Managing a hybrid office Mac fleet

An Edmonton firm has thirty staff. On any given Tuesday, eight Macs are at the studio, fifteen are at staff homes, four are at client offices, and three are on planes. The IT pattern that ran the office in 2019 cannot run this firm in 2026. What does run it is a different set of assumptions about where a Mac lives, who can see it, and how the studio knows it is doing what it should.

Hybrid work changed something fundamental about device management. The old pattern assumed the Mac came back to the office. Updates installed when the device joined corporate Wi-Fi. Patches were enforced by the building. None of that holds anymore.

The three pillars of a hybrid-ready fleet

Mobile Device Management (MDM). The control surface for the fleet. Configures the Mac the same way regardless of where it sits. Pushes apps, settings, security profiles, and updates over the internet. Mosyle, Kandji, Jamf, and SimpleMDM all do this. The difference between vendors is interface and pricing, not capability for the core job.

Identity-managed sign-in. Microsoft Entra ID, Google Workspace, Okta, or Apple’s own setup with Managed Apple Accounts. The identity provider is what tells the Mac who its user is, what they have access to, and what should happen when they leave the firm. Without identity at the centre, access management becomes a per-device exercise that does not scale past about fifteen staff.

Remote support tooling. The path to actually fix something when a staff member is at home and a Mac will not boot. Built into most modern MDM platforms as remote screen and command line access. Used carefully (with consent and with logging), this is what turns a remote device into one IT can actually help.

Why network-dependent controls break

Many firms inherited an architecture from the office era. Access to internal systems required a Virtual Private Network (VPN) connection. Updates installed when the Mac joined corporate Wi-Fi. Backups ran when the device was on the network. Compliance reports counted only the devices the network saw.

Each of these assumptions breaks under hybrid. A staff member who works from home for two weeks may never trigger the update window. A Mac that lives at a client site for the duration of a project never appears in the compliance report. A VPN-only access model creates a constant friction tax on staff who are doing legitimate work from coffee shops.

The pattern that works better is identity-based control. Access decisions follow the user, not the network. Updates are pushed by the MDM whenever the Mac is online, not when it is on corporate Wi-Fi. Compliance reports come from the MDM, which sees every managed device regardless of location.

What good visibility looks like

Three reports tell a hybrid fleet manager almost everything they need to know.

Last-seen report. Every managed Mac, when it last checked in to the MDM, and from what general location. A Mac that has not checked in for three weeks is a fleet question. A Mac that has not checked in for three months is probably a fleet loss.

Update compliance report. Every managed Mac, the operating system version, and the patch level. Anything more than two minor versions behind is worth investigating. Anything more than a major version behind is worth scheduling.

Disk encryption report. Every managed Mac, whether FileVault is enabled, and whether the recovery key is escrowed to the MDM. Without escrow, a forgotten password becomes a wiped Mac.

None of these reports are complicated. The discipline is running them and acting on them. The fleets that drift are not the ones missing tools. They are the ones missing the weekly review.

When trust is not the question

Some firms resist hybrid management because they read the visibility tooling as surveillance. That framing misreads what the tooling is for. The MDM does not let IT read a staff member’s emails or open their browser tabs. The MDM lets IT confirm that the Mac is encrypted, patched, and running the corporate apps the staff member needs to do their work.

The architecture is the firm’s defence against a lost laptop, a departing staff member who keeps their access for three months by accident, or a ransomware incident that needs to be contained before it spreads through the fleet. The team is not the problem. The lack of visibility into the fleet is the problem.

When to think about this

The right time to think about hybrid fleet management is before the next staff member moves to permanent remote, before the next office relocation, or before the next compliance questionnaire that asks about device management posture. After any of those, the answer should already exist.

There is also a worst-case version of this argument. The early weeks of the COVID-19 pandemic in 2020 caught a meaningful number of the businesses we worked with completely off guard, because they had no infrastructure that let staff work from anywhere except a desk in the office. Fleet visibility, identity-based access, and remote support tooling are not just operational conveniences. They are also the difference between a firm that absorbs the next disruption and a firm that loses a month to it.

Hybrid work made fleet visibility harder. The right tooling makes it tractable. The firms that build for hybrid get to focus on the work. The firms that do not build for hybrid spend the next year explaining gaps they cannot close.