A company may have Microsoft 365 accounts for everyone and still have no consistent way to manage the laptops those people use. One employee works on a company device, another uses a personal computer and a third signs in from a replacement laptop that nobody has documented.
Device management is about making that situation less unpredictable. You do not need to configure every possible policy on day one.
First, find out what is in use
List the devices that access company email and files, and identify their owners. Note the operating system, whether the device is company-owned and how it is protected. Include contractors and occasional users where they have access to sensitive information.
Next, look at the Microsoft 365 licences you actually have. Device management capabilities vary by licence, so check entitlements before planning a rollout around tools you may not have.
Choose a small baseline
For managed devices, start with controls that have a clear purpose:
- Require appropriate screen locking and sign-in protection.
- Use supported operating systems and a manageable update process.
- Enable device encryption where supported and keep recovery arrangements documented.
- Decide how a lost or stolen device will be handled.
- Keep local administrator access limited and justified.
Where Microsoft Intune or another management platform is available, use a pilot group before enforcing policies company-wide. A settings change that works on a new laptop may interrupt an older application or a shared workstation.
Treat personal devices differently
Bring-your-own-device arrangements create a different set of questions. Staff may reasonably object to giving an employer broad control over their personal phone. Consider whether protecting company applications and data, rather than managing the entire device, meets the business need.
Write a short policy explaining what the company can access, what it can remove and what happens when someone leaves. Transparency matters as much as technical configuration.
Don’t forget the exit process
Offboarding is often the weak point. When someone leaves, the team needs to know who disables access, collects equipment, transfers work files and checks for shared credentials or applications. A device management policy without an offboarding checklist is incomplete.
A manageable rollout
Start with five representative users: someone in the office, someone remote, a manager, a frequent traveller and a colleague who uses specialist software. Test sign-in, updates, access to everyday files and recovery from a locked device. Document what went wrong before widening the rollout.
A modest, well-tested baseline is more valuable than an ambitious set of rules that staff find ways around.
