Remote device management for IT teams: How to manage employee devices overseas

In an age of remote work, IT admins can’t always walk down an office hallway and manually get a new employee’s computer up and running. Companies today are spread across home offices that can span continents, leaving employers with the tall task of managing hundreds of disparate devices, each with niche configurations tailored to the individual employee. 

While the pandemic-induced work-from-home renaissance has opened up global hiring opportunities and given knowledge workers more autonomy, it’s also ushered in a new, logistical problem: the handling of employees’ equipment. How can you get a device out to a new hire overseas before they start work, keep it protected from cyberattacks, update it as their role changes, get it back once they leave — and then replicate the process across your global team ad infinitum? 

We’ll guide you along the path of least resistance to minimize any headaches and ensure you’re complying with international rules. 

Device lifecycle at a glance

Step #1: Understand your employees’ device needs

Employers are typically responsible for providing the equipment employees need to do their job. But there’s a bit of a gray area with remote team members working out of home offices. 

Companies don’t always have to provide laptops and other devices to new remote employees. Some businesses institute a bring your own device (BYOD) policy where remote employees supply their own computers. While using personal devices cuts costs, it can leave employers vulnerable to security risks. 

You should check the local requirements before deciding on your device policy, as different countries have different rules. In Chile, for example, employers generally need to provide the equipment required for remote work and cover related costs. Croatia similarly requires employers to provide necessary remote-work equipment, but also allows reimbursement arrangements when employees use their own devices. In the US, California has a similar reimbursement policy. Ireland, on the other hand, doesn’t mandate this, but gives remote employees tax write-offs for remote work expenses, which can include their phone bill and internet connection. 

Even if not required, it’s common for employers to provide work from home stipends for remote employees to offset the cost of home office supplies. And if your employee doesn’t have their own device and needs a work computer, you should provide one. 

Define a standard device build for each role

Instead of choosing equipment from scratch for every hire, document an approved device build for each major role or employee group. That standard can specify the device model, memory and storage, OS build, required software, security requirements and any other exceptions that need IT approval. For example, an engineering build might require a higher-spec laptop, developer tools, disk encryption and access to systems like GitHub or AWS. However, a sales build might use a lighter laptop with Salesforce, calling software and a headset. Location can also affect whether employees need different keyboards, power adapters or hardware availability.

Once those builds are documented, employee data (role, department and location) can automatically trigger workflows for any new hire. This also gives IT a consistent baseline to update as new software emerges or a company’s needs evolve, instead of trying to individually track devices and employees for sweeping changes.

Step #2: Buy and ship the devices

Your remote employees’ device needs depend on their role. A company cell phone (and headset) can work as a smart desk phone stand-in for salespeople to communicate with clients. It can also help social media managers oversee brand accounts, and can be given to entire teams — even coworkers across multiple time zones — to ensure consistency across the same operating system and easy access to collaboration apps. 

As an added bonus, you could also invest in ergonomic work equipment to lessen the chance of any neck, back, and shoulder injuries, like an external keyboard and mouse. Some jurisdictions have ergonomic requirements that influence the kind of equipment you should buy. According to the UK’s Health and Safety regulations, employers need to conduct a Display Screen Equipment (DSE) assessment for remote and in-person employees to ensure their workspaces have tilted keyboards and adjustable monitors (as well as an ergonomic chair and other office furniture that helps prevent musculoskeletal injury).  

All the variability between regional requirements and needs for different jobs can make it difficult to choose and ship devices — especially at scale, when you want to manage all of them. However, it’s important to ensure your remote employees have the devices they need ahead of their start date or promotion. Therefore, it’s a good idea to look for a solution that allows hiring managers to quickly purchase and ship devices as part of the onboarding process.

Register, enroll and check devices before shipping

Record every device in an asset register before shipping to make tracking its lifecycle easier; that way, IT has a record of every device movement, update and retirement. Before shipping, confirm that the device is enrolled in mobile device management (MDM) and meets the company’s security baseline. A simple readiness check you can record in asset management might include:

• Serial number and employee assignment recorded

• MDM enrollment confirmed

• Current OS version and updates installed

• Disk encryption enabled

• Endpoint protection active

• Required applications and settings deployed

• Delivery address and start date confirmed

Rippling’s zero-touch enrollment can apply software, access, and security settings without IT physically handling the device, while workflows can flag issues like a new hire starting in three days whose assigned device still hasn’t arrived.

Step #3: Set up employee access and permissions

Before remote employees can work on their new devices, you need to make sure they’re set up with all the apps, tools, and integrations your company uses — and that you can manage them from afar. The device should be set up for IT support and cybersecurity protections, while also allowing employers to remotely provision and deprovision apps depending on the employee lifecycle. 

With Rippling IT, you can instantly set up and secure employees’ accounts, knowing that every employee has the necessary access and permissions from day one. Rippling provides one unified place to set up, manage, and disable all of your employee apps — from Google Workspace to Slack.

Automate provisioning on remote devices

See Rippling IT

Step #4: Ensure devices stay secure and up to date

Once your remote employees have their work devices configured for the job, you need to make sure they’re protected. Look for IT solutions that can hide OS updates until you verify that they’re reliable and then remotely implement them on company devices. You also want a reliable endpoint protection platform (EPP) that detects cyberattacks and prevents them from spreading. 

Moreover, employers should be alerted when there’s a security threat. Rippling IT integrates with SentinelOne, which flags breaches (you can set up email or Slack notifications) and allows admins to quarantine files and safeguard sensitive information. Rippling IT can also mine from its expansive employee data to run reports on encrypted devices and security installations across all connected devices. Employers can know which devices are being threatened and which employees, teams, and locations are thereby impacted. 

Security checks can also determine whether a device is allowed to access company systems. For example, Rippling device trust rules can require engineers accessing Jira, AWS or GitHub to use a managed device, blocking access when that requirement isn’t met. Companies can apply similar rules around device status, IP address, location, or other security signals.

Step #5: Retrieve employee devices when they leave

If you provide employees with company devices when they start working, you need to collect those same devices when they stop. When an employee at or near company headquarters moves on, this is relatively straightforward (albeit tedious); they can hand-deliver all equipment they got when they started or ship it back. 

With Rippling, you can use Inventory Management to eliminate any busywork. This “cloud IT closet” automatically ships a return box and prepaid shipping label to the employee, sends it to a secure warehouse to get wiped and assessed, and if up to standards, ships it off to a new hire. You can also build a “device return” custom workflow into the Rippling HRIS, which notifies IT admins once an employee is offboarding if an automatic device return has not been arranged.  

Refresh, reassign or retire devices

Getting a laptop back is only part of the offboarding process. After verifying that the device serial number matches the asset register, inspecting its condition and wiping company data, administrators still need to decide what happens next (which generally depends on age and condition). Useful signals include battery wear, disk health, any repeated software problems, and whether the hardware still receives required OS and security updates. Microsoft Digital, for example, recommends monitoring those health signals and generally recirculating the device if it’s within a 48-month Windows refresh baseline.

Rippling workflows use similar signals, like notifying IT when an assigned device is more than three years old and opening a Jira ticket when battery health degrades past a certain point, although the exact timeframe and integrations depend on company needs. Other offboarding tasks may also need to happen alongside the device return, like revoking software access and ending or transferring company-paid mobile subscriptions. Once everything is reset and the device is deemed usable, it can be reconfigured for another employee or stored in inventory. If it’s being retired, record the wipe or destruction in the asset register so the device no longer appears as active company hardware.

How Rippling manages the device lifecycle

Rippling connects device management to employee data and inventory so IT teams can manage each stage of the process from one central platform. Changes like a hire, role change or termination can automatically trigger IT actions to support timely, consistent responses across the lifecycle — which means fewer device and inventory issues and less time spent following up on lax documentation or chasing vulnerabilities.

Managing employee computers remotely

Your company’s IT footprint doesn’t need to be confined to one physical office space. Manage your entire fleet, end-to-end, from a single dashboard. Use Rippling IT to:

• Configure apps and set permissions.

• Automatically install secure OS updates and detect cyber threats

• Wipe devices, then ship them off to new employees.

Secure every device from enrollment to retirement

See Rippling IT