endpoint being employee devices, probably (via vmware's workspace one product)