Unified Endpoint Management
Company devices ready out of the box, and safe when they go missing
Windows and macOS computers, iOS and Android phones and tablets are enrolled, configured and protected from one console that runs on Nesnet's infrastructure in Türkiye, so device data never leaves the country.
Why now
- A sales director's laptop was stolen at the airport, with the customer list and proposal files on it. Nobody knows whether the disk was encrypted, and there's no way to lock it remotely.
- Twelve people start this month, and each laptop takes half a day of IT's time to set up. If devices arrived with company settings and apps the first time they're switched on, the team could spend that time elsewhere.
- A departed employee's phone still holds company mail and customer files. Wiping a personal phone is out of the question; only the company data needs to go.
- An update is out for a critical OS flaw, but nobody knows how many devices have it. Without a tool that lists out-of-date devices and enforces the update, that question has no answer.
- A customer audit asks you to show that company data is accessed only from encrypted, up-to-date devices. Without compliance rules and conditional access, there's no evidence.
What changes
| Today | With Nesnet |
|---|---|
| Every new laptop takes half a day of hands-on IT setup. | The device enrolls on first boot, and settings, apps and rules install themselves. |
| Nothing can be done about the data on a lost device. | The device is locked from the console, put in lost mode, or company data is wiped remotely. |
| Company data stays on a leaver's personal phone. | Enterprise wipe removes only company apps and data, never touching personal data. |
| Nobody knows which devices are up to date or encrypted. | The inventory shows every device's version, encryption state and compliance in one list. |
| Company apps can be opened from any device at all. | Access opens only to managed devices that meet the rules, with sign-in through a NIM account. |
From today to live: how it works
- 1
Device fleet call
You and the Nesnet team agree how many devices you have, which platforms they run, and which are company-owned or employee-owned. By the end of the call, enrollment paths and the items that set the price are clear.
- 2
Your management environment is prepared
A separate organization group is created for you, your corporate directory is connected and enrollment paths are configured. Automatic enrollment programs for Apple and Android devices are linked at this stage.
- 3
Profiles and rules are written
Password, encryption, Wi-Fi, VPN and email profiles, the app list and compliance rules are prepared with Nesnet's team. The step-by-step actions for a rule violation are written down here too.
- 4
A pilot group enrolls
Devices from the IT team and a few volunteers enroll first. Together you check that settings, apps and rules arrive as expected.
- 5
The whole fleet comes under management
The remaining devices enroll in turn, and new devices enroll themselves on first boot. Inventory, compliance reports and event logs show the state of things from day one.
What you get
Every platform in one console
Windows and macOS computers, iOS and iPadOS devices, Android phones and tablets, ChromeOS and Linux devices are managed from the same console. Rugged Android and Windows handhelds sit in the same list, so there's no separate tool to learn per platform.
Enrolled the moment it's unboxed
Apple devices bought through Apple Business Manager and Android devices registered for zero-touch enroll themselves on the first setup screen. Windows computers enroll during the out-of-box experience, and IT never has to touch the device.
Work and personal kept apart on personal phones
Android's work profile keeps company apps in a separate space, and Apple's user enrollment opens a separate area for managed data. Management reaches only the work side and never touches the employee's photos, messages or personal apps.
Privacy that follows device ownership
Whether location, app, network and telephony data is collected, and whether it's shown if collected, is set separately by device ownership. On personal devices, collected data is kept to a minimum and remote commands can require user approval.
Settings arrive as profiles
Password policy, restrictions, Wi-Fi, VPN, the email account and certificates reach the device as per-platform profiles. Employees never need to know the Wi-Fi password or the mail server name; the device arrives ready to connect.
Ready-made security baselines for Windows
Ready-made baselines that bundle recommended security settings are applied to Windows computers. You can also build a custom baseline from your existing group policy backup and bring years of settings with you.
Distribute apps remotely
Store apps, in-house apps and Windows desktop software are distributed remotely, and Apple volume purchase licenses assign apps without asking for the employee's personal account. In-house apps roll out in phases, first to a small group and then to everyone.
An app catalog for employees
The management app on the device holds a catalog of approved apps employees can pick and install themselves. People install the software they need without raising a ticket, and never go hunting for unapproved apps.
Compliance rules with escalating actions
Rules such as encryption, OS version, passcode, root or jailbreak status, antivirus, firewall and last-seen time are measured continuously. On a violation, the user is warned first, then profiles and apps are restricted, and finally an enterprise wipe steps in.
Manage operating system updates
Updates are enforced on devices or deferred for a set period, and Windows updates are listed with the devices they're installed on. Instead of guessing how many devices got a critical security update, you see it in a report.
Lock or wipe a lost device
Lock a device remotely, change its passcode, make it play a sound to find it, or put a supervised Apple device in lost mode with a message on the lock screen. If it's not coming back, an enterprise wipe removes company data or a full wipe resets the device.
Wipe only company data from a leaver
Enterprise wipe removes only corporate apps, profiles and company data, leaving the employee's personal photos and apps in place. On their last day, company data leaves the personal phone without anyone touching it.
Protection against accidental mass wipes
Wipe protection holds wipe commands that exceed a threshold within a set time, so a wrong group selection can't reset the whole fleet. A wipe command that hasn't reached the device yet can also be cancelled by an admin.
Disk encryption and recovery keys
On Windows computers, the operating system's built-in disk encryption is turned on by profile and each drive's recovery key is stored in the console. On macOS, disk encryption is enforced, so the data on a lost laptop can't be read.
Company data only from compliant devices
A device's management and compliance status is shared with NIM, Nesnet's identity platform, and staff sign in to apps once with the same NIM account. Apps can require a fully managed device that meets the rules, and a device that doesn't is sent to a fix-it step.
Users matched to your directory
Users are mapped from your existing corporate directory and enroll their devices with their corporate credentials. A user disabled in the directory becomes inactive in the console too, so offboarding starts in one place.
Inventory and reports
The device list shows last-seen time, compliance status, serial number, operating system and installed apps, and it can be filtered and searched. Device, user and app reports download as spreadsheets or arrive by email on a schedule.
Event logs and SIEM export
Console sign-ins, failed logins, admin actions and setting changes are logged along with device events. Logs can be exported or sent to your security event management system, so an audit can see who did what to which device.
Admin roles by permission
Limited admin roles such as help desk can be defined, so a help desk agent can lock a device but can't change the rules. Employees also get a self-service portal role where they can see their own devices.
Shared devices and shift work
On shared Android, iOS and macOS devices, staff sign in with their own account, settings follow their role and the session is cleared at sign-out. On rugged Android devices, an enterprise reset keeps apps and files marked as persistent, and the device re-enrolls itself.
Why Nesnet
The console is in Türkiye, on Nesnet's infrastructure
The management console runs on Nesnet's infrastructure in the Equinix Istanbul (Dudullu) and Türk Telekom Ankara facilities. Device inventory, location and compliance data aren't sent to a service abroad; they stay in Türkiye.
One identity, compliant devices only
Devices' management and compliance status is shared with NIM, Nesnet's identity platform, and staff sign in to apps with the same NIM account. The rule that company data is reached only from compliant devices is set in one place.
The management endpoint is already running
The management endpoint devices connect to is already in live operation at Nesnet. There's no waiting for a server to be built and tested for a new customer; the work starts with preparing your device groups and rules.
Rules written together with you
Nesnet's team prepares enrollment paths, profiles and compliance rules to fit your needs. Which devices are company-owned, which belong to employees, and what happens step by step when a rule is broken are agreed from the start.
Desktops, mail and identity in one team
Nesnet runs virtual desktops, business email and its identity service with the same team. You don't juggle separate companies for your devices, the desktops they connect to and the mailboxes they use.
Billing that follows your device count
Invoices are issued as e-invoices or e-archive invoices. The fee follows the number of managed devices and changes as devices are added or removed.
Example scenarios
A laptop stolen at the airport
Situation
A consulting firm partner's laptop was stolen at the airport on the way back from abroad. It held customer contracts.
Outcome
The console showed the disk was encrypted and the recovery key lived only in the console. The device was locked remotely, an enterprise wipe was queued for its next connection and the event logs went into the insurance file.
A new hire's first day
Situation
At a fast-growing software company, dozens of people start every month, and IT was setting up every laptop by hand.
Outcome
New laptops now ship straight to the employee's address, enroll on first boot with the corporate account and install mail, VPN and apps on their own. The time IT used to spend on setup went to other work.
A sales team on personal phones
Situation
A distributor's sales team uses company mail and the ordering app on their own phones. Company data stayed on the phones of people who left.
Outcome
Phones were enrolled with a work profile; company apps sit in a separate space and personal data is never accessed. When someone leaves, an enterprise wipe removes only the work side.
Proof of compliant devices for an audit
Situation
A financial institution was asked to show that customer data is reached only from encrypted, up-to-date devices.
Outcome
Compliance rules required encryption and a current OS, and non-compliant devices had their app access restricted through NIM. The compliance report and event logs were presented to the auditor.
Who does what
| Nesnet | You |
|---|---|
| Builds the management environment, organization groups and enrollment paths with its own team. | Decide which devices are company-owned or employee-owned and which rules apply. |
| Runs the management endpoint devices connect to on its infrastructure in Türkiye. | Inform your employees about what data is collected on personal devices. |
| Prepares profiles, app distribution and compliance rules to fit your needs at initial setup. | Open and manage your organization accounts in Apple and Android automatic enrollment programs. |
| Connects single sign-on and the compliant-device requirement to NIM. | Report lost devices and leavers promptly, and make the lock or wipe decision. |
| Handles your support requests with the same team that runs virtual desktops and business email. | Assign admin roles within your team and review permissions regularly. |
Who it is for
Companies with a scattered device fleet
Companies handing out laptops, phones and tablets to teams in the office, in the field and at home. Who holds each device, which version it runs and whether it's encrypted all show up in one list.
Organizations that allow personal phones
Organizations that let staff reach company mail and apps from their own phones. Work data lives in a separate space, while personal photos and messages stay outside management.
Growing companies with a small IT team
IT teams that set up every new hire's computer by hand, taking days. The device enrolls on first boot, and settings and apps install themselves.
Audited and regulated organizations
Organizations that must show data on a lost device is protected, disks are encrypted and a leaver's access is closed. Compliance status and event logs export as reports.
Businesses with shift and field devices
Businesses using shared tablets or rugged handhelds in warehouses, stores and the field. At shift change, the device is ready for the next user, with settings that follow their role.
May not be the right fit
For a small office with just a few computers that are easy to manage one by one, this service may be more than you need.
If the management console must run on a server in your own building, this service doesn't meet that need; the console runs on Nesnet's infrastructure.
Under the hood
Endpoint management works like this: a device enrols once and then checks in with the management console at regular intervals. The console sends it profiles, apps and commands; the device reports its status and inventory back. Nesnet delivers the service on an enterprise unified endpoint management platform and sells it per device. On phones and tablets the operating system's own management interface is used, and on Android a work profile, on Apple devices user enrolment, keeps company data apart from personal data. On computers, a management app on the device handles software distribution and enrolment. A compliance engine measures the rules on a schedule and runs the configured actions in order when one is broken. Each customer's devices live in their own organisation group, so settings and permissions don't leak outside it. What Nesnet adds is that its own team builds it: the management endpoint runs live at Nesnet, and enrolment paths, profiles and rules are prepared around your needs.
Building blocks
- Unified endpoint management console
- enrolment, profiles, apps and remote commands
- Compliance engine
- measures rules on a schedule, escalates step by step when one is broken
- On-device management app
- enrolment, app catalogue, software distribution on computers
- Operating system management interfaces
- the built-in device management channels of Apple, Android, Windows and ChromeOS
- Organisation groups and role-based access
- each customer's devices and administrators in a separate group
- Reporting and event logging
- inventory reports, console and device events
- Directory connection
- users mapped from your existing corporate directory
How it compares
| Option | When it is the right choice |
|---|---|
| Setting up each device by hand and tracking it in a spreadsheet | If one IT person looks after a few computers, manual setup and the operating system's own settings do the job. As the device count grows, phones join in and auditors ask for evidence, a hand-kept list stops being accurate. |
| Relying on the mail app's own security settings on phones | If staff only need company email on their phones, the mail account's passcode and remote-wipe policies can be a reasonable first step. Once app distribution, update tracking, disk encryption and laptops come into the picture, you need unified management. |
| One operating system vendor's own management tool | If every device you own runs the same operating system, that vendor's own tool may be simpler. With Windows, macOS, iOS and Android in the mix, one console is less work than a separate tool and rule set for each. |
Technical specifications
| Service | Computer and mobile device management |
|---|---|
| Billing unit | Per device |
| Setup | Not a portal product, built by Nesnet's team |
| Management endpoint | Live at Nesnet |
| Support line | 0800 606 1071 |
| Platforms | Windows 10 and 11, Windows Server, macOS, iOS and iPadOS, Android, ChromeOS, Linux; rugged Android and Windows devices |
|---|---|
| Enrolment paths | Email address, on-device management app, automatic on first boot (Apple, Android, Windows, ChromeOS), QR code |
| Personal devices | Android work profile; Apple user enrolment (separate managed volume) |
| Privacy | Data collection and remote-command permissions by ownership |
| Shared devices | Sign in / sign out on Android, iOS and macOS |
| Profiles | Passcode, restrictions, Wi-Fi, VPN, email account, certificates; Windows security baselines |
|---|---|
| App types | Store and in-house apps; MSI, MSIX, EXE for Windows; phased rollout |
| App catalogue | In the on-device management app; end-user self-service portal |
| OS updates | Deferral, enforced installation, install status tracking |
| Disk encryption | Built-in Windows and macOS encryption; recovery keys in the console |
| Compliance rules | Encryption, OS version, root / jailbreak, last seen, passcode, app list |
|---|---|
| Remote actions | Lock, lost mode, change passcode, enterprise wipe, full wipe, enterprise reset |
| Wipe protection | Wipes above a threshold in a short window are held |
| Conditional access | Single sign-on and device-compliance access through NIM |
| Users | Mapped from your existing corporate directory |
| Inventory | Serial number, OS, last seen, security and compliance status |
|---|---|
| Reports | XLSX or CSV; scheduled email subscriptions |
| Event log | Console and device events; forwarding to a SIEM |
| Administrator permissions | Role-based; each customer in its own organisation group |
If something breaks
A device is lost or stolen
The device is locked from the console, and on supervised Apple devices lost mode can be turned on and the location requested. If it isn't coming back, an enterprise wipe removes company data or a full wipe resets the device.
A bulk wipe is sent by mistake
Wipe protection holds wipe commands that go over a threshold within a set time. A wipe that hasn't reached the device yet can also be cancelled by an administrator.
A Windows computer's system breaks
An enterprise reset reinstalls the operating system while keeping user data, user accounts and managed apps. The computer stays under management, and company settings and apps sync back down.
A device stops checking in
A last-seen rule marks a device that hasn't contacted the console within the set time as non-compliant. The configured steps then run in order: a notice to the user, blocked access to company resources and, if needed, an enterprise wipe.
Frequently asked questions
Pricing and first steps
Pricing
Unified Endpoint Management is billed monthly per managed device. If set-up or initial enrolment work is needed, it is written into the quote as its own item, and Nesnet’s team prepares your quote.
What the price depends on
- Number of devices under management
- Setup scope: platforms to manage, enrolment paths and rule sets
- Virtual Desktop or Business Email taken alongside
How to get started
- 1.Fill in the form or call 0800 606 1071.
- 2.We map your fleet and ownership model in one call and prepare a price.
- 3.Your environment is prepared and the pilot group's devices enroll.
Bring your device fleet under management with one call
Tell the Nesnet team how many devices you have and who owns which, and you'll hear back within the same business day. The console runs in Türkiye, sign-in goes through NIM, and new devices are ready the moment they're unboxed.