Endpoint and Device Management Services
Keep business devices controlled, supportable and visible.
Managed endpoint operations across agreed laptops, desktops and selected mobile devices, aligned to organisational policy and risk.
Based in Boksburg and supporting organisations across Gauteng: IT support in Johannesburg and IT support on the East Rand.
Discuss this managed service →Defined scope. Clear ownership. Visible service.
Managed endpoint operations across agreed laptops, desktops and selected mobile devices, aligned to organisational policy and risk. Namandla Consultants begins with discovery, agrees responsibilities and measures the service against operational outcomes.
What the service can cover.
Asset visibility
Maintain a dependable view of managed devices, ownership, status and lifecycle.
Configuration control
Apply approved configuration, security and operating standards consistently.
Health monitoring
Identify device health, capacity, protection and compliance issues before they become widespread.
User lifecycle
Support controlled onboarding, role changes, replacement and offboarding.
Remote support
Diagnose and resolve agreed endpoint issues through secure support processes.
Lifecycle planning
Identify ageing, unsupported or high-risk devices and plan replacement responsibly.
Controlled from onboarding to improvement.
What endpoint management covers
Five capabilities. Most organisations have the first and none of the rest.
Inventory
What devices exist, who has them, what is installed, what state they are in. Sounds trivial. In practice, asking an organisation how many laptops it owns and getting an accurate answer is unusual.
Configuration
Settings applied and enforced from a baseline rather than set by hand at build time and diverging thereafter. Encryption, firewall state, password policy, browser settings, local administrator membership.
Compliance
A defined standard for what a device must satisfy, evaluated continuously, with a consequence when it does not.
Application management
Deployment, updating and removal of software, without touching the device or asking the user to do it.
Lifecycle
Enrolment through to retirement, including wipe and reset. This is where most gaps sit, particularly at the retirement end.
The capability that turns it from inventory into a control
Compliance-based conditional access. Endpoint management on its own gives you a list and some settings. Connected to conditional access, it gives you a rule: a device that is not encrypted, not patched or not compliant cannot open corporate data, regardless of who is signed in.
That is the point of the exercise and it is the part most commonly not configured. Organisations enrol devices, generate an inventory and never connect the compliance state to an access decision, which leaves it as a reporting tool.
Modern deployment
Provisioning without imaging
Traditional deployment meant building a golden image and applying it. It goes out of date, it needs maintenance and it requires the device to be physically handled before the user gets it.
Modern provisioning uses the manufacturer’s factory image, registers the device to your tenant by hardware identity, and applies configuration and applications on first sign-in. Windows Autopilot, Apple Business Manager and Android Zero Touch all do this.
The practical difference is that a device can ship from the supplier directly to a user, who unboxes it, connects to the internet, signs in with their work account and receives a configured machine. That matters for remote staff, for multi-site organisations and for replacement turnaround.
Configuration baselines
Set once, enforced continuously and reported on when a device drifts.
Disk encryption enabled with the recovery key escrowed to the tenant. Local administrator rights removed from standard users, with a managed elevation path for the cases that genuinely need it. Firewall on. Endpoint protection enabled and reporting. Screen lock and password policy. Browser configuration including the settings that matter for security rather than for convenience.
Local administrator rights are worth a specific note. Removing them is the single highest-impact endpoint configuration change available in most environments and it is the one most often deferred, because it generates friction in the first month. The answer to the friction is a managed elevation mechanism rather than blanket rights, and the friction subsides once the genuine cases are catalogued.
Compliance policy
What a device must satisfy: encryption on, operating system at or above a minimum version, endpoint protection active and healthy, no jailbreak or root, firewall enabled and a check-in within a defined period.
Non-compliance triggers a defined consequence: notify the user with a grace period, then block access to corporate data through conditional access. The grace period matters. Blocking immediately on a policy first published generates a wave of tickets and undermines the whole programme.
BYOD
Personal devices need a different approach, because you have no right to wipe someone’s phone.
Application protection policies apply controls to corporate data inside corporate applications without managing the device: require a PIN to open the work app, prevent copy and paste from work to personal apps, block saving to personal storage, and wipe only the corporate data when the person leaves.
That is the correct model for personal devices. Full device enrolment on a personal phone is disproportionate, it creates POPIA questions about what the organisation can see, and it generates resistance you do not need.
The lifecycle gaps
Three specific points where endpoint management typically fails, all at the edges.
Enrolment of devices bought outside the process
A department buys three laptops directly. They never enrol, never appear in inventory and never receive policy. A purchasing control and a periodic reconciliation against network discovery catches this.
Devices that stop reporting
A device that has not checked in for thirty days is off, lost, reimaged or has had its agent removed. All four warrant a look and none of them generate an alert by default.
Retirement
The device comes back and gets put in a cupboard. It is still in inventory, still holding a licence, still trusted and still holding data. Retirement means wipe, remove from inventory, reclaim licence and record disposal. Where the device holds personal information, secure disposal is a POPIA matter rather than a housekeeping one.
What Namandla delivers
Assessment
Device inventory reconciliation, current enrolment and compliance position, licensing entitlement review.
Deployment
Intune or equivalent platform configuration, enrolment across Windows, macOS, iOS and Android, Autopilot and zero-touch provisioning setup.
Baseline design
Configuration profiles, compliance policies, update rings and their connection to conditional access.
Application management
Packaging, deployment, updating and removal, including third-party application updating.
BYOD
Application protection policies for personal devices, with the corporate and personal boundary documented.
Lifecycle process
Procurement to enrolment, onboarding, offboarding, wipe and retirement, with the reconciliation that keeps inventory honest.
Ongoing management under the managed services agreement, with compliance reporting and drift remediation.
Licensing note. Intune is included in Microsoft 365 Business Premium, E3 and E5. Most mid-market organisations we assess already hold it and have not deployed it. We use what you have before proposing anything additional.
Remote delivery nationally. Onsite in Gauteng for hardware work.
Common questions about Endpoint & Device Management
What is endpoint management?
Endpoint management covers inventory, configuration, compliance, application deployment and lifecycle across the devices your people use. It is how you know what exists, that it is configured correctly and that it stays that way.
The capability that makes it a security control rather than a reporting tool is compliance-based conditional access, where a device failing its compliance standard cannot reach corporate data. Enrolling devices and never connecting compliance to access is the most common half-finished implementation.
Do we need Intune if we already have antivirus?
They do different things. Antivirus is one control running on a device. Intune governs the device itself: configuration, compliance, applications and whether it is permitted to reach your data.
The specific capability antivirus cannot provide is blocking an unencrypted or unpatched device from opening corporate information regardless of who signs in. If you hold Microsoft 365 Business Premium, E3 or E5, Intune is already licensed, so the question is usually whether to deploy it rather than whether to buy it.
Can you manage Macs and mobile devices?
Yes. Windows, macOS, iOS and Android are all supported through a single platform, with configuration and compliance policies per platform.
Capability differs by platform, and macOS and mobile management is genuinely different from Windows rather than a subset of it. Apple device management in particular works best with Apple Business Manager for provisioning, which needs setting up with your reseller and is worth doing before scaling.
What about personal devices?
Personal devices get application protection policies rather than full enrolment. Those apply controls to corporate data inside corporate apps: PIN to open, no copy and paste to personal apps, no saving to personal storage and selective wipe of corporate data only.
Full enrolment of a personal phone is disproportionate and it raises reasonable POPIA questions about what the organisation can see on a device it does not own. The application protection model gives you the control you actually need over your data without taking control of someone’s phone.
Will removing local administrator rights cause problems?
It generates friction in the first month and then it subsides. It is the highest-impact endpoint configuration change available in most environments.
The answer to the friction is a managed elevation mechanism for the cases that genuinely need it, rather than leaving blanket rights in place. The genuine cases are fewer than expected and they get catalogued during the first few weeks. Deferring this indefinitely because of the anticipated friction is common and it leaves the largest available improvement on the table.
How do new laptops get set up?
Through zero-touch provisioning. The device is registered to your tenant by hardware identity at the supplier, ships directly to the user, and configures itself on first sign-in with the applications and settings from your baseline.
That removes imaging entirely and it means a replacement can go from order to a working machine on a user’s desk without passing through IT. For remote staff and multi-site organisations the difference is substantial. It needs setting up with your hardware supplier, which is a one-off exercise.
What happens when someone leaves?
Account disabled, sessions revoked, device wiped or reset, licence reclaimed and the record retired from inventory. For a personal device, corporate data is selectively wiped and personal data is untouched.
Offboarding executed on the day rather than at the next audit is one of the more reliable indicators of whether an environment is well run. Leaver accounts still active weeks later is the most common finding in an access review and it is entirely a process problem rather than a technical one.
How long does deployment take?
Four to eight weeks for a mid-market estate. Platform configuration and baseline design take about two weeks. Enrolment moves at the pace of user communication rather than technical capacity.
Existing devices need enrolling, which can be done remotely but needs the user to participate. Compliance policies should go out in report-only mode first and be enforced in stages, because publishing a blocking policy on day one locks people out and damages trust in the programme.
Does this work for remote staff?
It is where it works best. Devices are managed over the internet without needing a VPN or a connection to a corporate network, and provisioning ships direct to the user.
Traditional domain-based management assumed the device would be on the corporate network regularly, which for a substantial part of most workforces is no longer true. A device that has not been on the network for four months is unpatched and unmanaged under the old model and fully current under this one.
What reporting do we get?
Device inventory, compliance state by policy, patch and update status, encryption status, application deployment success and devices that have stopped reporting.
The last one is worth watching specifically. A device that has not checked in for thirty days is off, lost, reimaged or has had its management removed, and none of those generate an alert by default. Regular reconciliation between the management platform, the asset register and network discovery is what keeps the inventory honest.
When is full endpoint management more than you need?
On a small estate of ten to fifteen devices, all in one office, all managed by someone who knows every machine, the platform overhead can exceed what it returns.
What still helps at any size is disk encryption with escrowed recovery keys, automatic updates enabled and local administrator rights removed. Those three are available without a management platform and they cover a disproportionate share of realistic exposure. If that is where you sit, do those and revisit when the estate grows or the workforce spreads out.