Managed IT for Fully Remote, Mac-First Teams

The day you find out you don't control your laptops

Most remote teams discover the gap when someone quits. The Mac is three states away, and it was set up on the employee's personal Apple Account. If Find My was on, Activation Lock means that even once the Mac is back and erased, nobody can set it up again without that person's password. Getting Apple to remove the lock takes the original proof of purchase and a support request.

Device management, with zero-touch enrollment through Apple Business Manager, closes that gap before it opens. So does watching sign-ins, because on a remote team the laptop and the login are the whole office.

Zero-touch enrollment through Apple Business Manager

Zero-touch means nobody in IT handles the laptop before the employee does. Here's how it works.

Macs you already own can join too. They're added to Apple Business Manager with Apple Configurator, which means erasing and setting them up again, and after that they enroll like new ones. For the first 30 days after a Mac is added this way, the user can remove it from management. For more on the setup, see our zero-touch Mac deployment guide.

What device management can and can't see

Good employees ask this first, and they deserve a straight answer. On a company-owned Mac, device management is a configuration tool, not a surveillance tool. It's also only one of the tools on a managed laptop, so the full picture is below.

Other tools on a managed laptop see more, and we'd rather you hear it from us:

• Monitoring agent. Reports the laptop's health and patch status and lets us run maintenance and fixes remotely.
• Remote support. Lets us see the screen to fix a problem during a support session.
• Managed detection and response. Watches for attacker behavior, like an unknown program making changes it shouldn't or a burst of files being encrypted, and flags it for a security analyst.
• DNS filtering. Sees which websites the laptop looks up, so it can block malicious ones.
• Your work account. Your employer, as the Google Workspace or Microsoft 365 admin, can access work email and files. That's true with or without us.

We use these tools to keep laptops working and to catch attackers, not to review anyone's work.

Personal devices are a separate conversation. People on their own hardware can be covered through their accounts, with 2-step verification and identity monitoring, instead of device management.

Sign-ins from more than one country

When part of your team works from another country, blocking foreign sign-ins isn't an option. Their normal is someone else's red flag.

So we monitor instead of block. Identity monitoring flags sign-ins that don't fit each person's pattern, like a login from a third country, or two sign-ins too far apart to travel between. 2-step verification is enforced on every account without text-message codes, which can be hijacked through a SIM swap and are unreliable across borders anyway. Staff who travel can tell us before they go, so a real login from an airport doesn't get treated like an attack.

Laptop lifecycle for staff you never meet

Onboarding checklist for a new remote hire

The same steps every time, whether the new hire is in Oakland or overseas.

For a printable version, see our onboarding checklist and offboarding checklist.

What it costs

Published prices, with the arithmetic shown. Every rate comes from our pricing page.

For more team sizes, including a 12-person office and a 9-person nonprofit, see what managed IT costs in Monterey County.

Related