Yeah, it's a bit of a choice, but a happy user that takes care of the friction is a win for me. From an MDM perspective all we require is that your work machine

Yeah, it's a bit of a choice, but a happy user that takes care of the friction is a win for me. From an MDM perspective all we require is that your work machine can run osquery. We host the rules in an internal repo so if someone wants to use something we don't support they have to write the compliance checks themselves ahead of time (and get them approved, we do help with that). I also think that monoculture isn't really the best way, but neither is an abundance of variations causing uncertainty. We need to be able to plan ahead and look ahead, and have enough of a standard to operate. Luckily, convincing stakeholders that "but we imaged this workstation last year" isn't a valid argument in any scenario (security, productivity, DLP) wasn't all that hard, and the jump from there to "images and MDM are all fun, but near realtime posture verification is the only way" was made with relative ease. Most people still stick to the "supported and automated" provisioned workstations, but those who want something else can have it, if they deliver on their compliance, non-friction and actual work. Best of all worlds.