[mvip]

If you're on Google Workspace, using Google's Device Manager (assuming you use Chrome as the 'forced' browser), you can get pretty far. It's not as full-featured as other enterprise device mangers by any means, but it should be sufficient for some compliance (ISO27001 and SOC2) as I know companies who have passed with this setup.

[raasdnil]

I am on Google Workspace, to be honest, more than a little concerned with the legendary Google support if something goes pear shaped... but I didn't know they had a device manager, will check it out. Thanks :)