IT & Security · Module
Device Management
Device inventory, enrolment, kiosk mode, compliance and governed remote actions
Device Management keeps an inventory of devices linked to the employee, the CI and the asset, with native Android Enterprise and an Intune connector. Kiosk profiles serve POS and frontline devices, and every remote action carries its own risk tier.
What it does
Device Management is planned for W4 and is connector-first. The device inventory records management channel (native Android, Intune, Google or import), platform, OS version, model, serial, IMEI as sensitive personal data, ownership (corporate, BYOD, shared, kiosk), assigned person, site and CI link. Existing MDM inventories can be imported by serial for coexistence without re-enrolment.
Enrolment by ownership
Native Android Enterprise supports enterprise binding, enrolment tokens and QR codes, fully managed devices, work profiles and dedicated devices, with managed Google Play app approval. Zero-touch enrolment assigns configuration by device purchase (programmes to verify). Enrolment invitations go by email, WhatsApp template or portal, often triggered by the ITSM joiner runbook. BYOD enrolment is work-profile only, after a plain-language notice in the employee's language showing what IT can and cannot see, with a withdrawal path.
Profiles and compliance
Device profiles set passcode, encryption, Wi-Fi, VPN, restrictions and OS update policy by dynamic group, versioned with a pilot rollout first. Compliance policies check minimum OS, encryption, passcode, root or jailbreak signal, last check-in and required apps, with a grace period and remediation instructions. Compliance state can be published to One3 Identity as a device claim for access policies.
Frontline and POS
Kiosk and dedicated mode supports single- or multi-app kiosks, POS app lock, auto-launch, exit PIN and scheduled reboot. Shared device sign-in uses One3 identity through the Frontline Worker App and clears session data on sign-out. A POS device health panel shows compliance and kiosk state on POS register records.
Remote actions in risk tiers
Sync (R1), reboot kiosk (R2), lock, reset passcode, lost mode and retire (R3), and work-profile removal and full wipe (R4). R4 always needs a human approver with a second factor. Bulk wipe is prohibited, and bulk lock needs a preview and typed count. The lost or stolen device workflow runs lock, sensitivity assessment, wipe proposal and breach handoff.
Lifecycle
Assignment, return on exit from the leaver runbook, repair, retirement and disposal link to Operations Assets. Device Management is still labelled conditional in the plan until its roadmap epic and role are confirmed.
Features
What Device Management includes
Device inventory
Channel, platform, OS, model, serial, IMEI, ownership type, assigned person, site and CI link.
Microsoft Intune connector
Inventory and compliance sync with sync, lock, retire, wipe and passcode reset where supported.
Native Android Enterprise
Enrolment tokens and QR codes, fully managed, work profile and dedicated devices with managed Play approval.
Zero-touch and enrolment invitations
Configuration assigned by purchase, and single-use enrolment links via email, WhatsApp or portal from joiner runbooks.
BYOD enrolment with privacy notice
Work-profile-only enrolment after a notice in the employee's language, with acceptance evidence and withdrawal.
Device profiles
Passcode, encryption, Wi-Fi, VPN, restrictions and update policy by dynamic group with pilot rollout.
Compliance policies
Minimum OS, encryption, passcode, root signal, check-in age and required apps, with grace period and remediation.
Compliance-based access signal
Compliance published to One3 Identity as a device claim, and to connected IdPs where supported (verify).
App policies
Required, allowed and blocked apps, managed configuration, silent install and minimum versions.
Kiosk and dedicated device mode
Single- or multi-app kiosk, POS app lock, auto-launch, exit PIN, settings lockdown and scheduled reboot.
Shared device sign-in for frontline
Sign in and out with One3 identity, session data cleared on sign-out, shift-linked access.
Remote actions by risk tier
Sync, reboot, lock, passcode reset, lost mode, retire, work-profile removal and full wipe, each with its own tier.
Lost or stolen device workflow
Lost mode and lock, locate within policy, sensitivity assessment, R4 wipe proposal and breach handoff.
OS update and patch policies
Update windows, deferrals and deadlines on Android and Intune update ring status with a patch compliance report.
AI device troubleshooting
Diagnoses from inventory, compliance history and recent Actions and suggests steps with rationale.
POS device health panel
Compliance, last check-in and kiosk state on POS registers, with reboot request or ticket from the store.
Workflow
Enrolment by ownership
- 1
Enrolment triggered by joiner runbook, admin, zero-touch or self-service
- 2
Corporate devices enrol fully managed; shared devices get a kiosk profile
- 3
BYOD shows a privacy notice and enrols work profile only if accepted
- 4
Group profiles and app policies apply
- 5
Compliance is evaluated and a device CI is created in ITSM
Workflow
Lost or stolen device
- 1
Loss reported on WhatsApp, portal or ticket
- 2
Lost mode and lock applied
- 3
Data sensitivity assessed
- 4
Wipe proposal approved by an IT manager with a second factor
- 5
Security incident proposed if needed and replacement offered
AI
AI skills and Digital Employees
Device troubleshooting
Diagnosis and suggested Actions with rationale for IT staff and via the L1 agent.
Script drafting and checks
Drafts scripts with static checks for destructive commands and secret patterns; drafts enter normal review.
Asset reconciliation
Matches devices to CIs, assets and IdP accounts and proposes fixes.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Can IT see my personal data on a BYOD phone?
BYOD enrolment is work-profile only, after a notice in your language that shows what IT can and cannot see. You can withdraw, which removes the work profile.
Which platforms are supported first?
Native Android Enterprise and the Intune connector are planned first, with Google endpoint management and Apple ADE via connector. Native Apple and Windows MDM are later.
Can someone wipe all devices at once?
No. Bulk wipe is prohibited, and every full wipe is an R4 Action with a human approver and a second factor.
Does it work for store POS tablets?
Yes, kiosk and dedicated device modes with POS app lock and a device health panel on POS registers are planned.
See Device Management in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.