# How to encrypt iOS and Android devices using MDM?

Last updated: July 24, 2026

Explains how to enable encryption on managed Android and iOS devices using MDM to protect corporate data. Android devices support 128-bit AES encryption by default and require a Profile with Restrictions enabled to enforce storage and SD card encryption. iOS devices are encrypted by default, but administrators can create a Profile with Restrictions to force encrypted backups. Once configured, profiles are saved, published, and distributed to devices or groups.

## Description

With more organizations moving to a mobile-first workforce, each and every mobile deivce contains a lot of confidential corporate date which needs to be secured from unauthorized access. Encryption is the most common way to secure the data present on the devices, whereby unauthorized usage of corporate data is restricted. You can use MDM to encrypt data as explained below:

## Steps

### Android

- [Android by default supports 128-bit AES(Advance Encryption Standard)](https://source.android.com/security/encryption/full-disk) with certain OEMs supporting key size higher than 128-bits. To enable this encryption using MDM:
- On the MDM server, click on **Device Mgmt** from the top menu and select **Profiles** from the left pane.
- Click on **Create Profile** and select **Android**. Provide a name for the profile. You can know more about profiles here.
- Select **[Restrictions](https://www.manageengine.com/mobile-device-management/help/profile_management/android/mdm_android_restrictions.html)** from the left menu. Ensure the options **Enforce Storage Encryption** and **Enforce SD Card Encryption** are set as **Yes**, with latter to be enabled in case you want the encryption to be extended to the data on the SD card.
- Once done, **save** and **publish** the profile. This profile can then be distributed to [devices](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) and/or [groups](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_groups.html).

### iOS

[iOS devices are encrypted by default](https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf). To ensure even the data backups are encrypted, follow the steps given below:

- On the MDM server, click on **Device Mgmt** from the top menu and select **Profiles** from the left pane.
- Click on **Create Profile** and select **iOS**. Provide a name for the profile. You can more about [profiles here](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_creating_profiles.html).
- Select **[Restrictions](https://www.manageengine.com/mobile-device-management/help/profile_management/android/mdm_android_restrictions.html)** from the left menu. Ensure the option **Force Encrypted Backup** is set as **Yes**, to extend the encryption to the data backup.
- Once done, **save** and **publish** the profile. This profile can then be distributed to [devices](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) and/or [groups](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_groups.html).

## Frequently asked questions

### Are my Android and iOS devices encrypted by default?

Android devices support 128-bit AES encryption by default, with some OEMs supporting higher key sizes; iOS devices are also encrypted by default.

### How do I enforce storage encryption on Android devices?

Create an Android profile, open Restrictions, and set Enforce Storage Encryption (and Enforce SD Card Encryption, if you also want SD card data encrypted) to Yes, then save, publish, and distribute the profile to devices or groups.

### How do I make sure iOS device backups are encrypted too?

Create an iOS profile, open Restrictions, and set Force Encrypted Backup to Yes, then save, publish, and distribute the profile to devices or groups.