The complete guide to unified device, app, and account management

Unified device, app, and account management means your MDM, identity provider, HR system, and service desk work from the same record of each person and each device, so a new hire, a broken laptop, or a departure gets handled once, in one place. Serval is the AI-native ITSM platform that does this on top of the tools you already run. It connects to Jamf, Microsoft Intune, and Iru (formerly Kandji), syncs their devices into a hardware assets database, and runs access requests, onboarding, and offboarding through approvals and workflows. Your MDM still enrolls and configures devices, and your identity provider still holds accounts. Serval is the service layer that connects them.

With Serval, an employee can ask about their laptop in Slack or Microsoft Teams and get an answer from the asset record your MDM keeps current, and the access request or device workflow that follows runs in the same conversation.

This guide is for IT leaders who run an MDM, an identity provider such as Okta or Microsoft Entra ID, and a help desk that can't see either one. It covers what UEM does and where it stops, how to set up the service layer step by step, and how ServiceNow, Jira Service Management, Freshservice, and ManageEngine connect to Intune and Jamf.

What does unified device, app, and account management mean?

It means one operating model for three things that usually live in separate tools: the devices people use, the apps on them, and the accounts that grant access. Unified endpoint management (UEM) covers the first two. ManageEngine defines UEM as managing and securing every endpoint, from phones and tablets to laptops, desktops, and IoT devices, from one place. Mobile device management (MDM) is the older, narrower term, and vendors use the two loosely: Jamf Pro, sold as Apple device management, provisions Macs as well as iPhones and iPads, and Microsoft Intune calls itself a cloud-based endpoint management service for devices and apps on Windows, macOS, iOS, Android, Linux, and more.

Accounts are the third piece. They usually sit in your identity provider, and the HR system decides when they should exist. Some device vendors now sell identity too: Iru adds single sign-on and SCIM account provisioning, and Jamf Connect creates Mac accounts from your cloud identity provider. Unified management ties all of them to the service desk where requests, approvals, and tickets happen.

Where does UEM stop and the service layer begin?

UEM manages the fleet: enrollment, configuration, patching, app deployment, and compliance policy. It isn't designed to run the work around the fleet: access requests and approvals, onboarding and offboarding that span HR, IT, and managers, laptop tickets, and the record of who approved which access and when.

Most teams fill that gap with separate tools: a ticketing system, an access request tool, an asset spreadsheet, and scripts for onboarding and offboarding. Those tools rarely share data. An offboarding has to be coordinated by hand across the MDM, the identity provider, the HR system, and the help desk. A laptop ticket arrives with no device history attached. An access review can't see the requests behind each grant.

The service layer is the platform that closes those gaps. It reads from the MDM and identity provider, holds the asset and access records, and runs the requests and workflows that change them.

What tools combine IT asset management with help desk and access management?

Serval combines all three in one platform. Serval databases hold hardware assets, software, and licenses, synced from your MDM, procurement tool, and identity provider. The help desk takes requests in Slack, Microsoft Teams, and the web. Access Management runs access requests with approvals, time limits, and automatic revocation. Because it's one platform, a ticket can list the assets it's about, and an access request runs through the same help desk conversation as a laptop question.

Ramp used this to move everyone off MacBook Airs. Serval used Ramp's MDM to find everyone still on one, asked each person what size laptop they wanted and where to ship it, and started the shipment of a box for returning the old one. Ramp's hardware vendor handled the physical shipping. The result: 600 laptops replaced and 150 hours saved.

The large ITSM suites also bundle asset management with the service desk. ServiceNow's ITSM Foundation package lists Asset Management and CMDB alongside incident and request management. ManageEngine ServiceDesk Plus combines IT service management, IT asset management, and a CMDB, and Ivanti sells an ITSM product alongside its UEM product. Freshservice and Jira Service Management both have asset modules that sync from MDMs, covered in the next section.

Which ITSM platforms integrate with Microsoft Intune and Jamf?

Serval connects to Jamf, to Microsoft Intune through its Microsoft Graph integration, and to Iru (formerly Kandji), and it has 140+ pre-built integrations in total, including other device management tools such as Mosyle. Each of the three has an installable ingestion workflow that pulls the device fleet into Serval's asset inventory.

For Jamf, installable workflows look up computers by user or serial number, find non-compliant or unresponsive devices, and send MDM commands such as device lock, erase, and OS update. The MDM command workflows ask whoever installs them to choose an approval procedure, and custom workflows can call any Jamf Pro or Classic API endpoint.

For Microsoft Intune, Serval reads Intune devices, policies, and apps. With the read/write permission preset, workflows can manage Intune and run privileged device actions such as wipe and retire.

For Iru, Serval has typed access to the Iru API, including device actions such as restart, lock, and erase, plus prebuilt workflows that flag devices with failing updates, overdue macOS updates, or no check-in today.

Freshservice's Intune app runs actions such as Lock and Wipe from the Asset Details page. In Serval, device actions run as published workflows that the help desk agent can start from an employee's own Slack or Teams request, with approval wherever your team requires it.

ServiceNow

ServiceNow's Microsoft Intune spoke manages devices and applications in Intune from a ServiceNow instance, with actions such as syncing or deleting a managed device. Its Jamf spoke manages Jamf users, mobile devices, groups, and computers. Both spokes require an Integration Hub subscription. The ITSM Foundation package also lists Service Graph Connectors for End-User Computers.

Jira Service Management

In Jira Service Management, Assets Data Manager has Jamf and InTune data sources that bring device data in over an API connection. Atlassian includes Data Manager in its Service Collection Premium and Enterprise plans.

Freshservice

Freshservice's Microsoft Intune app syncs Intune devices into its asset records, shows device health, and lets agents lock, reset the passcode on, or wipe a device from the Asset Details page. Its Jamf integration syncs device and user data from Jamf Pro.

ManageEngine

ManageEngine sells ServiceDesk Plus for service and asset management and Endpoint Central for unified endpoint management, which covers patching, software deployment, and mobile device management.

How to set up unified device, app, and account management

The steps below follow the order most IT teams use. Your MDM and identity provider keep their jobs throughout. Each step adds the service layer on top.

1. Build one inventory with a source of truth per field

Device data often lives in three places: the MDM, the procurement system, and a spreadsheet. The records conflict because nobody decided which system owns which field. Decide that first.

In Serval, the Hardware Assets database holds one record per device, keyed by asset tag, with assignment, lifecycle state (on order, in stock, in transit, in use, in maintenance, retired, or missing), device health from your MDM, and procurement and warranty fields. Ingestion fills it. Serial number joins an MDM device to its asset record, and when two sources map the same field you set which one wins, for example the MDM for OS version, the HR system for owner, and procurement for cost. Every field change is recorded with who or what made it and when.

2. Keep device and app policy in your MDM

Encryption, passcodes, minimum OS versions, app allow lists, and patch cadence belong in the MDM, defined once per role and operating system with documented exceptions. For personal devices, use app-level protection that manages company data without enrolling the whole phone, and tell employees what is and isn't monitored.

The service layer reads posture back. Serval's Hardware Assets device health fields hold MDM enrollment, last check-in, OS version, and whether disk encryption is on, and the help desk agent can answer an employee's questions about the health of their own device.

3. Run access through requests, policies, and reviews

Connect your identity provider so groups and app roles are visible, then decide how each role is granted. Device compliance can feed conditional access in your identity provider and MDM. The requests, approvals, and expirations belong in the service layer.

In Serval, access policies set the maximum access duration, the approvals, and whether a business justification is required. Access is granted through your identity provider's groups, a direct API connection, a custom workflow, or a manual task. When time-bound access expires, Serval removes it the same way it was granted. User access reviews certify that people still need what they have, and reclamations remove access people stopped using.

4. Automate onboarding and offboarding across HR, IT, and devices

Onboarding touches the HR system, the identity provider, the MDM, and every app a new hire needs. Offboarding touches the same systems in reverse, and a missed step there is a security gap.

Serval runs both as journeys: one process with tasks in order across HR, IT, the manager, and other teams, which can start from a webhook or a schedule, such as a new-hire feed from your HR system. Journey tasks trigger access requests and track them to completion, while the access itself runs through Access Management or workflows. Device steps run as workflows against your MDM, such as retiring a Jamf computer record or removing its MDM profile. Serval automates over 50% of Perplexity's IT requests and all employee onboarding, and at Cribl, offboarding is enforced consistently, with no missed steps.

5. Automate the device requests behind common tickets

Patch rollout and app updates stay in the MDM. What the service layer automates is the request side: "my laptop is slow," "I need a new monitor," "lock my lost phone."

In Serval, you describe a workflow in plain English, Catalyst writes the code, and you review and test the draft before you publish it. Published workflows run exactly as written each time. After the laptop swap, Ramp built a matrix of which department gets which laptop, so when someone requests a machine, Serval picks the model.

6. Measure and tune

Track the numbers that move when the system works: devices out of compliance, onboarding time to a working laptop and accounts, offboarding completion, access review completion, and unused licenses. Serval's Hardware Assets template comes with a pre-built analytics dashboard for the fleet. Review exceptions and stale records each quarter, since old exceptions and unused access are where drift starts.

What mistakes should you avoid?

• Conflicting device records. If the MDM, HR system, and asset tracker each keep their own, you have three views of conflicting data. Settle the source of truth per field before adding tools.
• Automating enrollment but leaving offboarding manual. Zero-touch enrollment gets the attention, but offboarding and access cleanup are where manual work and risk pile up.
• Rebuilding the audit trail after the fact. Approvals, grants, revocations, and device actions should be recorded as they happen.
• Reviewing devices but never access. Access that piles up over time is a risk UEM doesn't address. Review it on a regular schedule.

When should you choose Serval?

Choose Serval when your MDM and identity provider are in place but the work around them still runs through tickets someone resolves by hand: device questions, access requests, onboarding, and offboarding. Keep your MDM for enrollment, configuration, and patching, and your identity provider for sign-in. Serval connects them to one service desk.

FAQ

What is the difference between UEM and MDM?

MDM started as management for phones and tablets. UEM manages and secures every endpoint type, including laptops, desktops, and IoT devices, from one place. Vendors use the terms loosely, and many MDM products now manage laptops too. Neither one runs access requests, onboarding journeys, or tickets, which is the service layer's job.

What tools combine IT asset management with help desk and access management?

Serval combines a hardware and software asset database, an AI help desk in Slack and Microsoft Teams, and access management with approvals, time limits, and automatic revocation in one platform. ServiceNow lists Asset Management and CMDB in its ITSM Foundation package, and ManageEngine ServiceDesk Plus combines IT service management, IT asset management, and a CMDB.

Which ITSM platforms integrate with Microsoft Intune?

Serval connects to Intune through Microsoft Graph, syncs Intune devices into its asset inventory, and can run wipe and retire through workflows with the read/write preset. ServiceNow has a Microsoft Intune spoke that requires an Integration Hub subscription, Jira Service Management has an InTune data source in Assets Data Manager, and Freshservice has an Intune app with device actions such as Lock and Wipe.

What IT automation tools integrate with Jamf?

Serval's Jamf integration syncs computers into its asset inventory and includes installable workflows for device lookups, compliance checks, and MDM commands such as lock and erase, which prompt for an approval procedure at install. ServiceNow has a Jamf spoke, Jira Service Management has a Jamf data source, and Freshservice syncs device data from Jamf Pro.

How do you automate offboarding across devices, apps, and accounts?

Start the offboarding from the HR system, then run one process that revokes access through your identity provider and apps, retires or wipes the device in your MDM, and records every step. In Serval, an offboarding journey tracks those tasks across HR, IT, and the manager, and workflows run the device and account actions.