How do I deploy endpoint protection to the laptops of staff who never come into the office?

You don’t need staff to bring laptops into the office. Deploy protection over the internet using a cloud device-management service (MDM) and an endpoint-protection platform (EPP/EDR).

A practical rollout:

1. Inventory the laptops: identify who owns each device, its operating system, and whether it’s company-managed or personal.
2. Choose your management route: use your existing MDM/RMM if it can install software and enforce security policies remotely. If you don’t have one, set up cloud MDM and enroll the laptops.
3. Enroll and protect devices remotely: assign the endpoint-protection app and configuration to a small pilot group first, then expand in batches. For new company-owned devices, use automated enrollment during setup so protection arrives before staff start working. Apple Business Manager, for example, works with an MDM service to enroll and manage organization-owned Apple devices remotely. (developer.apple.com)
4. Make enrollment part of access: require devices to be enrolled and reporting as compliant before they can access company email, files, or other sensitive resources.
5. Check that it worked: confirm each laptop appears in the security console, is checking in, and has current protection. Follow up on devices that haven’t checked in; remote laptops may connect only intermittently. (cisa.gov)
6. Plan for unmanaged or personal laptops: don’t assume you can silently manage them like company-owned devices. Use an approved enrollment process, limit access to company data, or provide a managed device.

If you use Microsoft Intune and Defender for Endpoint: Microsoft’s current setup supports onboarding Windows devices through Intune policies, while macOS requires deploying the Defender app and configuration. Intune can also use device-risk information to mark devices noncompliant and restrict access. (learn.microsoft.com)

In short: cloud management + remote enrollment + staged deployment + access controls—not an office visit.

The core approach is to manage the laptops remotely through a cloud-based device management tool, since a remote device will never reach your office network. I've assumed Windows devices and Microsoft Intune/Defender, which is the most common setup. Tell me your platform or tooling if it's different.

1. Get the laptops enrolled in device management first
Remote laptops need a cloud-based management agent before you can push anything. This also allows you to push updates and policies remotely. Intune is one option, and it keeps an inventory of devices and can ensure compliance, for example by blocking company email on devices without a lock screen or encryption.

2. Connect your endpoint protection product to that management tool
With Defender, Microsoft Intune is the recommended approach for cloud-native and Intune-managed environments. Before creating policies, check permissions. The required roles are Endpoint Security Manager in Intune and Security Administrator in Microsoft Entra ID. You also need to turn on the Intune connection in the Defender portal under its advanced endpoint settings. Other products, such as Endpoint Central or Cisco's AMP-based stack, follow a similar pattern of agent push plus central policy.

3. Create the onboarding policy and assign it to remote devices
In Intune, go to Endpoint security > Endpoint detection and response and deploy the preconfigured onboarding policy for Windows. It deploys immediately to the relevant Windows devices and appears under EDR policies, Summary tab. Assign it to a device group that includes your remote staff's laptops.

4. Add the antivirus settings separately
Don't assume onboarding alone protects the machine. Microsoft's guidance is that onboarding does not configure antivirus, firewall or attack surface reduction settings. Create an Endpoint protection profile for those, and check for duplicate or conflicting policies. Microsoft says all Intune policy types have equal priority, and a setting that receives different values from several policies might fail to apply.

5. Pilot, then roll out
Start with a small group of remote users on varied hardware. Confirm that agent overhead is acceptable on older machines and that protection still works when the device is off the corporate network. Then widen the rollout in stages.

6. Verify coverage from the cloud side
Devices can take a while to appear. Once synced, devices will appear in the Defender portal within a few hours of the policy applying. If a laptop is missing, trigger a manual sync from the Intune device record. The Defender device configuration management page also shows an Onboarded via Intune card that provides a high-level view of your onboarding rate. Check that the pilot devices show a successful status in Intune before you assign the policy more broadly.

7. Don't rely on the VPN, and cover patching too
A VPN doesn't replace device management. A VPN can protect connectivity to selected corporate resources, but it does not replace endpoint management. Patching matters for the same reason: waiting for an employee to reconnect to the internal corporate network before updating a laptop can create unnecessary exposure. Set update rings in the same management tool so updates reach remote machines automatically.

8. Consider data controls and offline enforcement
If you need to control USB use or data movement, look for an agent that enforces policy without a network connection. One vendor's guidance says offline enforcement should be a benchmark when evaluating products, since a user copying files to a drive on a plane should still trigger policy.

Practical checklist

• Enroll all remote laptops in Intune (or your MDM) and confirm they report as compliant.
• Enable the Defender–Intune connection and assign the EDR onboarding policy.
• Create an antivirus/endpoint protection profile.
• Pilot with a few remote users, then expand.
• Track onboarding rate and fix devices that never check in.
• Set up patching and, if needed, USB/DLP controls.

To deploy endpoint protection to staff who never visit the office, you must move away from traditional, network-dependent management tools and adopt cloud-native, internet-based deployment strategies.

Since you cannot physically touch these devices or rely on a corporate VPN for initial setup, follow this recommended approach:

1. Choose a Cloud-Native Security Platform

For remote workforces, you need an Endpoint Detection and Response (EDR) or Endpoint Protection Platform (EPP) that is managed entirely through the cloud.

• Why: These solutions do not require a VPN to receive policy updates, threat intelligence, or security patches. They communicate directly with the vendor’s cloud console over the public internet.
• Examples: Solutions like Microsoft Defender for Endpoint, SentinelOne, or Sophos Intercept X are built for this distributed model.

2. Leverage Mobile Device Management (MDM)

Use an MDM solution (such as Microsoft Intune, Jamf, or similar) to manage the installation remotely.

• Zero-Touch Deployment: MDM platforms allow you to push the security agent to laptops remotely without the user needing to manually install it.
• Automated Enrollment: If you are issuing new laptops, use "Autopilot" (for Windows) or "Automated Device Enrollment" (for macOS) to ensure the security agent is pre-installed as soon as the user connects to the internet.
• Compliance Enforcement: You can set policies that prevent the device from accessing corporate resources (like email or files) until the endpoint protection agent is installed and reporting a "healthy" status.

3. Implement a Phased Deployment Strategy

Avoid pushing security agents to everyone at once, which can lead to software conflicts or performance issues.

• Pilot Group: Start by deploying to a small, diverse group of 5–10% of your users to ensure stability.
• "Detect-Only" Mode: Initially, set the EDR policies to "Detect Only" or "Audit" mode. This allows you to identify what software the agent might flag as suspicious without accidentally blocking legitimate business applications.
• Full Prevention: Once you have verified that the agent is stable and isn't interfering with day-to-day work, roll it out to the rest of the company and enable full prevention/blocking features.

4. Beyond the Software (Best Practices)

• Don't rely on VPNs for security: Modern remote security operates on a Zero Trust model. Assume the home network is insecure. The endpoint protection agent on the laptop should be the primary line of defense, regardless of where the user is connected.
• Automate Patching: Ensure your management platform is set to automatically push operating system and third-party application patches. Remote users often forget to update, making automated patching critical.
• Communication: Send clear instructions to your staff. Explain that this software is for their protection and is a requirement for company equipment.

Summary Checklist for IT:

1. Select a cloud-managed EDR/EPP.
2. Use an MDM/UEM tool to push the agent silently.
3. Run a pilot to validate compatibility.
4. Enforce compliance policies so only protected devices can access company data.

You don’t need staff to bring laptops into the office. Deploy endpoint protection through a cloud-based device-management service (MDM), so enrolled laptops receive the protection agent and security settings over the internet. For a Microsoft environment, Microsoft recommends Intune for cloud-native onboarding and management of Defender for Endpoint.¹

A practical rollout:

1. Check your inventory and prerequisites. Identify each laptop’s operating system, ownership, current management status, and connectivity requirements. Confirm the endpoint-protection licenses and enrollment setup are in place.
2. Use your MDM to deploy and configure protection. Assign the agent and security policies to device groups. For Microsoft Defender for Endpoint, you can choose the operating system and deployment method in the Defender portal, then use Intune or another supported management tool to onboard devices.¹²
3. Test with a small pilot. Verify that the agent installs, reports into the security console, updates, and applies policies while devices are off the corporate network. Expand in stages after the pilot checks pass; Microsoft recommends a ring-based rollout.²
4. Handle devices not yet enrolled. Send staff a secure enrollment link or instructions, or arrange a remote support session. Avoid sending onboarding keys or sensitive deployment packages through ordinary email; use your approved secure channel.
5. Monitor coverage and exceptions. Track which laptops are onboarded and healthy, investigate devices that stop reporting, and make access to company data conditional on meeting your security requirements where possible.³

For company-owned Apple laptops, Apple Business Manager can automate enrollment into an MDM service, allowing IT to configure and manage devices remotely.⁴ For devices that cannot be reached through your management system, use the vendor’s supported manual onboarding method as a fallback, then move them into centralized management.

Sources
¹ Microsoft, Identify your architecture and select a deployment method for Defender for Endpoint — https://learn.microsoft.com/en-nz/microsoft-365/security/defender-endpoint/deployment-strategy
² Microsoft, Onboard devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-gb/microsoft-365/security/defender-endpoint/onboarding
³ CISA, Technical Reference Architecture — https://www.cisa.gov/resources-tools/services/technical-reference-architecture-tra
⁴ Apple, Device Management — https://developer.apple.com/documentation/devicemanagement