How to manage devices in hybrid workplaces

Hybrid workplaces complicate endpoint management because endpoints move between office and remote networks. IT teams need consistent inventory, software deployment, patching, security, data protection, and support across every location. We’ll walk you through the key considerations and how to choose the tools that work best for you.

What is hybrid work?

In a hybrid workplace, employees work from more than one location, typically combining office and remote work. For IT teams, the primary challenge is maintaining consistent inventory, software, security, access, and support as devices move between networks.

In general, there are three common types of hybrid workplace models.

• Flexible hybrid work model: Employees choose where they work on any given day. They may also choose to work fully remotely or fully on-site.

• Fixed hybrid work model: Employees work remotely on designated days based on an organization, department, or individual schedule.

• Mixed hybrid work model: The organization combines flexible and fixed schedules based on employee, team, or operational requirements.

The right device management approach depends on how frequently endpoints leave the office, which operating systems you support, and whether devices can reliably connect to the corporate network.

How do you manage devices in a hybrid workplace?

To manage devices in a hybrid workplace, inventory every endpoint, group devices by operating system and network location, select the appropriate management model, automate deployments and patches, enforce access controls, and monitor compliance. Apply the same process to every endpoint, even when different tools are required.

1. Inventory your endpoints and identify their operating systems, owners, locations, and installed software.

2. Group devices by whether they are usually on the corporate network, remote, or frequently moving between both.

3. Choose cloud-based, on-premises, or combined management tools based on connectivity and operating system requirements.

4. Deploy the required agents, authentication controls, and management configurations.

5. Automate software deployment, operating system updates, third-party patching, and recurring maintenance.

6. Monitor endpoint health, patch compliance, software inventory, and devices that stop checking in.

The following areas should be part of that management process.

Identity and access management

Identity and access management (IAM) controls who can access company systems and what each user can do. In a hybrid workplace, cloud-based identity, multifactor authentication, single sign-on, and least-privilege access help protect resources across office and remote networks.

Software deployment

When users are scattered across multiple locations, how do you ensure that business-critical software is properly deployed and regularly updated on their computers? Instead of deploying software manually, we recommend using a software deployment solution that supports on-prem and remote deployments.

If you’re currently using an on-prem software deployment tool, you can set up VPN to deploy to remote devices as well. Or you can schedule deployments to occur when employees are in the office (for those who do go in). Alternatively, you can use agent-based solutions to deploy to any device that’s connected to the internet, or offer self-service app delivery via the likes of Microsoft Intune’s Company Portal.

Whatever you choose, you’ll want to have full visibility of your software and hardware inventory to know what to update, install, or uninstall — and when — so you can spot any shenanigans before they occur. Following these software deployment best practices wouldn’t hurt, either.

Computer imaging

Imaging computers results in a more consistent and secure endpoint environment, whether you’re rolling out new hardware or migrating users to a new version of Windows. But execution can be tricky when you’re managing a hybrid workforce with employees who aren’t always on-site.

You can wait until employees are in the office, but what about those who are fully remote? One way is to deploy images to devices on-prem before shipping them out. Some imaging solutions, like SmartDeploy, also let you securely deploy images over the internet using your company’s third-party cloud storage provider, even if you don’t have VPN set up.

Unless you have a small fleet, we wouldn’t recommend imaging computers manually. And if you’re supporting different hardware models, using sector-based disk cloning software could result in an unwieldy number of images and physical reference machines. Some folks also choose to ditch computer imaging entirely and use Windows Autopilot to configure preloaded OEM systems, but you risk dealing with unwanted bloatware.

IT security

Hybrid workplaces increase security risk because endpoints connect from multiple networks and may spend less time on the corporate network. Reduce that risk with continuous endpoint visibility, patch compliance, encryption checks, identity controls, and automated remediation for noncompliant devices.

Besides controlling user access and keeping systems and software up to date, make sure you have other safeguards in place to protect company systems from threats, like phishing attacks. Employees can be your weakest link, so make security top of mind for them through training, strong password practices, and proactive zero-trust security policies. Be prepared with an incident response plan. Time and resources permitting, consider testing your defenses to spot gaps and optimize your security measures.

User data storage and backup

With individuals and teams scattered across various locations, how can hybrid organizations ensure that company and user data is properly stored and backed up? One common approach is to combine cloud file storage and synchronization services, such as OneDrive or Dropbox, with a dedicated backup and recovery strategy. Organizations may also use services from cloud platforms such as AWS, Microsoft Azure, or Google Cloud, depending on their storage, retention, and recovery requirements.

• Costs: Cloud services can reduce up-front infrastructure expenses and shift costs toward usage-based pricing. However, organizations should account for storage growth, data transfer, retention, and recovery charges.

• Scalability: It’s much easier to increase storage and backup capacity, as needed.

• Security: Public cloud services typically come with built-in security features, like access control, data encryption, and multifactor authentication.

• Automation: Administrators can configure and automate scheduled backups, so you don’t have to worry about doing this manually or overlooking an important step.

• Collaboration: Cloud storage platforms enable file sharing and multiuser access, which facilitates collaboration across teams.

Organizations that want to leverage their on-prem storage assets may opt for hybrid cloud backups, which combine on-prem and public cloud storage components. Depending on your existing setup, IT resources, and user requirements, using hybrid cloud backup could be a viable option.

Communication and support

Support hybrid users with a centralized ticketing system, cloud-based communication, secure remote access, and standardized workflows for onboarding, offboarding, and common fixes. Track response times, recurring incidents, and unreachable devices so distributed endpoints do not quietly fall out of support.

How do you manage macOS devices in a hybrid workplace?

Use a cloud-based agent for Windows and macOS patching, scripting, inventory, deployment, and remote administration. Pair it with a mobile device management platform when you also need automated enrollment, configuration profiles, FileVault controls, or Apple-specific compliance policies.

PDQ lets IT teams manage Windows and macOS devices from the same console without requiring a VPN. It can also work alongside an MDM platform such as Microsoft Intune or SimpleMDM when deeper device configuration and enrollment controls are required.

How do you choose device management tools for hybrid workers?

Choose a management tool based on where devices operate, which operating systems you support, and whether the organization needs software management, full device configuration, or both. Cloud-based tools are generally the simplest option for remote endpoints, while on-premises tools remain useful for Windows devices that regularly connect to the corporate network. Here are some questions to consider:

• How often do users alternate between working on-site and remotely?

• Do you need to do only light-touch deployments?

• Does the solution support all the device models and operating systems in your organization?

• Does the solution integrate with existing infrastructure?

• Does the solution integrate with your IAM and security tools?

• Does the solution allow you to easily automate and streamline recurring workflows?

• Does the solution allow you to collect and view useful hardware and software data?

• Is the solution scalable?

• Is the solution easy to set up and use?

• Do you have the necessary budget and IT resources to manage your chosen setup?

• Is technical support readily available?

Which device management tool fits your hybrid environment?

The right device management tool depends on where endpoints operate, which operating systems you support, and how much control you need over deployment, enrollment, security, and compliance. Use the following comparison as a starting point, then evaluate each option against your infrastructure and IT requirements.

PDQ Connect vs. Microsoft Intune for hybrid device management

PDQ Connect and Microsoft Intune address overlapping but different device management needs. PDQ Connect is a strong fit when the primary goals are software deployment, third-party patching, scripting, inventory, vulnerability remediation, and remote administration for Windows and macOS endpoints.

Microsoft Intune is a stronger fit when the organization needs mobile device management, mobile application management, automated enrollment, configuration profiles, broad mobile platform support, and Conditional Access integration. Hybrid organizations may use both, with Intune managing device configuration and access policies while PDQ Connect handles day-to-day software, patching, scripting, and endpoint administration.

PDQ gives hybrid IT teams two ways to manage endpoints. PDQ Connect is cloud-native and agent-based, manages Windows and macOS devices over the internet, and does not require a VPN. PDQ Deploy & Inventory handles on-network Windows devices with agentless software deployment, patching, and inventory.

Use either product on its own or combine them based on where devices work, how often they connect to the corporate network, and which operating systems your organization supports.

Can’t decide? Don’t worry, we got you. You can always try Deploy and Inventory or try Connect (or both) free for 14 days.