Managed support teams are judged by what they can prove. When a customer asks whether its laptops and phones are in good order, “the console looks green” is not evidence. EndpointOps, the informal name for looking after user hardware across its entire working life, gives a support desk a vocabulary for better answers. Below are eight signals, each with the reasoning behind it, that a support provider can track and show to a customer without needing a large toolset.
1. Management coverage over a thirty-day window
The opening figure is the proportion of devices that reported at least once in the past month. In the management product the Atlas uses as its example, a month without contact ends a device’s compliant status, which makes that period a sensible yardstick. Count against the full list of devices the customer owns, not against the list the console already holds. A coverage figure of 70 percent that is honest beats a 100 percent that was computed from the survivors.
2. Protection-agent health over seven days
An agent can be installed and still be silent. The Ops Atlas notes that one major endpoint-security product marks an agent inactive after a week without contact, and it separates a healthy sensor from a mere “antivirus is on” flag. Report two figures side by side, installed and reporting. The gap between them is the work queue.
3. Recovery keys stored, as a share of encrypted devices
Encryption without stored keys is a liability on a quiet day and a crisis on a bad one. In the example the Atlas works through, a fleet of 1,200 devices had 1,164 encrypted and 1,131 with a saved key, which gives 94.3 percent. Whichever way your own figure falls, the rule of thumb is to store the key before the disk is locked. The July 2024 endpoint outage that crashed millions of Windows machines made this tangible, because recovery on encrypted machines depended on retrieving that key for every single one.
4. Share of access coming from unmanaged devices
Support teams often forget to look at the other side of the fence. Measure how many sign-ins reach customer systems from hardware that is not under management at all. If the percentage is not falling month by month, conditional-access rules are either missing or being bypassed. This signal ties the device layer to real exposure rather than to inventory pride.
5. Supported-operating-system share
Customers rarely know how many machines still run an unsupported release. Windows 10 reached its end of mainstream support on 14 October 2025, and the Atlas quotes the paid extension at $61 a device for year one, then twice that, then twice again, capped at three years. Take an imaginary customer with 300 devices that first buys cover in year two: the bill for that year is $54,900. Showing the arithmetic turns an abstract risk into a budget line the customer can decide on.
6. Key retrieval time, measured by drill
Choose a device at random once a month and ask a support engineer to recover its key while someone times it. The number you record is the real service level for a locked-out user. Treat a slow drill as a defect in procedures rather than in people: perhaps the key store is hard to reach, or the right permission sits with only one person. The Atlas points out that as many as seven stock directory roles are allowed to read stored BitLocker keys, which is itself worth checking against your own list of key holders.
7. Administrative blast radius
This is the signal customers least expect to be asked about. Who can erase devices, and how many can they erase before somebody notices? In the 2026 incident the Atlas discusses, press accounts that the companies did not confirm described a compromised administrator account used to create a new top-level admin and wipe devices through the console. A US government alert a week later advised minimal-rights roles, logins that phishing cannot easily defeat, and a second approver for wipes. The multi-admin approval feature in the Atlas’s example product reaches further, taking in app and script changes, policy edits and role changes alongside destructive actions, and daily caps of 500 wipes, 1,000 retirements and 1,000 deletions apply. Report whether the second-approver rule is on, and who sits in the approver group.
8. Reconciliation delta
The last signal is the difference between what the console says and what three independent sources agree on. Report it weekly. A shrinking delta shows the process is working; a growing one means devices are entering the fleet by a side door. It is also the easiest figure to explain to a non-technical sponsor, since it is just the gap between two counts.
Putting the eight to work
Do not launch all eight at once. A reasonable order is coverage, agent health, key storage and the reconciliation delta in the first month, then the access share, the operating-system share and the retrieval drill, and finally the administrative review. The Atlas frames this as a rising maturity ladder, from unknown devices through enrolled, enforced, reconciled and resilient. For a deeper look at the source of these ideas, see its entry describing EndpointOps and its boundaries, which also lists the topics, such as patch scheduling and identity, that belong to other services.
Where these signals fit in a support engagement
Metrics only matter if they feed decisions. Link each signal to an action and an owner, and review them on a cadence the customer can attend. Teams that are building the cultural side of this work can draw on the article on principles behind dependable software delivery, and those who come from infrastructure automation may like the discussion of why operations engineers should move from scripts toward reliability engineering. Whichever route you took into the job, show your working and measure what actually breaks.
