Security doesn't start when an employee signs into their laptop for the first time.
It starts at the purchase order, and it isn't finished until the drive has been destroyed and the certificate is on file.
That span is longer than most companies treat it as, which is why endpoint security problems are usually operational problems wearing a technical costume. A company grows, purchasing gets decentralized, provisioning gets done by whoever is available, and nobody notices anything is wrong until an employee leaves without warning or an auditor asks how many laptops the company owns.
Standardization starts at the order
When we order Dell hardware for a client, we submit a form with the order that has Dell register those devices into the client's Autopilot tenant before they ship. The machines are known to the environment before they physically exist in anyone's hands.
That one step removes the most fragile part of endpoint deployment, which is the window between a laptop arriving and someone getting around to enrolling it. In that window a device is company property holding no policy, no encryption enforcement, and no management agent, and the length of that window is entirely determined by how busy the IT team is that week.
We are working on the same arrangement with our other hardware partners. It isn't live yet, which means for non-Dell purchases we still register hardware hashes on receipt. That works, and it depends on a person doing it correctly and promptly, which is exactly the kind of dependency worth engineering out.
What the employee actually experiences
A device ships to the employee's home or office. They open it, connect to wifi, and sign in with their company account.
From there, Intune applies the security baseline, disk encryption, endpoint protection, compliance policies, and the applications their role requires. No staging, no imaging, no shipping the laptop to an office first so a technician can set it up, and no checklist that a busy person might work through out of order.
The compliance value of this is specific. A SOC 2 assessment will ask you to demonstrate that security controls are applied consistently across managed systems. A deployment process where policy is enforced by the platform is something you can evidence by exporting configuration state. Setting devices up by hand and trying to be consistent is not evidencable, no matter how careful the technician was.
Conditional Access is what keeps the inventory honest
Intune is our source of truth for device inventory. The reason we can trust it is not that we are diligent about updating it. It's that we make enrollment a prerequisite for access.
Devices must be enrolled and compliant to reach company resources behind Entra ID. An unenrolled machine does not get to a mailbox, a SharePoint site, or a Teams channel. It is not a warning, and it is not a report someone reviews later.
That single control closes the gap that makes most asset inventories untrustworthy. The usual failure is silent: HR has 38 employees, the RMM shows 43 agents, the asset spreadsheet lists 51 machines, and nobody can explain the difference because devices entered the environment through several different doors over several years. When enrollment is enforced, a device that isn't in Intune isn't doing anything, so the drift never accumulates.
It also converts the whole problem into a support ticket, which is the most useful thing about it. Someone who cannot connect calls the help desk, and the answer is always visible: the device isn't enrolled, isn't compliant, or has fallen out of policy. We aren't hunting for unknown devices. We find out about them because the person holding one tells us.
Devices leave the environment in ways nobody plans for
Laptops get stolen out of vehicles. They get left in hotel rooms. Users damage them, usually by accident and usually at an inconvenient moment.
None of that is unusual, and a device lifecycle process that only accounts for orderly returns will fail the first time one of these happens. What matters is that the machine is enrolled, because that's what makes a remote wipe possible, and that the record shows who it was assigned to, so the conversation about what data was on it is a short one.
A laptop stolen from a car is an incident. A laptop stolen from a car that nobody can identify, assigned to a person nobody is certain about, holding data nobody can characterize, is a much longer and more expensive incident.
Retirement has two paths and both need a record
When a device comes back, the first decision is whether it has useful life left.
If it does, it gets wiped and returned to the pool for redeployment. Autopilot handles the reset, and the machine comes back up for its next user the same way it did for the first one.
If it doesn't, it goes to our electronics recycling partner for physical destruction. They issue a certificate of destruction, which we white label and provide to the client.
That certificate is the part worth understanding. A retired laptop sitting in a closet still contains cached credentials, local files, saved browser sessions, and authentication tokens. Until the drive is destroyed or verifiably wiped, it is a piece of your environment that nobody is monitoring, and surplus hardware accumulates in storage rooms because disposal is nobody's priority. The certificate is what turns "we got rid of it" into something you can hand to an auditor with a date and a serial number on it.
The reason this is a security control
Hardware lifecycle work is unglamorous and it produces no dashboard anyone wants to look at. It's also one of the clearer signals of whether an organization is running a real security program.
Companies that handle it well can tell you who has which device, what state it's in, and how it will leave. That means faster onboarding, cleaner offboarding, shorter incident response, and audits where the asset questions take ten minutes. Companies that handle it badly usually don't know they handle it badly, because the cost shows up all at once, during the week they can least afford it.
If your company has grown faster than its hardware processes, that gap is worth closing before something forces the issue.