Enrolment, encryption, updates and application deployment through Intune, and new machines that configure themselves through Autopilot instead of being built by hand.
Device management is the difference between owning a laptop and controlling it. Enrolled devices can be checked, configured, updated and, when one goes missing, locked or wiped. Unenrolled devices are trusted on the strength of whoever set them up.
The question worth asking is not whether you want managed devices. It is what you would do tonight if a laptop with a signed in mailbox and a synced OneDrive folder did not come home.
Almost nobody arrives asking for Intune. They arrive with one of these.
And the honest answer to "can we wipe it" turned out to be no. This is the most common trigger and the most expensive lesson.
Asking whether devices are managed and encrypted. The technical controls behind those questions are covered on the controls insurers ask about.
And it is still syncing. That is the device half of former employee access.
Because every machine is built by hand, slightly differently, and the differences turn into support calls for the next two years.
How many devices, who owns them, what is already enrolled, and which are personal.
This is a business decision, not a technical one. Policy that fights how people work gets worked around.
Including at least one belonging to somebody who will tell you honestly if it is annoying.
Not everybody on the same afternoon.
Including where the encryption recovery keys live, which is the detail people wish they had written down.
Usually part of a bigger piece:
Handing somebody a laptop is not the same as managing it. Without enrolment you cannot confirm the disk is encrypted, cannot push an update, and cannot do anything at all if it is left in a taxi.
Whether that matters depends on what is on the laptop. For a business handling customer records or payment details, it usually matters more than the owner expects.
A new laptop arrives at the person, not at you. They sign in with their work account and the device configures itself: policies, applications, encryption, printers.
The alternative is somebody spending half a day setting it up by hand, differently each time, which is where the inconsistencies that cause support calls come from.
Yes, and this is usually the right answer. Company data on a personal phone can be contained so that work mail and files are protected and can be removed, without the business touching photos, messages or apps.
People are far more willing to accept that arrangement when it is explained properly, so it is worth explaining rather than announcing.
Both can be enrolled and managed. What differs is which controls are available on each, and that gap is worth knowing about before you promise a uniform policy to an auditor or an insurer.
We would rather tell you where the differences are than pretend the two are identical.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
MFA, access reviews, joiners and leavers, and devices that are managed rather than just handed out.
Licences, accounts, security settings and the day to day of running a tenant.
Tell us how many laptops and phones there are and who owns them. Not everything needs enrolling, and we will say which parts do not.