How VICE replaced a decade of MDM policy debt with declarative infrastructure

The challenge

VICE is a media company with big ambitions: an in-house creative and advertising agency, a studio business that produces commercials, film, TV, and music videos, a TV channel run in partnership with A&E Networks, and a post-production shop that also does work for outside clients.

Like a lot of the media industry, VICE has been through real change in recent years, and its IT organization is leaner today than it used to be. Tomas O’Brien runs day-to-day device management along with one teammate. It’s a small team keeping a global, always-on fleet running.

Their legacy device management tooling didn't make that job easier. It had been in place for years, built up by a long line of admins with scant documentation, and it still carried policies for offices VICE had long since closed. Some of what it enforced didn't make sense anymore, and there was no easy way to tell current configuration from years of accumulated leftovers.

The real problem showed up in a question Tomas found himself constantly asking, “why is this machine in or out of scope for this policy?” Answering it meant tracing an extension attribute, a synced group, a scoped policy. Three separate pieces with a real risk that one had drifted out of sync with the others. Even if there was documentation on how each object was related, it was still an expedition.

The solution

Moving a decade of accumulated policy to a new platform could have been the riskiest part of the project on its own. Instead, the migration was straightforward: Iru's team stayed hands-on throughout, answering questions quickly enough that a two-person IT team never had to worry about the scale of the job, even with a fleet spread across offices worldwide.

Once the fleet was moved over, Iru solved the underlying problem of wondering what devices were in or out of scope by approaching configuration workflows in a completely different way.

That shift extended to how the team thinks about deployment generally. The old platform expected hundreds of manually crafted rules and conditions. The team sometimes manually triggered scripts and commands. Iru's model is declarative. Define the end state you want, and the platform keeps auditing devices and remediating until they match, with no one needing to babysit the process.

Retiring a homegrown onboarding tool

One of the things that model replaced was a homegrown onboarding setup script VICE's IT team had built and maintained over the years, a tool with branching logic and custom prompts for different offices and roles. It worked, but it meant re-validating the whole thing every time Apple shipped a new macOS release, and only a handful of people really understood how it worked under the hood.

When VICE moved to Iru, Tomas's manager asked whether the team would need to rebuild that tool from scratch. Instead, Tomas showed him Liftoff, Iru's first-party Mac onboarding flow: it walks new hires through setup automatically, and Iru keeps it working with each new macOS release, so nobody on the team has to test or rewrite it every cycle.

One less platform, one less thing to relearn

VICE's fleet is mostly Mac, with a smaller slice of Windows devices concentrated among finance and a few executives. Running a separate MDM for that slice meant a second admin console and a workflow the team had to relearn every time it touched those machines, for a small fraction of its users. Consolidating onto Iru made that go away.

It also changed how confident Tomas feels about the Windows side day-to-day, since he now gets the same visibility into that platform that he has on Mac. Before, it was more efficient to just ask people to download apps and install updates rather than going into the long-untouched Windows management tool and trying to make it work.

The consolidation also means routine app rollouts stop being platform-specific work. When VICE needed everyone on Adobe Sign, Acrobat had to go out to both Mac and Windows. One job instead of two, and one Tomas didn't have to think much about at all.

Migrating EDR vendors without a coverage gap

The same declarative approach carried VICE through a vendor migration that could otherwise have been risky. Moving from Carbon Black to SentinelOne meant getting a new agent onto every computer without leaving any device unprotected in between. Running both agents at once caused conflicts, so timing mattered.

The team pushed SentinelOne's configuration profiles to the whole fleet first, so the groundwork was in place everywhere before the action began. Then they set up a custom script and custom app, deployed to all devices: if Carbon Black is present, remove it, and for the custom app: if SentinelOne or Carbon Black are not installed, install SentinelOne.

Because Iru keeps all the audit and enforce logic within one Library Item, deploying this was drag and drop. And the actual swap was fast: Iru’s endpoint agent could get most computers moved through it in 2 to 20 minutes. And the agent’s auto-remediation meant that it kept trying until it succeeded. No intervention.

Directory groups drive scope

VICE already manages access to apps through Okta user groups. There was previously no easy way to sync those same groups to device management and use them to scope policies. To attempt it would mean syncing a profile attribute, building a matching group, and keeping the two in sync manually—effectively making user groups out of the question as the source of truth.

Connecting Okta to Iru made user groups the source of truth across identity and devices:

The integration took about 20 minutes to set up. A new hire added to an existing Okta group is picked up automatically the next time they're assigned a device.

Looking ahead

Iru’s declarative model that helped VICE's team burn down their tech debt has now created a new operating rhythm, and the IT team is extending into new territory.

VICE is piloting Iru’s Passport feature to sync Okta credentials to local Mac accounts and manage local admin rights. And it’s promising to simplify how they stay compliant with customer requirements.

For a lean team running a global fleet that used to take an archaeological dig just to understand, that's the throughline: less time spent reconstructing what a device is supposed to be doing, and less time split across two platforms doing it. Windows stopped being a second workflow to maintain for a fraction of the fleet, so there's more time left for everything else on the list.

About VICE

VICE is a media company operating across an in-house creative and advertising agency, a studio business producing commercials, films, television, and music videos, a television channel run in partnership with A&E Networks, and a post-production business. Like much of the media industry, VICE has navigated significant change in recent years and today runs a leaner organization while continuing to produce content across its television, film, and digital properties.