How should organisations balance endpoint controls and identity controls for remote staff?

Balancing device trust with identity assurance for remote staff

The practical answer is to treat remote access as conditional, not automatic. Identity controls establish whether the person or workload is entitled to request access, while endpoint controls determine whether the device and its security state are good enough to receive it. The balance is strongest when both decisions are enforced together, rather than one being treated as a fallback for the other.

A useful way to think about this is that identity answers “who” and endpoint posture answers “from what environment.” Remote staff create more exposure because access often arrives over unmanaged networks, personal devices, or devices that have drifted from policy. If you rely on only one layer, phishing, malware, token theft, and device compromise can turn a valid login into a trusted session.

Where each control layer does different work

Identity controls are the front door logic: strong authentication, conditional access, least privilege, and session controls decide whether the user should be allowed into the environment at all. Endpoint controls are the health and containment layer: device encryption, patching, EDR, local admin restrictions, browser hardening, and device compliance checks reduce the chance that a permitted session is immediately abused.

That division matters because remote work failures usually happen at the seam between the two. A strong identity stack can still be bypassed if a compromised laptop or unmanaged device can present valid tokens, and a hardened endpoint cannot compensate for weak authentication or excessive access. The most resilient design is one where the identity decision is sensitive to device risk, and the endpoint decision is aware of the access being requested.

For broader identity governance and lifecycle context, NHIMG’s Identity Security Programme Guide is a useful way to think about the control stack as a programme rather than isolated tools. For lifecycle and access governance detail, the NHI Lifecycle Management Guide is a strong reference point when access needs provisioning, review, rotation, and removal discipline.

How to set the balance without creating friction or blind spots

The best balance is usually risk-based, not symmetrical. High-value systems should require stronger identity assurance and stricter device posture than low-risk applications. Remote users who access sensitive data, admin functions, or production systems should face a higher bar than staff using low-risk collaboration tools.

In practice, that means device trust should gate access to sensitive applications, while identity assurance should gate the user’s right to request the session. If the device cannot meet a minimum posture, the answer is not to weaken identity controls, it is to step the user down to safer access paths, such as web-only access, read-only access, or a remediated device workflow.

Endpoint and identity teams also need a shared policy vocabulary. If one team defines “compliant device” differently from how the identity platform evaluates conditional access, the organisation gets inconsistent enforcement and hard-to-debug exceptions. The control stack works best when posture signals, authentication strength, and privilege thresholds are coordinated through one decision policy.

What fails first when remote access is over-trusted

Remote staff are often attacked through the easiest bypass, not the strongest control. Attackers commonly target the user with phishing, then reuse captured credentials or session material on a device the organisation has not properly assessed. If endpoint checks are weak, the attacker inherits the user’s trust. If identity checks are weak, the attacker gets in even from a suspicious device.

This is why remote access should never treat a successful login as proof of safety. The real failure mode is when organisations overestimate one control because the other exists somewhere else in the stack. A valid account on an unsafe endpoint is still a compromise path, and a secure endpoint with poor identity assurance is still exposed to impersonation and privilege abuse.

Risk and Threat Considerations

Remote staff create a larger attack surface because access decisions are being made across untrusted networks, variable devices, and user-driven workflows. The main risk is not any single control failure, it is the combined effect of weak identity assurance and weak endpoint posture, which can let phishing, malware, token theft, or unmanaged devices turn normal work access into an attacker foothold.

Failure mechanism: An attacker compromises the user, the device, or the session, then uses the surviving trust layer to make the other layer look legitimate. If conditional access does not actually verify posture, or if endpoint checks do not restrict session scope, the access path stays open after the initial compromise.

Impact: The organisation can lose confidentiality, permit lateral movement, or expose sensitive applications to unauthorised action. The practical consequence is that remote access becomes dependent on assumptions that are hard to see and easy for attackers to exploit.

Practitioner Guidance

What to prioritise: Start with the highest-risk access paths, not the broadest user population. Remote admin access, production systems, finance data, and privileged SaaS access should have the strongest combined identity and endpoint requirements.

What to verify: Check that the identity platform is consuming real endpoint signals, not just enrollment status, and that the endpoint platform can distinguish between compliant, partially compliant, and clearly unsafe devices. If those states collapse into a single “allowed” decision, the control stack is too soft.

Decision rule: If the device cannot be trusted, reduce the session’s scope rather than bypassing the device requirement. If the user cannot prove strong identity, do not rely on endpoint health alone to compensate.

Practitioner takeaway: The goal is not to choose identity over endpoint or endpoint over identity, it is to make each layer strengthen the other so that stolen credentials, compromised devices, and risky sessions all face independent checks.

Related resources from NHI Mgmt Group

• How should healthcare organisations balance fast clinical access with tighter identity controls in remote and hybrid care models?
• Should organisations use remote browser isolation instead of traditional endpoint controls?
• How should organisations balance security with employee productivity in identity controls?
• Why does identity governance matter when organisations are trying to balance security controls with growth and productivity?