A global rollout ends. The groups we left behind do not
Every corporate device in a worldwide retail group moved to a new management platform. The part that still mattered two years later was not the migration.
A global retail group
A global retail group moved its endpoint management from one platform to another for corporate users worldwide, across Windows and macOS, and out into the store estate. A migration of that size has an end date. The capability to keep developing it afterwards does not arrive by itself, so it was built deliberately.
The challenge
A worldwide device migration looks like a project and behaves like an operating model change.
The technical work is real: two operating system families, several deployment types, application protection reaching every corporate user, and a store estate whose devices are not office laptops and cannot be treated as though they were. But a group of local brands is not one organisation. Each has its own operations, its own pace and its own view of what good looks like.
The failure this design was aimed at is the common one. The programme completes, the central team is disbanded or moves on, and the local brands are left holding a platform they had no hand in shaping. Development stops. Innovation stops. Within a year the estate is drifting back toward what it replaced. The migration succeeds and the capability quietly does not.
What we did
Move the estate, both operating systems
Migration of corporate endpoint management to a single platform, supporting Windows and macOS communities across the group rather than solving for the majority and leaving the rest behind.
Application protection for every corporate user
Rolling out protection to the whole corporate user base worldwide, which is the point where a device programme becomes a security control rather than a convenience.
Several deployment routes, one platform
Co-management, Autopilot in both hybrid and cloud-joined forms, and virtual desktops, so the way a device is provisioned fits its context instead of forcing one route onto every case.
Build the groups that outlive the programme
Special interest groups in the local brands, owning continued development, innovation and operation of cloud workplace services after the migration itself had finished.
How it works
Windows and macOS, not Windows then macOS
Both communities supported across the group. A workplace standard that covers most people is not a standard, it is a majority.
Protection at the application layer
Application protection deployed to corporate users worldwide, so the control travels with the data rather than with the device.
The store estate counts
Development extended into store environments, so colleagues on the shop floor consume current technology standards instead of whatever was deployed last.
Special interest groups in the brands
Ownership placed with the local brands, formalised as groups with a remit to keep developing the service rather than only to run it.
Continuation is a design choice
A programme that ends without a home for the work is a programme that has to be repeated. The handover structure was part of the design, not a closing task.
Central platform, local development
One standard held centrally, with development happening close to the brands consuming it. The split that lets both move at their own pace.
Technologies
Intended outcome
Corporate endpoint management across the group runs on one platform, covering both operating system families, with application protection reaching the corporate user base and current standards extended into stores.
The part worth reporting is the structure rather than the rollout. Special interest groups in the local brands hold continued development, innovation and operation of cloud workplace services. The platform has somewhere to be improved from.
This is the same principle that shows up in the platform work elsewhere on this site. Leaving capability behind is not the polite ending to an engagement. It is the difference between a change that holds and one that has to be made again.
The organisation is described by business area rather than named. This was an employed role rather than a client engagement of Hernandez Ortiz B.V. No device counts, brand names, estate figures, internal architecture or colleague names are published.
Related work
Nobody could say which subscriptions were compliant
A global tenant, hundreds of applications moving to Azure, and no single view of whether any of it met the standard.
Seven locations, 350 people, two delivery centres, two years
The hardest consolidation problems are not technical. Support work for a whole European region moved into two centres, and every part of it was about people.
The platform was built. Teams still could not get onto it
A managed cloud platform, finished and waiting, and workload teams queueing to onboard onto it. The constraint was never the technology.