Skip to content
IT Atlas

Endpoints · Endpoint Management

Endpoint Management

Enrolling, configuring, securing, monitoring and retiring the devices people use, at scale and without touching them physically.

IntermediateUpdated 2026-09-01

Overview

Modern endpoint management is cloud based and identity driven. A device enrols into a management service, receives configuration and security policy, reports compliance state, and that state feeds access decisions made by the identity provider.

This replaced imaging and domain join as the default model. Devices are provisioned from vendor supplied hardware identity, configured over the internet, and never need to touch a corporate network.

How it works

  1. 01Enrolment establishes device identity, usually backed by a hardware key store, and registers the device in the directory.
  2. 02Policies are delivered over MDM protocols and evaluated on a schedule; results are reported back as compliance state.
  3. 03Applications are deployed as required or available, with dependency and supersedence handling.
  4. 04Compliance state becomes an access signal, so a non compliant device can be denied access to corporate data without being wiped.

Sequence

Endpoint lifecycle
  1. 1Procure
  2. 2Enrol
  3. 3Configure
  4. 4Secure
  5. 5Monitor
  6. 6Maintain
  7. 7Retire

Each stage should have an owner, a system of record and an audit trail. Retirement is the stage most often neglected.

Layer model

Configuration
Baseline settingsCertificates and Wi-Fi profilesApplication deploymentUpdate ringsLocal administrator control
Security
Disk encryption with key escrowSecurity baselinesAttack surface reductionEDR onboardingFirewall policy
Assurance
Compliance policyInventory and hardware detailUpdate status reportingAccess enforcement via Conditional Access

Design considerations

  • Decide the ownership model per persona: corporate owned managed devices, corporate owned shared, and BYOD with application level protection only.
  • Use deployment rings for both OS and application updates.
  • Plan for macOS, iOS, Android and Linux explicitly rather than treating them as exceptions.
  • Define what happens when a device is lost, when an employee leaves, and when a device fails to check in for 30 days.

Security considerations

  • Remove standing local administrator rights and provide an elevation workflow instead.
  • Escrow disk encryption recovery keys and test recovery.
  • Require device compliance for access to corporate data, not merely report on it.
  • Monitor enrolment: unexpected new devices and repeated enrolment failures are meaningful signals.

Common misconfigurations

  • Compliance policies created but never referenced by access policy.
  • Devices in multiple management systems simultaneously, producing conflicting policy.
  • No retirement process, so leaver devices remain enrolled and trusted for months.
  • BYOD enrolled as fully managed, creating privacy problems and user resistance.

IT vs OT

Industrial workstations and HMIs frequently cannot accept modern MDM or aggressive update policy. They are managed as long lived, tightly controlled assets, see OT Atlas.

IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.