Kandji or Rippling IT for a Commercial General Contractor

Before comparing platforms, write down what you're actually managing: field iPads issued to foremen and superintendents, iPhones for site supervisors who need email and photos on the move, Windows desktops for estimators and project managers in the office, and any shared laptop kept in a jobsite trailer. Note which of these are truly company-owned versus a personal phone a foreman uses for work email, since the second category needs a different, lighter-touch policy than full device enrollment.

For the iPads that go out to jobsites, Kandji's Apple-native controls are a reasonable fit: enforced passcodes and encryption in case a device is left in a truck overnight, remote lock and wipe if one goes missing on a site, and app restrictions that keep a foreman's iPad focused on plan-viewing and punch-list software rather than becoming a general-purpose tablet. What it won't do is manage a single one of the Windows machines your estimators and PMs run every day.

Because a general contractor's fleet is typically close to half Apple and half Windows, running two separate platforms to cover it, one for iPads and one for desktops, adds administrative overhead that a smaller construction firm often can't justify. Rippling IT's single console across both operating systems means one login, one policy set, and one place to look when a device goes missing on a jobsite. It also ties provisioning to your hiring record, so a newly hired project manager's Windows laptop is set up the same day HR processes their start date.

The biggest mistake is enrolling field iPads without confirming they'll still work offline or on weak jobsite cell signal, since some remote lock and compliance checks depend on connectivity a device won't reliably have on a rural or basement-level site. Test enrollment on a device you expect to have the worst signal before rolling out to the whole field crew. The second common mistake is failing to have a clear policy for devices that leave with a subcontractor's crew by accident: decide in advance who's responsible for recovering a company iPad left on a jobsite, and put that step in your project closeout checklist.

A third mistake is standardizing app restrictions too tightly before you've watched a foreman actually use the device for a full week. Locking an iPad down to only the plan-viewing app on day one, before you know whether the super also needs a weather app for pour scheduling or a photo tool for daily logs, tends to generate a flood of exception requests that undermines confidence in the whole rollout. Start slightly looser, watch real usage for a couple of weeks, then tighten.

To avoid the usual rollout problems on active jobsites, keep these points in mind:

• Confirm field iPads still work offline or on weak signal before enrolling them, since some remote lock and compliance checks depend on connectivity.
• Test enrollment first on the device you expect to have the worst signal, before rolling out to the whole field crew.
• Expect remote lock and wipe commands to queue until the device reconnects when a site has poor cell coverage.
• Handle a foreman's personal phone with account-level email controls instead of enrolling the whole device in company management.
• Avoid running two separate consoles for iPads and Windows PCs when the fleet is split about evenly.

If you're running two or three jobs at a time with a handful of field iPads and a small office team, a full MDM platform might be more than you need yet. A simple passcode and Find My enrollment on company Apple devices, combined with a spreadsheet tracking who has which device, can cover a small fleet reasonably well. The trigger to move to Kandji or Rippling IT is usually running enough concurrent jobs, and enough field staff turnover, that the spreadsheet starts missing devices between projects.

Say your firm is stretching a project manager or general operations manager to also own device recovery and setup on top of their actual job. National wage data puts the median salary for a general operations manager at $105,770 a year¹, and that's before counting the hours lost chasing a missing iPad between jobsites instead of running the project it was bought for. A platform subscription that automates enrollment and remote lock is usually cheaper than the time a stretched PM spends doing the same job by hand once you're running more than a couple of active sites.