Situation
A retail chain with 20 stores across Lithuania and about 300 employees. Each store has 2-4 checkout computers, a manager’s laptop and a phone; another 40 or so phones and tablets are with regional managers, logistics and sales representatives. The devices were bought at different times and configured on site, each in whatever way the person could manage. Antivirus was whatever came installed from the factory, often with an expired licence.
Problems built up from two sides. First, any checkout fault meant a trip to the store for an IT employee, sometimes 150 km each way. Second, phones with access to email, pricing and customer data were completely uncontrolled: no screen lock, personal apps installed, and no way to wipe a phone if it was lost. Over one year three phones and one laptop were lost, and nobody knew exactly what was on them.
The finance director contacted us after an internal audit that named device management as an uncontrolled risk. The deadline was the start of the retail season.
What was needed
- One console for all devices: checkouts, computers, phones and tablets.
- Remote device lock and wipe within minutes, not days.
- Protection that stops an attack on a checkout computer without an IT employee getting involved.
- App policies: what may be on a phone with company data and what may not.
- Fewer trips to stores and a clear process for preparing a new device.
- Deployment without stopping trading: checkouts cannot be shut down during opening hours.
What we did
Weeks 1-2: inventory and policies
We compiled a list of all devices: 212 in total, 38 of which were not officially assigned to anyone. Together with the finance director and the head of retail we agreed on policies: screen lock and encryption on all phones, a separate work profile with company apps, a list of prohibited apps, and on checkout computers only the checkout application and a browser limited to approved addresses.
Weeks 3-5: MDM deployment
We deployed mobile device management based on Microsoft Intune. The company already had Microsoft 365 licences, and Entra ID became the single source of identities. We enrolled phones remotely: a manager received instructions, and within 10 minutes the device appeared in the console with a work profile. We connected checkout computers at night after the stores closed, 3-4 stores per night; not a single checkout was shut down during the day.
Weeks 5-7: SentinelOne Singularity
We installed SentinelOne Singularity on all computers, checkouts and phones. We chose it for its autonomous operation: a checkout computer often lacks a stable internet connection, and SentinelOne stops and rolls back an attack locally, without a connection to the console. Deployment ran through the MDM, so no extra trips were needed. In the first week the console showed three outdated remote-access programs that someone had installed on checkouts at some point; they were removed.
Week 8: processes and handover to managed support
We prepared a procedure for setting up a new device: it arrives from the supplier directly at the store, connects itself to the MDM at first power-on and receives its full configuration. The procedure for a lost device: the manager calls our helpdesk, and the device is locked and wiped from the console. We took over the whole estate into managed IT services with a helpdesk. For store managers we prepared a one-page guide: whom to call, what to say, and what not to do if an unusual message appears on the checkout screen. The company’s IT employee remained responsible for the checkout application and the relationship with its vendor, while device health, security and updates are on our side.
Result
Wiping a lost device now takes about 5 minutes from the call to the helpdesk. In the first three months the procedure was used for two phones, and in both cases the data was erased before anyone could unlock them. All 212 devices and their security events are visible in one console, and for the first time the IT employee can say how many devices the company has and what condition they are in.
Visits to stores were cut by half: most checkout faults are resolved remotely, and application updates and configuration changes are pushed from the console. It is measured simply: the helpdesk system records how many requests were resolved remotely and how many required a trip.
“Before, a lost phone was just a lost phone. Now it is a five-minute procedure.”
What we would advise in a similar situation
- Inventory first. Until you know how many devices you have, no console will help.
- For checkouts, choose protection that works without a connection to the console. In a store the internet goes down more often than it seems from the office.
- On phones, separate the work profile from the personal one: employees agree more easily, and a wipe affects only company data.
- Deploy at night and in stages. A few stores per night, and within a month you have the whole network without a single checkout stopped.
