Jamf Pro, JumpCloud and Microsoft Intune. It detects which of them it can reach before every investigation and works with whichever you’ve connected.

Yes, within the limits you set. Low-risk fixes, like clearing caches or unlocking an account, run once the employee agrees. Disruptive ones, like restarts or OS updates, run at a time the employee chooses. Locking, wiping or suspending always can require approval from a manager or IT lead.

It runs the same playbook everywhere: identify the device, diagnose, fix, verify. The checks available vary by platform, and it tells you upfront what it covered on each. Jamf goes deepest on Apple devices, JumpCloud spans Mac, Windows and Linux, and Intune covers the Windows fleet. If a check isn’t available on a platform, it says so and routes that part to someone with console access.

It can do so for verified recovery cases. Releasing a FileVault or BitLocker key needs a strong identity check, every release is logged, and the key is never written into the ticket.

Yes. It checks device encryption, OS versions, passcode status, policy application, and patch currency against available MDM data. It identifies missing updates, unsupported devices, and compliance gaps, while flagging devices it cannot verify because of stale data or limited platform access.