A new client sends over a welcome email with one line that makes a freelancer’s stomach drop: “please enrol your laptop in our device management before Monday.” Your own machine carries other clients’ repositories, your invoices and your family photos. Do you comply, refuse, or buy a second laptop? Think of it as a clinic visit for a contract: we name the symptoms, find the cause, and prescribe a fix for each. The vocabulary here is EndpointOps, the loose name for handling a device from enrolment to retirement.
Symptom one: the client wants control of your whole machine
Diagnosis. The request usually comes from a template written for employees on company hardware. Nobody has asked whether a contractor’s personal computer should be treated the same way. The Atlas entry on EndpointOps lists “demanding full enrolment on personal phones” as an anti-pattern, and the same reasoning stretches to personal laptops.
Prescription. Ask which of two models the client intends: a fully managed device, or a lighter arrangement in which only a protected work area is controlled. Offer to do the client’s work in a dedicated browser profile, a virtual machine or a loaner laptop that they provision. A precise, polite email saves a long argument later.
Symptom two: you worry the client can read your private messages
Diagnosis. This fear is common and mostly misplaced on phones. According to the source, the Intune platform does not collect “email and text messages” or “calling and web browsing history” from an enrolled phone, and Apple’s enrolment methods cannot open personal mail. Laptops differ, since a fully managed computer can have software and settings pushed to it, so read the policy rather than guess.
Prescription. Request the written list of what the client can see and change. If the answer is vague, treat that as information about the client’s maturity and decide whether the engagement is worth the friction.
Symptom three: the device shows as non-compliant right after you encrypt it
Diagnosis. On Windows the disk-protection check is measured when the machine starts up. A laptop that was encrypted a minute ago will keep reporting non-compliant until it restarts. People lose an afternoon to this and raise a ticket for nothing.
Prescription. Restart, wait for the next check-in (devices report about every eight hours, although a manual sync is quicker) and look again. Remember the second half of the rule: save the recovery key somewhere you can reach before you encrypt. A freelancer has no help desk to retrieve it.
Symptom four: your access to the client’s systems suddenly stops
Diagnosis. Conditional access rules often require a compliant device. One compliance window defaults to thirty days, so a laptop you have not connected for a month falls out of it. Grace periods exist, in steps of a quarter of a day, but the default action starts at zero days, so there is often no cushion at all.
Prescription. Keep the device checking in during a long break, or ask the client for a longer window for contractors. Tell them in advance when you plan a holiday. This is also a good moment to learn the client’s escalation route for blocked access, as a good professional habit.
Symptom five: the contract ends and nobody mentions your laptop
Diagnosis. Offboarding often forgets contractors. The device stays enrolled, the client’s data stays on it, and months later an administrator runs a clean-up on stale records.
Prescription. Insist on the distinction between retire and wipe. Retiring removes company data and managed apps; wiping removes everything. On a personal machine, ask for retirement and a written confirmation. If a client says they will “just wipe it”, take that as a cue to propose the narrower step. Handing over deliverables, as covered in our guide to earning the trust of a new client, should include this kind of closing checklist.
Symptom six: the client’s own fleet seems shaky and you are asked to advise
Diagnosis. A freelancer is sometimes brought in because the client suspects its dashboards are too optimistic. The usual cause is a single list. A console can only count the devices it has been told about, so a machine that was never enrolled never appears as a failure.
Prescription. Propose a reconciliation that uses three independent sources: the management console, the security agent’s roster, and something external such as purchase records or an account directory. Count only devices passing every test: enrolled, checked in within thirty days, encrypted with a stored key, and a protection agent reporting within seven days. The Atlas reports a lab where the console implied nearly nine in ten were fine and the real figure was four in ten. Quote that sort of gap carefully; the point is that gaps exist, not that yours will match.
Symptom seven: an admin account is shared among contractors
Diagnosis. Shared top-level credentials are convenient and dangerous. The source describes anti-patterns such as doing daily work as the all-powerful administrator, and it recalls a 2026 incident where, according to unconfirmed press reports, an attacker who took over an admin created a fresh top-level account and erased devices through the console. A government alert afterwards recommended least privilege, phishing-resistant sign-in and a second approver for wipes.
Prescription. If you hold any admin rights for a client, ask for a role limited to what you need, a personal account rather than a shared one, and sign-in methods that resist phishing. Where a second-person approval feature exists, ask that it cover destructive actions. It protects the client, and it protects you from blame.
A simple intake checklist you can reuse
Before accepting any device requirement, run through six questions. Which model applies, full control or a protected work area? What can the client see? Who holds my recovery key? How long may the machine stay offline? Who approves a wipe? What happens to my device on the last day? Put the answers into the statement of work. Those who juggle a day job alongside client work will find more context in the piece about freelancing responsibly next to a full-time post, where conflicts between employers and clients are discussed.
Closing prescription
Do not treat device rules as an insult. They are a client’s attempt to answer a fair question: how do we know the machine touching our systems is in good order? Your job is to make the answer narrow, documented and reversible, then carry on with the real work.
