Building a Zero-Trust Remote-First Governance Framework

In a global enterprise, the traditional “Perimeter-Based” security model is obsolete. With a remote-first workforce, the endpoint is the new perimeter. Hexnode UEM provides the technical framework to govern devices that reside permanently outside the corporate firewall.

This document details the implementation of Zero-Trust identity gates, Managed App Configurations (AppConfig), and specialized remote-first compliance profiles that ensure security parity between home-office and corporate environments.

Logical Architecture: The Native Remote-First Engine

Hexnode operates as a cloud-native management plane, utilizing standard OS-level protocols to govern devices over any internet connection, eliminating the need for complex internal routing or VPN backhauling for management traffic.

• The Cloud Notification Gateway: Hexnode utilizes native OS push notification services (APNs for Apple, FCM for Android, WNS for Windows) to maintain a persistent, low-latency control channel regardless of the user’s IP address.
• The Identity Bridge: Integration with enterprise IdPs (Microsoft Entra ID, Okta, Google Workspace) ensures user identities and group memberships to dictate device management scopes and policy enforcement.
• Global Content Delivery: Hexnode leverages standard App Store infrastructures (Apple VPP, Managed Google Play), its own global cloud CDN and DAFS (Distributed Apps and Files Server) to deliver Enterprise binaries rapidly without routing through a corporate VPN.
• Dynamic Compliance Engine: Hexnode continuously evaluates device health against baseline policies (e.g., OS version, passcode presence, encryption status) to enforce real-time access restrictions.

Core Remote-First Capabilities

Hexnode extends governance beyond simple device lockdowns, focusing heavily on zero-touch productivity and data boundary enforcement.

1. Managed App Configuration (AppConfig)

To ensure remote productivity, applications must be pre-configured without requiring the user to read a manual or call the helpdesk.

• Zero-Touch Config: Administrators programmatically deploy XML/JSON key-value pairs directly to managed apps (like Slack, Microsoft Teams, or secure browsers) via Hexnode’s App Configurations policy.
• Technical Outcome: Upon the first launch, the app is instantly populated with the corporate server URL, user email (using the %email% wildcard), and necessary security toggles.

2. Per-App VPN & Split-Tunneling

Remote-first governance requires securing corporate data without infringing on user privacy or bottlenecking home bandwidth.

• Selective Tunneling: Through Hexnode’s Per-App VPN policies (supported for iOS and macOS), administrators define specific, vetted enterprise applications that will automatically trigger the corporate VPN (e.g., Cisco AnyConnect, OpenVPN, F5) upon launch.
• Performance Impact: Latency-sensitive personal traffic or Zoom calls route directly to the local ISP, while sensitive internal app data is securely tunneled to the corporate VPC.

3. Identity-Centric Compliance Gates (Conditional Access)

Compliance for remote devices is directly tied to the user’s active session state via IdP integration.

• Partner Compliance Integration: Hexnode natively acts as a compliance partner for Microsoft Entra ID Conditional Access. Hexnode continuously feeds the device’s exact compliance status to Entra ID.
• Instant Block: If Hexnode detects a remote device is jailbroken/rooted, missing required apps, or fails passcode rules, it flags the device as non-compliant. Entra ID’s Conditional Access immediately intercepts this signal and blocks the user’s tokens, preventing access to corporate Office 365 or SaaS apps until the endpoint is remediated.

Comparison: Legacy Mobile Management vs. Remote-First UEM

Privacy Governance for the Home Office

Managing devices in residential environments requires a strict “Privacy-First” technical posture to meet global labor laws and GDPR requirements.

• Policy-Driven Location Tracking: Hexnode allows administrators to disable location tracking entirely for BYOD (Bring Your Own Device) deployments, enforcing it only on Corporate-Owned assets.
• Selective Remote View: Hexnode’s Remote View feature natively prompts the end-user for explicit permission before the session begins on modern OS platforms, ensuring IT cannot secretly monitor a home worker’s screen.
• The “Right to Disconnect” Logic (Time-Based Automation): To comply with strict global labor regulations (e.g., in France or Germany), Hexnode leverages its Automate feature to enforce a “Digital Timeclock” on corporate devices. Rather than relying on static rules, administrators can configure scheduled workflows that dynamically associate or remove restriction policies based on an employee’s specific working hours.

Scale Impact & ROI

Implementation Checklist

• Zero-Touch Portals: Link Apple Business Manager, Android Enterprise, and Windows Autopilot to the Hexnode tenant for direct-to-user shipping.
• Managed App Config: Navigate to Apps > App Configurations and map the XML key-value pairs for core productivity suites (e.g., setting the %username% and %email% wildcards).
• Conditional Access: Link Hexnode to Microsoft Intune/Entra ID via the Admin > Integrations tab to enforce identity-based compliance blocks for Office 365.
• Per-App VPN Setup: Create VPN configurations under Policies > Network > Per-App VPN and map them exclusively to secure enterprise applications.
• Work-Hours Policy (Right to Disconnect): Configure automations in the Automate tab to restrict policy application strictly to regional working hours.