Machine-learning teams love clean inputs, and the laptops those teams work on are rarely as tidy as the datasets. Training notebooks, model weights and credentials sit on devices that somebody bought, somebody configured and nobody has recounted since. EndpointOps is the informal name for looking after those devices through their whole life, and in this walk-through we will do the most useful single exercise it offers: a reconciliation that tells you how many machines are truly in good shape. Grab a coffee and a spreadsheet, and follow the steps in order.

Step 1: Decide what counts as a device

Write one sentence that says which hardware is in scope. A reasonable version: company and personal laptops, desktops, phones and tablets that can reach your systems. Leave servers, sensors and the GPU boxes in the rack out of it, because they have their own routines. The Ops Atlas draws a similar boundary and hands patching, alert triage and sign-in questions to neighbouring jobs. Keeping the scope tight is what makes the final percentage believable.

Step 2: Pull three lists, not one

You need three independent inventories. The first is whatever the management console says it controls. The second is the security agent’s roster, meaning devices whose protection software has reported recently. The third is something outside both: purchase records, a directory of accounts with their assigned hardware, or even a manual count from team leads. A single list always flatters itself, because it can only contain what it already knows about.

Step 3: Normalise the identifiers

Serial numbers are the safest key. Hostnames get renamed, and people re-image machines. Put every list into one sheet with the same columns: serial, owner, last check-in, encryption state, protection-agent state. Spend the time on this step, because a duplicate caused by a stray space will quietly skew the result. If you like data work, this is the familiar join-and-dedupe task wearing different clothes, much like the groundwork behind the piece on how smarter inputs sharpen business decisions on this site.

Step 4: Mark each device against four tests

Give every row a yes or no on four questions. Is it in the management console? Has it checked in during the last thirty days? Is the disk encrypted and is the recovery key saved? Is the protection agent healthy, with a report inside the past week? The Atlas uses those windows because the common management product treats thirty days of silence as the point where a device stops counting as compliant, and one major endpoint-security product flags an agent as inactive after seven days.

Step 5: Count only the devices that pass all four

This is the step that stings. A device that is enrolled but unencrypted fails. A device with a perfect agent that has not been enrolled fails. Add up the survivors and divide by the full count from your widest list. In the lab example the Atlas describes, the console boasted that roughly 89 percent of devices were compliant, yet the reconciled figure was 40 percent. The console was not lying, it simply could not see the machines that were missing from it.

Step 6: Hunt for the quiet defaults

While the sheet is open, check one setting in your tenant. By default, a device with no compliance policy assigned can be treated as compliant. For any setup where access depends on a compliant-device check, that means an enrolled machine nobody has configured still gets through. The Atlas notes that the vendor recommends changing it to non-compliant. Make the change in a test group first, confirm the results, then roll it out.

Step 7: Fix the cheapest gaps first

Sort the failures by effort. Missing recovery keys are often the cheapest and the most urgent: a stored key turns a lost password into a five-minute job, while a missing one can turn it into a wipe. Next come agents that stopped reporting, then unenrolled devices. Resist the urge to delete stale records to make the numbers prettier. The Atlas warns that removing a joined laptop’s record can suspend its disk protection and take the key with it, and activity timestamps only refresh about every fortnight, so a laptop silent for under three weeks may be perfectly alive.

Step 8: Turn the result into a short list of numbers

Pick five or six measurements and track them every week: management coverage, protection-agent health, share of encrypted devices with a stored key, share of access events coming from unmanaged hardware, the proportion on a supported operating system, and how long a key retrieval takes. The source gives a worked key example, 1,164 encrypted devices and 1,131 escrowed keys out of a fleet of 1,200, which comes to 94.3 percent. Notice that the denominator is the whole fleet, not only the machines that already behaved well.

Step 9: Automate the boring part, keep a human on the exceptions

Once the sheet works by hand, script the joins. Anomaly detection can flag a laptop that suddenly stops reporting, and a scheduled job can send the weekly numbers to a chat channel. But keep a person in charge of changes that cannot be undone. The Atlas lists a second-approver feature for wipes, retirements and policy changes, and the group of approvers has to be a plain security group, with direct members only; nested groups simply fail. Automation is a fine assistant for reading the data and a poor one for approving a mass erase.

Step 10: Write down the standard, then repeat

A one-page device standard turns the exercise into a habit. State what a healthy device looks like, who owns exceptions and how often you reconcile. If you want to see where the edges of the idea lie, the Atlas write-up of EndpointOps is a compact place to compare your scope with someone else’s. People coming to this from a pipeline background may also enjoy our beginner skills map for DevOps engineers, since the same mindset of counting what exists before automating it carries over.

What to expect from the first run

Expect the number to be lower than you hoped and the process to take an afternoon. That is the right outcome. A weak first percentage is a map of where to work, and repeating the exercise each week shows whether the effort is paying off. Within a quarter, most of the surprises are gone and the dashboard and the reconciled sheet begin to tell the same story.