Endpoint Management (UEM / MDM)

Patch compliance reported at 98% usually means 98% of the devices that checked in.

The devices missing from the report are not compliant and not non-compliant. They are absent: laptops that have not contacted the UEM service in weeks, machines rebuilt outside the process, kit issued to a leaver and never returned. The percentage looks healthier the more of them there are.

Endpoint detection and response is not device management. They are two different jobs. SECCOM states which agent covers which platform in the fleet, because the answer differs between Windows, macOS and mobile.

Where SECCOM stops. UEM and MDM enforce the state of the device. They do not authenticate the user. That stays with your identity platform, and the two need to be designed to agree.