Endpoint management

Endpoints are the most exposed and least controlled part of the estate: they leave the building, run arbitrary software, and are operated by people whose job is not IT.

Enrollment is the control point

A device that never enrolled is a device with no patching, no encryption guarantee, and no remote wipe. Enrollment must be a precondition of access to company data, not a request made afterwards.

Automate it from procurement so a device is enrolled before the user opens it. Manual enrollment as a post-delivery step is skipped exactly when the desk is busy.

Handle personal devices as a deliberate policy decision, not an accident. If personal devices reach company data, either manage the work container or restrict what they can reach — and be explicit with people about what the organization can and cannot see on their own hardware, because ambiguity there destroys trust quickly.

A small number of standard builds

Every additional build variant multiplies testing, support and failure modes. Converge on few, and handle exceptions by adding software to a standard build rather than by creating a new one.

Enforce the security baseline through configuration policy rather than instruction: disk encryption on, screen lock, firewall, up-to-date agents. Anything relying on a user to configure it is configured on some devices.

Patch on a cadence with a deadline

Endpoints patch worse than servers because they are off, asleep, or the user keeps deferring. Allow deferral with a hard deadline and force after it, and communicate the deadline in advance — an unexpected forced reboot during a customer call is what teaches people to avoid management.

Report coverage as a percentage of the fleet, and specifically chase the long tail. The devices that never appear in patch reports are usually the interesting ones: traveling users, spares, and the machine in a cupboard still holding a domain account.

Lost, stolen, or leaving

Have the sequence ready in advance: lock, locate if possible, wipe, revoke credentials and sessions, and record what data was on it for legal-risk:privacy-and-data-protection to assess notification.

Encryption is what turns a lost laptop from an incident into paperwork. Verify enforcement continuously rather than trusting the policy is applied — the device where it silently failed is the one that gets left in a taxi.

Departures are coordinated with people:onboarding-and-offboarding, with asset return tracked against it-operations:it-asset-management.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Tooling

Windows: Microsoft Intune, Configuration Manager, Ivanti, and similar. Apple: Jamf Pro, Kandji, Mosyle, and similar. Cross-platform: NinjaOne, Automox, Addigy, and similar.

Endpoint protection: Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, and similar.

Pick for your fleet's majority and accept a second tool for the minority. One tool that half-manages both platforms costs more than two that each work.

Never

• Allow company data onto a device that never enrolled.
• Rely on users to apply security configuration.
• Allow indefinite patch deferral.
• Assume encryption is on without verifying it per device.