They can be effective or intrusive, it depends on the implementation. I've used one (Fleetsmith) on MacOS and configured it to be non-intrusive. It was able to

They can be effective or intrusive, it depends on the implementation. I've used one (Fleetsmith) on MacOS and configured it to be non-intrusive. It was able to enforce some of the items in this blog post (encrypted drives with key escrow, screen saver with password time), and it also was able to require latest updates for some software such as Chrome, Docker, Slack, etc. We don't use this for engineers only, we use endpoint security for every laptop in the company. We did decide to set up a different profile for engineers though, and remained thoughtful about what to enforce. Additionally, we set up a canary profile to roll out new changes or policies and listen to feedback and problems before blindly rolling out changes to every developer machine in the company.