The screenshot
Shows it was on, once.
A SOC 2 auditor might accept a screenshot of one laptop’s settings. A customer’s security team can tell it’s theater.
New
Device Management (MDM)
Go from monitoring device security to enforcing it.
Oneleet MDM (mobile device management) enforces device security in the platform you already use for compliance. The Oneleet agent stays included.
- No second agent, console or vendor.
- Compliant by default, with proof your auditor can use.
- Speed up security reviews, build trust, and close deals faster.
There is a better way
Your customers aren’t asking if you have a security policy. They’re asking if anyone enforces it.
Oneleet MDM
Enforced on every managed device.
Security teams want to see settings enforced. Oneleet MDM keeps them on, with the evidence to back it up.
Security reviews
SOC 2 doesn’t require MDM.Your customers’ security reviews ask about it.
- ask about MDM by name
- 1 in 3
- ask about endpoint security
- 2 in 3
Based on Oneleet’s review of hundreds of security questionnaires.
Business impact
How it helps your business
Revenue
Answer the security review. Close the deal.
When a security review asks about devices, the answer is already there: settings enforced on every managed laptop, with the evidence to back it up.
Time
Stop configuring laptops one by one.
Turn on secure defaults once, and every laptop gets the settings your auditor checks, including the next new hire’s.
Cost
Drop the second vendor.
MDM is a per-device monthly charge, on the contract you already have. No additional vendor to buy and renew, and no integration to maintain.
What’s in Oneleet MDMSet it once, and every laptop stays on it.
Secure defaults
A policy you don’t have to write
One click enforces the device settings frameworks ask for, such as encryption, screen lock and firewall. You can see and adjust every setting per device.
Enforced settings
Turned off? Turned back on.
FileVault, firewall, screen lock, Gatekeeper and Defender are set by policy and put back when someone turns them off.
Turned off
Turned back onLock, wipe and key escrow
Lock or wipe a laptop when it’s lost or someone leaves
A lost laptop stays encrypted with FileVault, with the recovery key on file. Lock a Mac or wipe a laptop once it’s back online.
Apps and updates
Apps and updates from the same place
Install apps from a catalog on Mac and Windows, and push Windows updates with a deadline.
From monitoring to enforcing
The Oneleet agent already monitors your security settings. Now, Oneleet MDM lets you enforce them.
Oneleet agent
Included
Shows you which laptops are failing a check.
- Checks encryption, firewall and screen lock on every laptop
- Flags the laptops failing a check
- Activity log for each device
Oneleet MDM
Per-device monthly charge
Fixes them, and keeps them fixed.
- Everything the agent does
- FileVault, firewall, screen lock, Gatekeeper and Defender set by policy
- Lock, wipe and recovery key escrow
- Apps from a catalog and Windows updates with a deadline
Comparison
Most compliance tools read your MDM. Oneleet runs it.
Comparing options? Ask every MDM vendor these four questions.
| Ask every MDM vendor | Compliance tool + separate MDM |  Oneleet MDM |
|---|---|---|
| Does it enforce the device settings my compliance program requires? | Once someone turns each control into an MDM profile | Compliant by default. Your framework’s device requirements become enforced settings. |
| When my compliance tool flags a device, can I fix it in the same place? | No. You fix it in another vendor’s console | Fix it where you see it. The change applies to every managed laptop. |
| Are the device checks tied to my security program, in a format my auditor can use? | Your compliance tool reads them through an integration | Proof your auditor can use. Evidence of enforced settings, with an activity log for each device. |
| Does it add a second vendor, console and contract? | Yes | One vendor. One platform and one contract, charged per managed device per month. |
| Compliance tool + separate MDM |
|---|
| Once someone turns each control into an MDM profile |
| Oneleet |
| Compliant by default. Your framework’s device requirements become enforced settings. |
| Compliance tool + separate MDM |
|---|
| No. You fix it in another vendor’s console |
| Oneleet |
| Fix it where you see it. The change applies to every managed laptop. |
| Compliance tool + separate MDM |
|---|
| Your compliance tool reads them through an integration |
| Oneleet |
| Proof your auditor can use. Evidence of enforced settings, with an activity log for each device. |
| Compliance tool + separate MDM |
|---|
| Yes |
| Oneleet |
| One vendor. One platform and one contract, charged per managed device per month. |
Rolling it out
No need to wipe your fleet.
We’ll help you get enrolled. A Oneleet engineer (a real person and not a setup wizard) works with your team.
Existing Macs
Enroll with a profile from the Oneleet portal. No wipe.
New Macs
Enroll zero-touch through Apple Business Manager (ABM, now Apple Business).
Windows and Linux
Enroll through the Oneleet agent you already have. Windows takes one click.
Oneleet MDM enforces device security in the platform you already use for compliance.
The Oneleet agent stays included.
FAQ
Questions
Does SOC 2 require MDM?
No. But your customers’ security reviews ask about it: one in three security questionnaires our customers receive asks about MDM by name.
Do we have to wipe our Macs?
No. Existing Macs enroll with a profile from the Oneleet portal and keep their apps and files. New Macs bought through Apple or a participating reseller enroll zero-touch during setup.
Can employees remove it?
Not when the Mac enrolled through Apple Business. Anyone with an admin account on a Mac can remove a profile, and Oneleet flags that Mac so you can re-enroll it.
Do we need Apple Business?
Not to get started. Any Mac can enroll with a profile. Apple Business adds zero-touch enrollment for new Macs, and it needs a DUNS number, which usually takes 1–2 weeks. Once you have it, a Oneleet engineer can take it from there.
Which devices does it support?
Mac and Windows laptops. Linux devices can be wiped or have their local user disabled. Not iPhones or iPads.
What about personal laptops?
Personal devices stay monitored, not managed.
We already use another MDM. What does switching involve?
A laptop can only be in one MDM at a time, so a Oneleet engineer plans the move with your team. We can time it to your renewal date.
What’s the difference between the Oneleet agent and Oneleet MDM?
The agent is included and monitors your security settings. MDM enforces them, for a per-device monthly charge. See Device Monitoring.
Resources
Speed up your next security review.
Already a Oneleet customer? Ask your security program manager to add MDM.
