Lessons from freee’s Corporate IT Operations: Endpoint Management, Security, Automation, and TCO

Overview

freee’s Corporate IT operations are notable because the company does not optimize only for administrative simplicity.

Instead, its endpoint strategy attempts to balance:

employee productivity and usability
security
IT operational efficiency
automation and self-service
total cost of ownership across the entire device lifecycle

The most interesting principle is that employee choice is preserved while MDM, automation, layered security, and standardization are used to absorb the additional operational complexity.

1. Employees can choose Mac or Windows

As a general rule, new employees can choose:

Mac
Windows
Japanese keyboard layout
US/English keyboard layout

Rather than forcing everyone onto a single platform, freee allows employees to start with tools they already know so they can focus on their work more quickly.

However, not every use case is based on employee choice.

For outsourced call-center operations, for example, the company may specify Chromebooks.

Reasons include:

keeping data off the local device
improving security
reducing acquisition cost
using the devices as temporary loaner machines

Key idea

freee separates:

areas where employee preference should be respected
areas where the company should mandate a device for security or cost reasons

The goal is not maximum administrative standardization at any cost.

2. Use the best MDM for each OS

freee uses different management platforms for different operating systems.

OS	Management platform
macOS	Jamf Pro
Windows	Microsoft Intune
ChromeOS	Google’s native management tools

For Macs, freee also combines:

Apple Business
Jamf Connect

Jamf Connect links corporate identity with Mac login and simplifies the first-login and provisioning experience.

Key idea

Tool consolidation is not treated as a goal by itself.

The priority is to use the management capabilities that work best for each operating system.

3. Move device setup from IT to the employee

Previously, the help desk prepared devices before handing them to new employees.

Although configuration and software installation were already automated, IT staff still had to monitor the process and verify that provisioning had not stopped midway.

freee moved to a self-service model.

New employees now set up their own devices during onboarding orientation.

The user follows the on-screen workflow while the system automatically applies:

device configuration
security policies
required applications
authentication settings

Benefits

less help-desk work
better scalability as headcount grows
easier transition to fully remote provisioning
a clearer onboarding experience for users

Important principle

This is more than automation.

freee also changed who performs the workflow.

Instead of IT operators watching automated provisioning jobs, employees can complete provisioning themselves through a controlled process.

4. Layer security across endpoint, identity, and network

freee uses Palo Alto Networks Cortex as its EDR platform.

It also combines technologies such as:

MDM
EDR
OneLogin
cloud-based VPN
native OS security controls
cloud-first business applications

Although Mac and Windows use different MDM products, many security controls are shared across platforms.

The architecture follows a defense-in-depth model:

Endpoint
Identity
Network

freee also minimizes local data storage by performing much of its business activity in cloud services such as Google Workspace.

Temporary files stored on desktops or in download folders can be automatically removed when the device is restarted.

Key idea

Security is not treated as an endpoint-product problem.

It is designed across:

endpoint
identity
network
data handling

5. Do not rely on employees to install OS updates voluntarily

Windows

Microsoft Intune is used to automate OS updates.

Mac

Previously, IT announced updates through Slack and manually followed up with users who had not upgraded.

The organization has moved toward enforcement through Jamf Pro.

If a Mac is not updated by the specified deadline, the update can be forced and the device restarted automatically.

freee also limits the set of supported OS versions instead of allowing indefinitely old versions to remain in service.

Key idea

Security operations should not depend on whether users remember to comply.

Instead of:

Slack announcement
      ↓
Check non-compliant users
      ↓
Individual reminders

the target model is:

Policy
  ↓
MDM
  ↓
Deadline
  ↓
Mandatory update

6. Test major OS releases before broad deployment

A major OS release is not immediately deployed to every employee.

freee first validates it on test devices.

Typical validation areas include:

internal systems
business applications
VPN
authentication
MDM
EDR
peripherals
business workflows

Only after compatibility has been confirmed is the update rolled out more broadly.

This practice applies to both macOS and Windows.

Basic flow

OS Release
    ↓
Test Devices
    ↓
Compatibility Test
    ↓
Approval
    ↓
Phased Deployment
    ↓
Mandatory Update

7. Move application deployment toward self-service

For Macs, freee is working toward greater use of Jamf Pro Self Service+ and similar mechanisms.

The idea is to provide a catalog of company-approved applications from which employees can install what they need.

Traditional model

Employee
   ↓ Request
IT Help Desk
   ↓ Push
Device

Self-service model

Approved App Catalog
          ↓
      Employee
          ↓
        Install

Benefits

fewer help-desk tickets
faster software delivery
reduced shadow IT
standardized approved software
lower Corporate IT workload

Device Lifecycle and TCO

8. Evaluate devices by TCO, not only purchase price

freee evaluates devices from a total-cost-of-ownership perspective rather than only their acquisition price.

A practical model is:

TCO
 = Purchase Cost
 + Management Cost
 + Support Cost
 + Failure / Repair Cost
 + Help Desk Cost
 + Replacement Cost
 - Resale Value

A device with a higher initial price may still be less expensive overall if it:

lasts longer
fails less often
has better battery longevity
requires less administrative effort
retains a high resale value

9. Revisit replacement cycles based on actual device performance

Historically, freee used approximately the following replacement cycles:

Device	Replacement cycle
Mac for engineers	2 years
Mac for non-engineers	3 years
Windows PC	3 years

After the transition to Apple silicon, freee found that Macs could remain practically usable for around four years and began reconsidering the previous lifecycle rules.

Key idea

Do not replace a device only because an arbitrary number of years has passed.

Consider:

performance
battery condition
failure rate
OS support
security
user workload requirements

10. Purchase devices instead of leasing them

freee purchases its business devices instead of relying on leases.

A lease creates a fixed return schedule.

Ownership allows the company to decide how long a device should remain in service based on its actual condition.

Benefits of purchasing

extend device life when appropriate
keep good devices in service longer
reuse devices returned by departing employees
sell devices when appropriate
capture residual value

11. Reuse devices returned by departing employees

Returned devices can go through a lifecycle such as:

collection
cleaning
erasure
reprovisioning
reassignment

The endpoint is treated as a reusable corporate asset rather than a one-user disposable item.

12. Sell devices at the end of internal use

Devices that are no longer needed internally are not necessarily discarded.

If they still have market value, they can be sold.

This is especially relevant for Macs because of their relatively strong resale value.

A better economic model is therefore:

Net Device Cost
 = Purchase Price
 + Operating Cost
 - Resale Value

Thinking about the device’s exit value at the time of procurement is an important TCO discipline.

13. Review maintenance contracts as well

freee previously used AppleCare+ but later moved to a reseller maintenance service that better matched its operational needs.

The lesson is that support contracts should also be reviewed periodically rather than treated as permanent defaults.

What is especially impressive about freee’s Corporate IT model

1. Employee experience is not sacrificed for administrative convenience

The company accepts some additional management complexity in exchange for allowing users to work with familiar tools.

2. Automation evolves into self-service

The goal is not merely to automate work performed by IT.

It is to create safe workflows employees can execute themselves.

Examples include:

self-provisioning
self-service application installation

3. Human follow-up is replaced by policy enforcement

Instead of relying on messages and reminders, technical controls move devices toward the desired state automatically.

4. The best solution is selected for each operating system

Standardization does not necessarily mean using one vendor or one product.

Operational standards can be consistent while implementation tools differ by platform.

5. Security is layered

Endpoint, identity, network, and data controls are combined rather than relying on a single security product.

6. The full endpoint lifecycle is optimized

Purchase
   ↓
Provisioning
   ↓
Operation
   ↓
Reuse
   ↓
Resale

The entire chain is managed as part of TCO.

Checklist for applying these ideas in another organization

Device

Consider Employee Choice for Mac / Windows
Define standard models by job role
Consider purpose-specific Chromebooks or similar devices
Define which options users may choose, such as keyboard layout

MDM

macOS: Jamf Pro or equivalent
Windows: Microsoft Intune or equivalent
ChromeOS: Google Admin Console or equivalent
Standardize policy objectives across operating systems

Identity

Standardize on an IdP
Connect device login with corporate identity
Expand SSO
Consider MFA and passkeys

Endpoint Security

Deploy EDR
Minimize local data storage
Enforce disk encryption
Provide remote lock and wipe capabilities

Provisioning

Move toward zero-touch deployment
Introduce self-provisioning
Incorporate device setup into onboarding

Patch Management

Manage OS updates through MDM
Set update deadlines
Enforce updates after the deadline
Validate major OS releases before organization-wide rollout

Application Management

Define approved applications
Build a self-service software catalog
Reduce individual installation requests

Lifecycle / TCO

Do not determine replacement only by device age
Track failure rates
Track battery health
Reuse returned devices
Include resale value in TCO
Compare purchase and lease models using TCO
Review maintenance contracts periodically

Summary

The most useful lesson from freee’s endpoint operations is not the use of any particular product.

It is the operating model:

Preserve employee choice while building management, security, and automation controls behind the scenes.

A second important principle is:

Reduce operations that depend on people remembering what to do, and use policy plus technology to move devices automatically toward the desired state.

Finally, endpoint management is treated as a complete lifecycle:

Purchase → Provisioning → Operation → Reuse → Resale

This turns Corporate IT from simple PC administration into a combination of:

Employee Experience + Security + Automation + Cost Optimization

References

Why freee intentionally operates a mixed Mac and Windows environment
https://macfan.book.mynavi.jp/business/article/112562/
Best practices for managing mixed Mac and Windows environments at freee
https://macfan.book.mynavi.jp/business/article/112584/
Mac TCO, replacement cycles, resale value, and device lifecycle management at freee
https://macfan.book.mynavi.jp/business/article/112596/

This note reorganizes the key ideas from the above articles from a Corporate IT and endpoint-operations perspective.