An alternative is people install the software they choose to on the machines they're using. Optionally write a list of suggested programs down somewhere.

In that world, there is no central IT team pushing changes to machines and arguing with developers about whether they really need to be able to run a debugger.

I don't know how to keep windows machines alive. It's probably harder.

That is all well and good but how do you:

- Ensure the machines are up-to-date and users are not just indefinitely postponing OS updates?

- Same as above but with programs/software

- How do you ensure correct settings configuration in terms of security? Say default browser, extensions, program access etc?

- Re-image or reinstall the OS when there are issues or PC handover to another employee? Manually with a USB stick?

This kind of control exists and is needed for Linux and MacOS too. RMM is not a Windows only thing...

The critics here see Intune but what if they used another RMM and they compromised another cloud RMM account? Same issue.

Also, here there is no "arguing". They order the software from our portal and it gets pushed into Company Portal via Intune...

Write down a list you say... idk what to say. You have only worked for small startups I gather? Nothing wrong with that but please recognize that these types of limits and programs are not deployed for fun or to ruin your day.

It's annoying, but it's also grossly irresponsible to let dev machines get compromised. Regardless of which OS they are running.

I, for one, don't really want employees to install video games, porn cam clients, torrenting apps, shady vpn clients, crypto miners, remote access tools, dns "optimizers" and more generally viruses on their work computers.