Unifying endpoint management for hybrid teams

The starting point

The fleet was split across Apple and Windows, and most machines had no management tooling at all. There was no MDM, no policy enforcement and no view of what was out in the field. A laptop could leave with its credentials intact and nobody would know.

The company was heading into acquisition due diligence, where unmanaged devices show up as a finding.

What we built

Machines were already with their users, so enrolment had to fit around people's days. We phased it by team and scheduled it outside core hours.

On Apple, new hardware goes through Apple Business Manager straight into Iru. Existing Macs were enrolled in MDM outside Apple Business Manager and move to the full lifecycle path as hardware is replaced. Nobody had a forced wipe.

On Windows, self-service guides walked people through capturing hardware hashes and registering their devices in Autopilot. From then on each device is Autopilot-ready, and the full wipe and reprovision happens for compliance reasons or at the next refresh. People kept working throughout.

Both platforms were tied to Okta for identity-based policy, which we deployed in a parallel identity engagement. SentinelOne was bought below list price and pushed to every managed endpoint at the end.

The result

Every device is managed, policy is enforced remotely, and the hardware lifecycle follows the business instead of interrupting it. Nobody lost a workday.

HITRUST for a smaller client

A separate company of about 50 people needed MDM for its fleet. We enrolled the machines, deployed endpoint protection and enforced baseline policies. When the company went through HITRUST certification, those controls gave the assessor the evidence it needed. Enrolment records, endpoint compliance reports and policy logs already existed, because that is how the devices were run day to day.

We provide the controls and the evidence. Certification decisions sit with the auditor.