, a laptop, a smartphone, or a tablet. An endpoint is exactly what it sounds like. Microsoft, on the other hand, makes use of that tool.

Endpoint allows you to deploy the operating system level. It enables the packaging and deployment of applications. It enables you to secure systems with BitLocker and incorporate things with Active Directory.

We are a consulting firm.

Our clients use it to simplify desktop builds and to maintain the patch management on their servers and desktops, as well as to have an easy mechanism for both rolling out BitLocker, which is a Microsoft tool and publishing new updates for their various software packages.

Microsoft is investing significantly more in the cloud. For our use and our clients' use, and again, our clients who use Endpoint number over 500, with an increase of 1,000 users. It is effective. It significantly reduces the overhead associated with providing support. It actually works quite well.

The installation could be improved to be simplified.

I have been working with Microsoft Endpoint Manager for the last 12 months.

We are Microsoft partners. 

We have been working for well over a decade with SCCM, and now with Microsoft Endpoint Manager.

They are deployed both on the cloud, and on-premises.

Microsoft Endpoint Manager is quite stable.

Microsoft's cloud has a capacity of 100,000 users. Depending on what you are dealing with, it's highly scalable, depending on how and where you deploy it.

It's from Microsoft. However, we are a Microsoft Premier partner. As a result, we are quite familiar with the product. Again, there isn't much of a need for it. However, our clients call us if they run into problems, which happens very rarely.

You do not have to maintain the Microsoft Endpoint that is built into their cloud, it's a cloud-based service. Locally, there is now maintenance every 16 months if you are deploying the local endpoint or creating a hybrid to Microsoft's cloud. You have to upgrade if you are deploying the local deployment. The current build changes every 16 months, but the upgrade is a very low skill set, you don't need anyone to upgrade it.

SCCM is no longer known as SCCM. It's known as Endpoint. Microsoft no longer recognizes that product. Endpoint refers to both the local and cloud-based installations. And, prior to their acquisition by Dell, we were a long-term partner with Quest. We've had clients use Quest products, but we haven't.

According to Microsoft, SCCM is no longer in use. Microsoft Endpoint is the new name for the current build. You can now deploy an Endpoint structure locally or pull Endpoint from Azure.

SCCM is no longer active.

I have worked with both Microsoft Endpoint Manager as well as Quest in the last 12 months. We have clients running the Quest Software.

The most recent Quest software we've seen is the Exchange PTS, or mail migration tool. That is probably the tool that we've had clients deal with twice. However, that is apples to oranges in comparison to SCCM.

It is the mail migration utility. According to my understanding, Quest recently sold that to a different company. So it's an old Quest product.

The initial setup is complex.

You have to appreciate two points with Microsoft Endpoint Manager. Microsoft Endpoint is based in Microsoft's cloud, 365 Azure. And Microsoft has simplified it quite a bit. They also work well with Intune. Many of their services are complementary to the solution. Autopilot is being sent out. You can have a machine auto-built from a remote location, or you can order an Autopilot deployment from your HP, Dell, or Lenovo. They've simplified it considerably since the old days, but there is still a technical element. For those with a technical nature, it is quite simple. Anything is simple if you understand the product.

You should probably consider cloud deployment before local deployment because Microsoft has made significant investments in the cloud. The local deployment is still in place. Microsoft's cloud comes with a lot of extra features that are free of charge. Furthermore, if you deploy it locally, you must own SQL, whereas, in the cloud, SQL is not required.

I would rate Microsoft Endpoint Manager a nine out of ten.

Workspace ONE has a pretty broad range of features and capabilities. It's like a market-wide buffet that hasn't yet spread out. However, when compared to its competitors, such as Microsoft Intune, Intune is behind the game, but it has been catching up in terms of the capabilities and features that it now has to offer.

The Identity component of this solution is its most valuable feature.

VMware provides a wide range of services that are second to none.

They need a more flexible pricing model.

I have been working with VMware Workspace ONE for four years.

In terms of stability, I would say VMware Workspace ONE is fairly stable, but not every OEM vendor in the world can provide products that are error-free. When it comes to fixing errors, I believe VMware is on the right track. The problems aren't bothering the customers.

There are some errors but nothing that is of concern and it gets corrected quickly.

When compared to its competitors such as Microsoft, VMware is a much more scalable product, in my opinion.

When it comes to their SaaS offering, I would say the product is a little more flexible and scalable.

In terms of support, I would say it is adequate. When compared to Microsoft, I would say VMware support is excellent. However, there are times when you need to escalate certain issues in order to gain traction. And if you're not getting anywhere with your support cases, you may need to escalate internally.

Previously, I worked with Microsoft Intune.

Microsoft's licensing is more flexible and adaptive, in my opinion. In Microsoft, you pay for whatever you use. In terms of services, it is more evenly distributed. You only need to pay for one license to get access to a suite of products. From your office to your endpoint, you are essentially managing your endpoint. Everything is combined into a single console. somewhat more flexible on the Microsoft side, which is lacking on the VMware side.

In terms of features, I believe VMware has struck the right chord. However, there are some features in Microsoft that are lacking. I'm confident that Microsoft will try to catch up over time, and it will be there, within the next year or two.

I would say it was a straightforward process because if you are a potential lead for the product, the relevant stakeholders, such as the sales team, take action and then convert it. They perform POCs.

I would say that at the very least the pricing needs to be revised. Workspace ONE is on the higher end of the pricing band when compared to other players in the market.

Pricing may need to be subsidized.

The price is reasonable given the features that Workspace ONE provides. 

Not every company or every organization in the world can afford the VMware Workspace ONE just for the features. Some companies might be using some of the features, and they will have to pay for the rest of the features, even if they are not utilizing them.

I am not currently affiliated with any company, such as a solution provider, an MSP, or a product company that sells this product. I'm now more interested in DevOps.

I haven't been in touch with MDM technology in about six to eight months. We were gold-certified partners with VMware, as well as Microsoft.

I was a partner selling services and developing solutions for their customers.

I would advise them to first prioritize what they want to achieve. Rather than wandering aimlessly through the market in search of a specific product. First, they must understand or, more likely, articulate their use cases. And then, based on the pricing model, decide whether they want a lot more features so that they can use the services later on, rather than just going with whatever players are available in the market.

Make certain that it is the solution you require.

I would rate VMware Workspace ONE an eight out of ten.

We primarily use the solution for our organization's phones and iPads.

We use the solution for locking down the phone. If it gets lost or stolen, we deploy apps. We have an internal app that will be deployed. It's connected to Apple DEP VPP, and we do document deployments through it as well.

Maas360 uses distribution groups to deploy apps, which makes it a bit easier than, for example, Intune.

Overall, I haven't been happy with it.

Their licensing platform is absolutely awful. We've got locked out of our own account several times and that just has put a bad taste in my mouth. 

The initial setup is not exactly straightforward.

There have been some changes in its software. The portal, for example, has changed. One nuisance feature is that, when you login, you have to always press enter, which is annoying. With most sites, you just click on the login and you go. With this portal, you have to specifically hit enter.

The solution needs to offer live technical support. Right now, it's just a chat window and it's rather unhelpful.

I've been using this solution for about six years. It's been a while. We have some good experience with it.

The solution is scalable. A company shouldn't have any issues in that regard.

We use the solution on about 600 different devices across the organization. Everyone from sales and distribution to the president of the company uses it.

The only way you can get technical support is through a chat window. They weren't exactly friendly. I wouldn't say that we have been happy with technical support.

I wasn't aware of anything being used previously to this solution.

Anything you set up is going to be a bit challenging. However, this was not straightforward per se. It's not cut and dry. You have the rules and regulations on everything that you have to contend with.

I didn't handle the initial implementation. I took it over after the fact.

The initial setup was handled in-house. The company did not require the assistance of consultants or integrators.

We are charged on a monthly basis. It's my understanding that the pricing is the same as or similar to Intune. If we do switch over, the pricing will be pretty much the same.

With IBM, you had to have a certain type of license inside of Microsoft for it to work, however, I don't have too much detail on that.

We are also looking into Intune. The one thing I did notice with Maas360 versus Intune was that Maas360 uses distribution groups to deploy apps. Intune does not have that. With Intune, you have to use security groups. That's causing us a little headache that we've got to get around.

I'm getting my feet wet on it right now. I'm beginning to learn how to use it. We're in the POC stage.

We are a customer and end-user.

The solution is deployed onto the actual device itself.

I wouldn't recommend the solution. We're pretty much working to move off of it. We haven't been too happy with the solution in general. How it was described to us ultimately wasn't how it worked.

Overall, I would rate it at a six out of ten.