Cloud & Enterprise IT
End-User Computing
Device management, virtual desktops, and the tools staff use every day.
What this covers
Laptops, desktops, tablets in patrol vehicles, and shared workstations at counters all need to be provisioned, patched, secured, and eventually retired. HQT implements modern device management and, where it fits, virtual desktop infrastructure.
Typical activities
- Device management with Microsoft Intune, Jamf, or similar platforms
- Zero-touch provisioning so new devices are ready without hands-on imaging
- Patch and configuration baselines aligned to CIS benchmarks
- Virtual desktops for shared, remote, or high-security use cases
- Application packaging and deployment
- Collaboration platform administration, including Microsoft 365 and Google Workspace
What you receive
Configured management platforms, documented baselines, deployment procedures, and a lifecycle plan for refresh and disposal.
Considerations for public agencies
Field devices used by police, inspectors, and utility crews face different threats than office desktops. We design profiles for each role rather than applying one policy everywhere.
Signals that this work is due now
End-user computing work usually starts from a pattern someone notices rather than a schedule:
- A technician handles every new machine before a user gets it, and a replacement laptop waits on that queue.
- No single console answers how many devices the agency owns and when each one last checked in.
- Devices that spend weeks away from the network, such as inspector tablets, carry a patching exception that was meant to be temporary.
- Local administrator rights were granted to make one application work and were never removed.
- An operating system in the fleet is nearing the vendor's published end of support, refresh funding is approved, and the provisioning method has not changed.
- An audit or insurance renewal asks for per-device encryption and patch evidence, and staff assemble it by hand.
Where virtual desktops fit and where they do not
Virtual desktops are often proposed as a way to spend less. Cost is not the reason to choose them, because spending moves from the device to compute, storage, licensing, and the network path, and the endpoint still has to be managed. The cases that hold up are narrow: a workstation many people sign into across a shift, staff hired for a season, contractors who should not receive agency hardware, an application that runs only on an old runtime, and keeping regulated data off a general-purpose desktop.
They fit poorly where work has to continue when the network does not. Field devices on cellular links, dispatch positions, GIS and design workstations, and video or evidence review are common places where the experience falls short. A virtual desktop deployment also makes the desktop an availability-dependent service that belongs in the continuity plan with the network path reaching it.
Fitting this to what the agency already runs
Directory state shows up in device work immediately. Enrollment, conditional access, and single sign-on read the same accounts and groups, so stale accounts, groups with no owner, and slow departure processing become device problems: machines that cannot be reassigned, and compliance rules that cannot be trusted. Expect directory cleanup to run alongside enrollment.
Vendor-controlled endpoints are a contract question before a technical one. Public safety mobile data computers, election equipment, utility and building control workstations, and lab instruments often carry a configuration the vendor supports and nothing else. Get that configuration in writing before applying a baseline or an agent to those machines.
Two products enforcing the same control on one device, whether disk encryption, firewall state, or patching, will conflict; name one platform as authoritative for each and retire the other. Apple, Android, and ChromeOS devices use separate enrollment programs, and hardware bought outside the agency's usual reseller can arrive unable to enroll automatically. Treat a remote wipe as a records action as well as a security action, since content on the device may fall under a retention schedule or a legal hold.
What to write into the solicitation
- The device inventory the bidder works from, including operating system mix and the vendor-controlled machines out of scope.
- A named agency owner for each configuration profile, and the approval path for changing one.
- An exception process for settings the fleet cannot take, with each exception dated, attributed, and given a review date.
- The administrative rights model, including how a temporary elevation is requested, approved, and logged.
- Tenant and license ownership in the agency's name, with agency staff holding the highest administrative role rather than the vendor.
- Media sanitization consistent with recognized guidance such as NIST Special Publication 800-88, with disposal records returned to the agency.
- Assistive technology testing before a baseline reaches the fleet, since screen readers, magnification, and dictation can break when settings change. Accessibility obligations for state and local agencies arise under the Americans with Disabilities Act and state law, and some states apply federal Section 508 standards to their own purchases.
- Acceptance stated as measured conditions: enrollment coverage against the inventory, unattended build time for a replacement device, the patch rings in use, and the interval from vendor release to fleet deployment, shown live from the console rather than in a document.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
Do we need virtual desktops, or is device management enough?
For most staff a managed physical device with cloud identity meets the need, and a virtual desktop adds cost and a dependency on the network being up. Virtual desktops make sense in narrower situations such as a shared workstation used across shifts, short-term and contract workers, or an application tied to an old runtime. The test is whether a named group of users has a problem that a well-managed laptop cannot solve. Decide case by case rather than for the whole fleet.
Do we have to buy new computers to move to cloud-based device management?
No. Devices that meet the operating system requirements can be enrolled without replacement, though older hardware may not support every setting in a security baseline. Zero-touch provisioning is the part that applies mainly to new purchases, because the hardware has to be registered to the agency at the point of sale. A common approach is to enroll the current fleet now and write the registration requirement into the next purchase.
Can the same tools manage police and field devices as office laptops?
Usually the same platform can, but the policy applied to those devices should not be the same. Devices that touch criminal justice information fall under the FBI Criminal Justice Information Services Security Policy, which addresses areas such as authentication, encryption, and the handling of mobile devices, and which is revised periodically. Public safety software vendors also define supported configurations for mobile data computers, so confirm those terms in writing before applying an agent or a baseline.
Who should own the device management tenant and the data in it?
The agency. Licenses and the tenant should be bought in the agency name, with agency staff holding the top administrative role and any contractor working under delegated access that can be revoked. If a bidder proposes to manage your devices from a tenant it owns, ask precisely how devices, enrollment records, and configuration transfer to the agency when the contract ends.
How should we handle staff using personal phones and laptops for agency work?
Settle the policy before the tooling. Most platforms can protect agency data on a personal device without managing the whole device, generally by keeping agency mail and files inside applications the agency controls. Records obligations still apply, since content created on a personal device for agency business can be subject to a retention schedule or a legal hold. The policy should state what is allowed and how those records are captured.