Endpoint management and mobile devices

Birchline's devices are as varied as its staff. Head office has about 260 Windows laptops. Each of the 40 stores has three shared Android tablets at the till and in the stock room, and each warehouse has 12 rugged Android scanners. About 70 store and warehouse managers want work mail on their own phones, a mix of Android and iPhone. In the ninth session Sofia and Owen decide how each kind of device will be managed, because context-aware access (lesson 3) and several alerts (lesson 7) depend on device information. This lesson covers Google endpoint management: basic and advanced mobile management, company-owned and personal devices, work profiles, computers and what to do when a device is lost.

Basic and advanced management

Google endpoint management is built into Workspace and configured under Devices in the Admin console. For phones and tablets it offers two levels, and Google's comparison page sets out what each includes.

Advanced management is not available on every edition: Google's help pages say it is not included in Business Starter, Business Standard, some Education and Essentials editions, or Cloud Identity Free. Birchline's Enterprise Standard and Frontline Standard licences include it, so the choice is about policy, not licences. Some features, such as device audit alerts and management rules, need particular editions, which Owen notes as things to confirm before relying on them.

Company-owned and personal devices

The most important distinction is ownership. On a company-owned device, Birchline can manage the whole device, restrict apps and wipe it completely. On a personal device, Birchline should manage only its own data and leave the rest alone. Android's work profile makes that separation real: work apps and data live in a separate, encrypted profile with a briefcase badge, and a wipe removes only the profile. On iPhones, advanced management manages work apps and their data in a similar spirit.

Policies for phones and tablets

Device policies are set per OU or group under Devices, Mobile and endpoints, Settings. Owen keeps them simple, because every requirement is something a person has to satisfy before they can read mail.

• Screen lock required on every device, with a minimum of six digits or a password on company-owned devices, and the device's own lock accepted on personal phones.
• Encryption required. Modern Android and iPhone devices encrypt by default once a screen lock is set, so this rarely causes trouble.
• Device approvals required for personal phones, so that a new phone cannot receive work mail until IT approves it. Approvals are quick for managers who registered their phone with the helpdesk.
• Compromised device blocking on, so that rooted or jailbroken devices lose access automatically.
• Inactive device wipe: company tablets that have not synced for 60 days have their account wiped, since an unsynced store tablet is probably lost.
• Apps on company devices limited to an approved list, managed through the Admin console's app settings for Android and iOS.

The shared tablets raise one more question: whose account signs in? A tablet used by eight people across shifts cannot be tied to one person's account. Birchline's plan is that each person signs in with their own Frontline account at the start of a shift and signs out at the end, with a short idle timeout, so that the logs show who did what. The tablets are company-owned and limited to the store's network, so a forgotten sign-out exposes less than it would on a personal phone, and Owen sets the web session length for the Stores OU to the length of a long shift.

Computers

For Windows and Mac computers, Workspace offers several pieces, and Google's help pages describe which editions include each. Endpoint Verification reports device details for context-aware access. Chrome browser management applies policies to Chrome, such as which extensions can be installed and whether people can sign in to personal Google accounts in the browser. Workspace also offers Windows device management on some editions, which can apply settings to Windows computers and wipe them, and the Google Credential Provider for Windows lets people sign in to Windows with their Workspace account; in July 2026 Google announced that it supports FIDO2 security keys as a second step for Windows sign-in. Birchline already manages its laptops with existing Windows tools, so Owen uses Workspace only for Endpoint Verification and Chrome browser management for now, and records Windows device management as a later option.

Lost and stolen devices

Devices go missing. A tablet disappears from a store after a break-in; a manager leaves a phone in a taxi. The response depends on ownership and urgency.

Speed matters most in the first hour. Owen adds a lost device line to the helpdesk script: block the device and sign out the user's sessions straight away, then decide on a wipe once the facts are known. Store managers get a short card for the stock room wall with the helpdesk number and the instruction to report a missing tablet before trying to find it.

Measuring compliance

Once devices are enrolled, the device list in the Admin console shows each device's status: compliant, not compliant and why, last sync, owner and type. Owen plans a weekly check and a simple measure for the baseline report.

devices = {
    # type: (enrolled, compliant)
    "Store tablets": (120, 117),
    "Warehouse scanners": (24, 24),
    "Managers' phones": (68, 61),
    "Head office laptops": (258, 249),
}
total = sum(e for e, c in devices.values())
ok = sum(c for e, c in devices.values())
for name, (e, c) in devices.items():
    print(f"{name:22} {c:>4} of {e:>4} compliant ({round(100 * c / e)} out of every 100)")
print(f"All devices: {ok} of {total} compliant ({round(100 * ok / total)} out of every 100)")
worst = min(devices, key=lambda k: devices[k][1] / devices[k][0])
print("Lowest rate:", worst)

Store tablets           117 of  120 compliant (98 out of every 100)
Warehouse scanners       24 of   24 compliant (100 out of every 100)
Managers' phones         61 of   68 compliant (90 out of every 100)
Head office laptops     249 of  258 compliant (97 out of every 100)
All devices: 451 of 470 compliant (96 out of every 100)
Lowest rate: Managers' phones

With these planning figures, about 96 out of every 100 devices would be compliant, and managers' personal phones would have the lowest rate. That is typical: personal phones fall behind on updates, and the fix is a friendly reminder rather than a block, unless a phone is so far behind that it stops receiving security updates altogether.

Enrolling 120 store tablets

Enrolling one tablet by hand takes a few minutes. Enrolling 120 across 40 stores by hand, with store managers following instructions over the phone, would take weeks and produce 120 slightly different tablets. Advanced management supports bulk enrollment for company-owned devices: Android devices bought through a partner that supports zero-touch enrollment can be registered to Birchline before they ship, and when a tablet is switched on and connected to the store network it enrolls itself and receives its policies. For devices that are already in the stores, enrollment with a token or QR code is the usual alternative.

Owen plans the store tablets in three groups of 40, in the weeks before the April store wave. Each group is unboxed and enrolled at the head office warehouse by two IT staff, checked against a short list (enrolled, compliant, correct OU, Workspace apps present, store network saved), labelled with the store name and the serial number, and shipped with the store's other April materials. The device list then shows 40 new compliant tablets for each group, which becomes part of the go-live check for each store.

Privacy on personal phones

Managers bringing their own phones need to know what Birchline can and cannot see. With a work profile, Birchline can see the device model, operating system version, whether it is encrypted and compromised, and the work apps it manages; it cannot see personal apps, photos, messages or browsing on the personal side. PIPEDA expects Birchline to explain this and to collect only what the purpose requires. Owen writes a one-page note for managers that says exactly that, includes a screenshot of what the device list shows for a sample phone, and explains that a wipe removes only the work profile.

The note also answers the question managers ask most: what happens to work mail if they decide to stop using their own phone. The answer is simple: they remove the work profile, or IT removes it remotely, and the rest of the phone is untouched. A manager who prefers not to use a personal phone at all can use the store tablet and a security key for sign-in, the same as floor staff.