Apple Device Lifecycle: Buying, Enrolling, Redeploying and Disposing

The decision that determines how painful the next four years will be is made at the purchase order, not at deployment. Buy Apple hardware through a reseller linked to your Apple Business account and every device enrols itself, stays supervised and can be recovered when an employee leaves. Buy the same machine at retail and you inherit a manual process and, eventually, an Activation Lock problem.

This is the end-to-end lifecycle for an Australian business: procurement, enrolment, assignment, redeployment, the Activation Lock trap, residual value, and what the law actually requires when the device reaches the end of its life.

First, a naming change that matters

Apple replaced Apple Business Manager with a service called Apple Business on 15 April 2026. Apple’s own announcement is explicit: “Apple Business Manager and Apple Business Connect will no longer be available once Apple Business launches”, and Apple Business is “available as a free service” across more than 200 countries and regions. Apple Business is Apple’s free web platform for buying, assigning, enrolling and managing company-owned Apple devices, and it now includes built-in mobile device management alongside the brand and location tools that used to live in Business Connect.

Everything below uses the current naming. If your documentation still says Apple Business Manager, or your provider does, that is a small but useful signal. More on that in Apple’s business device portal.

Procurement: the ABM-linked reseller versus retail decision

Zero-touch deployment only works when Apple knows the device belongs to you. Apple’s own footnote on the Apple Business launch says it plainly: “Zero-touch deployment is available when devices are purchased through Apple or Apple Authorised Resellers.”

How the link works. You exchange three identifiers, and people mix them up constantly:

• Organisation ID is your unique identifier in Apple Business. You give this to your reseller.
• Reseller Number identifies the Apple Authorised Reseller or authorised carrier. You add this to your account.
• Apple Customer Number is the account number Apple assigns your organisation for purchasing. Apple notes this is not the same as your GSX account number, and to omit leading zeros.

The step almost everyone misses is in Apple’s own documentation: after the identifiers are exchanged and verified, you must arrange with the reseller to submit your orders through their portal, because “it won’t happen automatically”. Devices do not appear in Apple Business just because you bought them from a participating reseller. Someone has to lodge the order correctly.

Apple publishes a list of Preferred Device Enrolment Resellers for Australia, which is the right place to check before you commit to a supplier. If your incumbent hardware supplier is not on it and will not lodge your Organisation ID, that is a reason to change supplier, not a reason to change your deployment model.

What retail purchases cost you. Devices bought at an Apple Store, JB Hi-Fi or anywhere else can still be added, using Apple Configurator. Apple Configurator for iPhone can add iPhone, iPad, Apple Vision Pro and Mac (Apple silicon or T2, macOS 12.0.1 or later). Apple Configurator for Mac can add iPhone, iPad and Ethernet-model Apple TV, but cannot add Macs.

The catch is real and worth knowing before you rely on it. Apple’s documentation states that after a device is added this way and handed to a user, “they have a 30-day provisional period to release the device from Apple Business, supervision, and the device management service”. A device supplied through the reseller channel has no such escape hatch. If you are buying at retail to save a few days on lead time, understand that you are also handing every new starter a one-month opt-out from management.

You also have to catch each device at a specific Setup Assistant screen (macOS at “Select Your Country or Region”, iOS and iPadOS at “Choose a Wi-Fi Network”). Miss it and you restart the machine and try again. It is fine for one device. It does not scale.

Enrolment and assignment

Automated Device Enrolment is designed, in Apple’s words, for devices an organisation owns, and “lets organisations configure and manage devices from the moment someone removes a device from its box”. A device enrolled this way is automatically supervised on iOS 13, iPadOS 13.1, macOS 10.14.4 and later.

Supervision is not a bureaucratic nicety. Several controls only work on a supervised device. Apple’s Privacy Preferences Policy Control payload, the one that pre-approves your management agent, security agent and backup client for the access they need, states that “supervision is required if you apply this payload using a device management service”. Without it, every agent you deploy throws consent dialogs that users dismiss, and half your tooling silently does nothing.

The assignment checklist that actually matters:

1. Device appears in Apple Business with the correct serial number and order.
2. Device assigned to your device management service before it is unboxed.
3. Enrolment profile set to mandatory and non-removable.
4. Managed Apple Account created for the user, so organisational data stays separate from anything personal.
5. FileVault enabled with the recovery key escrowed and a test retrieval performed.
6. Bootstrap token escrowed to your management service. On Apple silicon Macs this is required for a remote erase to work later.
7. Asset record created, linking serial number to person, cost centre and purchase date.

Steps 5, 6 and 7 are the ones skipped under time pressure and the ones you regret. The mechanics sit in enrolment, policy and the bits that break, and the asset side belongs with IT asset management that holds up.

Redeployment when someone leaves

Redeployment is an offboarding problem before it is a hardware problem. The sequence that works:

1. Disable the user’s directory account and revoke sessions.
2. Confirm their data is in the tenancy, not only on the device.
3. Clear Activation Lock before you erase (see below, this order is not negotiable).
4. Issue a remote erase from your management service.
5. Verify the device reappears in Apple Business unassigned and clear of Activation Lock.
6. Reassign to the next user, or route to trade-in or disposal.

If your offboarding process does not include steps 3 and 5, you are building a cupboard full of expensive bricks. This should be wired into your onboarding and offboarding checklist rather than remembered on the day.

Activation Lock: the part businesses get burnt by

Activation Lock ties a device to an Apple Account so it cannot be reactivated without those credentials. Apple now distinguishes two kinds, and the distinction is the whole story.

Organisation-linked Activation Lock requires Apple Business and lets your device management service turn it on and off through server-side interactions. That is the version you want.

User-linked Activation Lock happens when a user signs in with their own personal Apple Account and turns on Find My. Apple’s own device-state table is blunt about the consequences: when user-based Activation Lock is on, it can be turned off in Apple Business, but not through an external device management service.

Three specific traps, all from Apple’s documentation:

The ordering trap. Apple states that “if Activation Lock was already turned on, you won’t be able to turn it off in Apple Business unless the user first turns it off”. If the employee enabled Find My before the device was added to Apple Business, your escape hatch is gone. Add devices to Apple Business first, always.

The bypass code window. On iPhone and iPad the device-generated bypass code is only available for up to 15 days after the device is first supervised. Apple is explicit: “If a device management service doesn’t retrieve the bypass code within 15 days, that bypass code is unretrievable.” Confirm your MDM is actually retrieving and storing these. Confirm it again if you ever change MDM, because Apple warns that on migration you must either receive a copy of the codes or have the outgoing service clear Activation Lock for all enrolled devices.

The macOS 11 trap. For a Mac running macOS 11 or later enrolled via Device Enrolment, Apple notes it “may be possible for Activation Lock to already be turned on when the Mac enrols”, and in that case “you can’t turn it off using a device management service”.

Releasing the device makes it worse, not better. Apple says twice on the same page that “managing Activation Lock using Apple Business isn’t possible after a device is released”, and the interface makes you tick a box confirming you understand the release cannot be undone. Never release a device to try to fix a lock. Also never release a device you are sending to Apple for repair, because if Apple replaces it, the replacement will not appear in your account.

When all else fails, Apple runs an Activation Lock support request process for owners who have proof of purchase documentation. Keep your invoices. This is the entire reason to keep them.

Erasing does not clear the lock. Apple’s guidance is unambiguous: keep Find My on and Activation Lock survives a remote wipe. Clear the lock first, then erase.

Trade-in and residual value

Apple runs Apple Trade In in Australia for both consumer and business customers. Worth knowing how it is structured: Apple’s own terms state that “Apple Trade In is a service provided by Apple’s third-party trade-in vendor”, and the Australian business trade-in runs on a partner platform linked from Apple’s Shop for Business page. It is a real programme; it is not Apple handling your hardware in-house.

Two clauses from Apple’s Australian trade-in terms deserve to be in your process document. First: “You are responsible for backing up and/or deleting data on your trade-in device. Neither Vendor nor Apple will be liable for your data.” Second, the vendor may revise the quoted value if Find My is not removed. Your Activation Lock hygiene has a direct dollar consequence, which is the argument to use when someone asks why offboarding needs to be done properly.

On the buy side, Apple Certified Refurbished in Australia includes a one-year warranty and full functional testing, and AppleCare+ can be added. For non-critical roles it is a legitimate way to lower fleet cost without leaving the managed hardware pool. We do not quote figures here because Apple’s pricing moves and any number in a blog post is out of date within a quarter.

We deliberately publish no dollar amounts for trade-in residual values. Anyone who does is guessing.

Secure erasure: what Apple actually does

On a Mac with Apple silicon or the Apple T2 Security Chip running macOS 12 or later, Erase All Content and Settings performs a cryptographic erase. Apple’s platform security documentation describes the mechanism precisely: volume encryption keys are wrapped with a media key that is “designed to enable swift and secure deletion of data because without it decryption is impossible”, and on these Macs “the media key is guaranteed to be erased by the Secure Enclave supported technology”. Erasing it “renders the volume cryptographically inaccessible”.

Two practical consequences. Disk Utility no longer offers multi-pass secure erase for SSDs at all, and Apple’s advice there is to turn on FileVault instead. And a remote erase on an Apple silicon Mac needs a bootstrap token escrowed to your management service. Without it, Apple’s documentation warns the Mac can fall back to a behaviour called obliteration, after which macOS must be reinstalled before the machine is usable.

Note for anyone quoting ASD: the Information Security Manual’s media guidelines require non-volatile flash memory to be overwritten at least twice with a random pattern and read back for verification, and note that wear levelling means “it is possible that not all memory blocks will be overwritten during sanitisation processes”. The ISM does not address cryptographic erase on self-encrypting devices. Do not claim it endorses the Apple method. Cite Apple for the Apple mechanism and the ISM for the general principle.

Disposal obligations in Australia

Privacy. Australian Privacy Principle 11.2 requires an APP entity that no longer needs personal information, where the information is not a Commonwealth record and is not required to be retained by law, to “take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified”. OAIC’s guidelines note that for electronic information it may be possible to sanitise the hardware, and where hardware cannot be sanitised, reasonable steps must be taken to destroy the information another way.

Losing a device that holds personal information can be a data breach. OAIC lists “a device with a customer’s personal information is lost or stolen” as an example. Whether it becomes an eligible data breach turns on likely serious harm and whether remedial action prevented it, which is exactly where a properly escrowed FileVault key and a verified cryptographic erase become the argument you make to the regulator rather than a line item in your incident report.

A certificate of destruction is not a legal requirement in Australia. It is good practice and it is often a contractual requirement. What OAIC actually expects is that you verify and document destruction, including where you have instructed a third party to destroy information. A certificate is the ordinary commercial way to discharge that. OAIC also warns that relying on certification “may not of itself be considered ‘reasonable steps'”. Do not treat the certificate as immunity.

E-waste in Victoria. E-waste has been banned from Victorian landfill since 1 July 2019 and it is illegal to dump it. Business is treated more strictly than households: EPA Victoria states that most e-waste from business and industry is pre-classified as priority waste under Schedule 5 of the Environment Protection Regulations 2021, and that duties under the Environment Protection Act 2017 “apply to the generator, transporter and receiver of e-waste”. You do not discharge your obligation by handing devices to somebody with a ute.

Note that Sustainability Victoria closed on 30 June 2026. If your disposal procedure names it, update the procedure. EPA Victoria is the regulator.

The national scheme. The National Television and Computer Recycling Scheme gives households and small businesses free access to industry-funded collection and recycling for televisions and computers, including printers, computer parts and peripherals. It now sits under the Recycling and Waste Reduction Act 2020, which replaced the Product Stewardship Act 2011 in December 2020. Two limits worth knowing: mobile phones are not covered by the NTCRS, and the scheme is not designed to absorb a corporate fleet refresh. For volume, use a commercial IT asset disposal provider. The detail sits in secure device disposal and e-waste obligations.

Tax. Disposing of a depreciating asset is a balancing adjustment event, and the ATO requires you to compare termination value against adjustable value, with the difference either assessable income or an allowable deduction in the year the event occurs. Note also that if you stop using an asset and never expect to use it again while still holding it, the termination value is the market value at the time you make that decision. Machines shoved in a cupboard are not automatically worthless. Check current thresholds and rules with your accountant or on ato.gov.au rather than trusting a figure in a blog post.

The one-page checklist

At purchase: Organisation ID lodged with the reseller. Order submitted through the reseller portal. Serial numbers confirmed in Apple Business before delivery. Invoice filed and retrievable.

At deployment: Assigned to your management service before unboxing. Supervised. Managed Apple Account issued. FileVault key escrowed and test-retrieved. Bootstrap token escrowed. Activation Lock managed by the organisation, not the user. Asset record created.

At offboarding: Directory account disabled. Data confirmed in the tenancy. Activation Lock cleared. Remote erase issued and verified. Device shown unassigned in Apple Business with Activation Lock cleared. Reassigned, traded or disposed.

At end of life: Cryptographic erase performed and evidenced. Asset tags and markings removed. Licensed disposal or trade-in provider engaged. Destruction verified and documented. Asset register updated. Balancing adjustment recorded.

If most of that list is news to your current provider, that is worth knowing before your next hardware refresh rather than after it, and it is the practical test in whether your provider can actually support Macs.

Bring us your serial number list and we will tell you which devices are in Apple Business, which are Activation Locked to a person who no longer works for you, and what it will take to fix. Call 1300 028 324 or use https://techassist.au/contact/. It is a quicker conversation than most people expect.

The instant asset write off lets an eligible small business immediately deduct the full cost of an eligible depreciating asset — a laptop, a server, networking gear — in the year it is first used, rather than claiming a slice of depreciation over several years. The catch: the thresholds, eligibility rules and timing change with almost every federal budget, so you must confirm the current position with your accountant and the ATO before you buy.

We are a Melbourne MSP, not a tax adviser. What follows is general information to help you plan IT purchases sensibly around end of financial year (EOFY) — it is not tax advice, and nothing here should be treated as the current law. Take it to your accountant.

What the instant asset write-off actually is

Normally, when a business buys a capital asset that lasts more than a year — a server, a stack of laptops, a managed switch — you cannot deduct the whole cost in the year you buy it. The Australian Taxation Office (ATO) treats it as a depreciating asset, and you claim its value as a deduction gradually over its “effective life”, often three to five years for IT hardware. Your taxable profit comes down a little each year rather than all at once.

The instant asset write-off changes that for eligible small businesses and eligible assets that cost less than a set threshold. Instead of depreciating over years, you claim the full cost as an immediate deduction in the year the asset is first used or installed ready for use. The asset still has to be a genuine business asset, but the tax benefit lands now rather than being strung out.

The appeal is cash flow and simplicity. A business buying $40,000 of hardware in a single year would, under standard depreciation, see only a fraction of that reduce its taxable income immediately. Under the write-off — assuming each asset and the business qualify — far more of it can be deducted in the same year, lowering that year’s tax bill and freeing up cash sooner.

Why this is the most caveated post we will write

Here is the part you cannot skip. The instant asset write-off is not a fixed, permanent feature of the tax system. It is a measure the government adjusts, extends, shrinks and re-legislates repeatedly — usually at budget time, sometimes retrospectively, and sometimes with the rules still before Parliament when the financial year is already underway.

Three things in particular move:

• The threshold. The dollar cap on what counts as an “eligible asset” has changed several times in recent years, and it has been very different for different periods. A figure that was correct two years ago may be wrong today. We are deliberately not quoting a current dollar amount here, because by the time you read this it may have moved.
• Eligibility. Which businesses qualify — usually defined by aggregated annual turnover — has its own threshold that also changes, and it is not the same as the asset cap.
• Timing. The asset generally has to be first used or installed ready for use within a specific window. Ordering before 30 June is not the same as the asset being installed and operational before 30 June.

So the only correct way to use this measure is to confirm the current threshold, the current turnover eligibility, and the current timing rules with your accountant and on the ATO website before you commit to a purchase. We mean this genuinely, not as boilerplate. We have seen businesses buy in good faith against a number they half-remembered from last year and get a different outcome at tax time. Your accountant is the source of truth; we are the people who help you choose and deploy the kit.

What IT typically qualifies — and what does not

Subject to all the caveats above, the distinction that matters for IT is between a capital asset you buy and own, and an ongoing subscription you rent month to month. They are treated very differently.

Things that are usually capital assets

Tangible IT equipment your business buys and owns is the natural home of the write-off, where the asset and business qualify:

• Laptops, desktops and monitors
• Servers and storage hardware
• Networking equipment — managed switches, firewalls, wireless access points
• Phones, tablets and peripherals used for work
• Some perpetually licensed software, and the labour to install and configure hardware, can form part of the asset’s cost — but this gets technical, and it is exactly the sort of thing to put to your accountant rather than assume

Things that usually are not

The big one is SaaS subscriptions. Microsoft 365, your cloud accounting platform, your CRM, a managed IT plan billed monthly — these are not capital assets you own. They are ongoing operating expenses. You generally deduct them as you incur them, as normal running costs of the business, and the instant asset write-off does not apply because there is no asset being acquired.

This trips people up because so much IT has shifted from “buy a box” to “pay a subscription”. A perpetual licence you purchase outright behaves more like an asset; a per-user monthly cloud service behaves like rent. If your spend has quietly moved from capital purchases to subscriptions over the last few years — and for most Melbourne SMEs it has — then a smaller share of your IT spend is even a candidate for the write-off than you might expect. That is not a problem; subscriptions are still deductible as operating costs. It just means the write-off is relevant to the hardware you buy, not the services you rent.

Capital asset versus SaaS subscription: the tax shorthand

This table is a rough orientation, not a ruling. Edge cases exist — bundled hardware-and-service deals, finance arrangements, mixed-use assets — and they are precisely where professional advice earns its fee.

Planning an EOFY refresh without buying junk

The right way to use the write-off is to let it influence the timing of purchases you were going to make anyway — not to manufacture purchases for the deduction. A deduction reduces tax; it does not make a thing free. Spending $30,000 to save some tax on it still leaves you out of pocket on the $30,000. If the kit is not genuinely needed, the write-off is a bad reason to buy it.

Where it works beautifully is bringing forward a refresh you already had on the roadmap. A professional services firm in Hawthorn we work with had a fleet of ageing laptops limping toward failure and a server approaching end of support. They were going to replace both within the year regardless. Their accountant confirmed the timing and eligibility, and we scheduled the rollout so the new hardware was installed and operational before EOFY rather than after. Same purchase they needed; the tax treatment simply landed in the more useful year. That is the sensible version.

The unsensible version is the December or June panic-buy of equipment nobody scoped, chosen on price-before-cutoff rather than fit, that sits in a cupboard or gets deployed badly because there was no plan. We have been called in to clean up plenty of those. A deduction on the wrong hardware is still the wrong hardware.

A few things keep the timing honest:

1. Confirm the rules first. Before you spend, get your accountant to confirm the current threshold, your turnover eligibility, and the install-by timing for the period you are buying in.
2. Buy to a plan, not a deadline. Know what you actually need — which machines are due, what the server is being replaced with, what the network requires — before the calendar drives the decision.
3. Mind the install-by date. The asset generally has to be in use or ready for use, not merely ordered. Hardware on a boat or sitting unconfigured in a box may not count for the year you wanted. Build in lead time.
4. Right-size it. Do not over-spec to chase a bigger deduction. Buy what the work needs.

Pair it with a proper hardware refresh plan

The businesses that get the most out of any EOFY incentive are the ones that already know their hardware lifecycle — because they are not deciding under pressure. A standing refresh plan tracks the age of every device, the support end-dates for servers and operating systems, and a rolling replacement schedule so equipment is renewed before it fails, not after.

With that in place, an instant asset write-off window becomes a simple question of timing: which planned replacements make sense to bring forward into this financial year? Without it, EOFY is a scramble and the write-off tempts you into bad buys. This kind of forward planning is core to good managed IT services, and it is the sort of thing a virtual CIO brings to a business with no internal IT leadership — a budget and a lifecycle, agreed in advance, instead of reactive spending. It also ties neatly into your wider IT budgeting: hardware is only one line, alongside your subscriptions, security and support, and seeing the whole picture is what stops any single tax lever distorting the plan.

For context on what end-of-support actually forces, our piece on the Windows 10 end of life walks through why some refreshes are not optional — and those are exactly the planned purchases a write-off window can help you time well.

TechAssist is a Melbourne-based MSP, founded in 2014, with thirteen Australian-employed engineers — not an offshore call centre. Because we bill per user at a fixed monthly rate rather than by the hour, hardware planning, procurement advice and EOFY refresh scheduling are part of the relationship, not a surprise project invoice. We will help you choose the right kit and get it deployed in time; your accountant tells you how it is treated.

Frequently asked questions

Is the instant asset write-off still available this financial year?

That is exactly the question to put to your accountant or check on the ATO website, because the answer genuinely changes. The measure has been extended, modified and re-legislated repeatedly, and the threshold and eligibility have moved with it. We will not state a current figure here because it may be out of date by the time you read this. Confirm before you buy.

Does my Microsoft 365 subscription qualify?

Generally no. A monthly or annual subscription is an operating expense, not a capital asset you own, so the instant asset write-off does not apply. The good news is that subscriptions are still deductible as ordinary running costs — they are just claimed differently from owned hardware. Your accountant can confirm the treatment for your situation.

Should I buy IT just to get the deduction?

No. A deduction reduces your tax; it does not make the purchase free. If you would not buy the equipment without the write-off, the write-off is the wrong reason to buy it. The measure is best used to bring forward purchases you genuinely need, with your accountant confirming the timing.

What is the difference between this and normal depreciation?

Normal depreciation spreads an asset’s deduction across its effective life — a few years for most IT hardware. The instant asset write-off, where it applies, lets you claim the full cost as an immediate deduction in the year the asset is first used. Same total deduction over time; the write-off just brings it forward.

If I order hardware before 30 June, does it count for this year?

Not necessarily. The rules generally turn on the asset being first used or installed ready for use within the window, not merely ordered or paid for. Stock in transit or sitting unconfigured may fall on the wrong side of the cutoff. Build in lead time and confirm the timing with your accountant.

Talk to us before your EOFY refresh

If you have hardware due for replacement and you are wondering how to time it around end of financial year, the smart move is to plan the refresh properly first and let your accountant handle the tax treatment. We will help you work out what genuinely needs replacing, choose kit that fits the work, and get it deployed and operational in time. Get in touch and we will give you a straight assessment of your hardware and a sensible refresh plan.

This article is general information only and is not tax advice. The instant asset write-off and its thresholds, eligibility and timing are set by legislation and change regularly — always confirm the current rules with a registered tax agent and the ATO before making a purchasing decision.

For most Australian SMEs in 2026 the honest answer to laptops vs desktops comes down to one question: does the person need to work in more than one place? If yes, buy a business-grade laptop and a dock. If they sit at the same desk every day and never move, a desktop gives you more performance per dollar and a longer life. The nuance is in the edge cases.

The old reasons to buy desktops — far cheaper, far faster, easier to fix — have softened. Laptops have closed the gap on performance, and hybrid work has made portability a default expectation rather than a perk. But desktops haven’t disappeared, and for some roles they’re still the right call. Below is a plain comparison and a role-by-role view, with the Windows 11 and Copilot+ angle that’s now part of every refresh conversation.

The quick comparison

Prices and configurations shift constantly, so treat that as a framework, not a quote. The hardware sticker is rarely the deciding number anyway — total cost of ownership over four years, including support, downtime and the value of flexibility, is what actually matters.

Mobility and hybrid work

This is the factor that’s reshaped the decision. A few years ago most Melbourne SMEs ran desktops in the office and that was that. Now hybrid is the default for professional services, and a person who can’t pick up their machine and work from home, a client site or the train is a productivity gap waiting to happen. For sales, field and management roles, a laptop isn’t a luxury — it’s the job.

The catch is that buying laptops “because everyone’s hybrid now” without thinking it through wastes money on people who never actually leave their desk. Be honest about who moves and who doesn’t. A reception or warehouse terminal that lives in one spot for five years doesn’t need a portable battery you’ll be replacing in year three.

Performance per dollar and the power users

For the same spend, a desktop still gives you more — more cores, faster GPU, more RAM, and the thermal headroom to sustain it under load. That matters enormously for a narrow band of roles: CAD and 3D work, engineering simulation, video editing, large data sets, anything that pegs a processor for hours. Cram that workload into a thin laptop and it throttles, runs hot and ages fast.

An engineering or architecture practice in Hawthorn running AutoCAD and Revit is a clear desktop case — or at minimum a mobile workstation, which is a different (and pricier) animal to a standard ultrabook. For the bulk of office work, though — Microsoft 365, browsers, video calls, line-of-business apps — a mid-range business laptop has more than enough grunt, and the performance gap is invisible day to day. Don’t pay for desktop horsepower a spreadsheet user will never touch.

Repairability, upgradeability and lifespan

Desktops win cleanly here, and it’s a real cost lever over time. A desktop is a serviceable box: when the storage fills up or the RAM gets tight, you open it and add more. A failed power supply is a cheap, quick swap. That’s why a well-specced desktop comfortably runs four to six years, and you can stretch it further with a single part.

Laptops are tighter. Better business models still let you upgrade RAM and SSD, but many consumer machines solder the RAM, and a cracked screen, worn battery or failed keyboard is a genuine repair bill — sometimes close to the cost of replacement. Plan on three to four years for laptops as a working assumption, and build that shorter cycle into your budgeting rather than being surprised by it.

Docking and dual monitors

The classic objection to laptops — “but my team needs two big screens” — stopped being valid years ago. A decent USB-C or Thunderbolt dock turns a laptop into a full desktop setup in one cable: dual monitors, keyboard, mouse, wired network and power. Staff get the desktop experience at their desk and full portability when they walk away.

Two practical notes. First, standardise on one or two dock models across the fleet — mismatched docks are a quiet, recurring source of support tickets. Second, check the laptop actually drives the displays you want at the resolution and refresh you want; not every USB-C port carries enough bandwidth for two 4K screens. Get that right at purchase and dual-monitor laptop setups are genuinely seamless.

Security: laptops get lost

This is the factor people underrate. A desktop bolted under a desk in your office is, physically, fairly safe. A laptop rides in cars, sits in cafes and gets left on trains. Every portable device is a data-loss event waiting to happen if it isn’t protected, and under the OAIC’s Notifiable Data Breaches scheme, a lost laptop holding client data can be a reportable breach.

The non-negotiable is full-disk encryption — BitLocker on Windows, managed centrally so recovery keys are escrowed and you can prove the device was encrypted if it goes missing. Pair that with a business-grade machine that has a TPM 2.0 chip (which Windows 11 requires anyway), conditional access so a stolen device can’t simply sign in, and remote wipe through Intune. We cover the access side in our guide to conditional access policies in Microsoft 365, and encryption is a baseline control under the Essential Eight. A lost encrypted laptop is an annoyance; a lost unencrypted one is a notifiable breach and a very bad week.

The Windows 11 baseline and Copilot+ PCs

Windows 10 reached end of support in October 2025, so every machine you buy now should be Windows 11 and meet its hardware floor: a supported 64-bit CPU, 4GB+ RAM (realistically 16GB for business use), UEFI with Secure Boot, and TPM 2.0. Any business-grade device from the last few years clears that bar; the trap is cheap consumer stock that quietly doesn’t.

The newer wrinkle is Copilot+ PCs — machines with a neural processing unit (NPU) rated at 40+ TOPS that run certain AI features locally rather than in the cloud. They’re genuinely more efficient and have excellent battery life, but for most SMEs in 2026 the on-device AI features are a nice-to-have, not a reason to pay a premium or rush a refresh. Buy one if it fits the budget and the role; don’t let the marketing drive the whole fleet decision. If you’re weighing the AI productivity case more broadly, our Microsoft 365 support team can give you a straight read on what’s worth paying for.

Business-grade vs consumer kit

This matters more than the laptop-versus-desktop question for most buyers. Consumer machines from a retail shelf look like a bargain until you account for what’s missing: shorter warranties, no next-business-day on-site option, no fleet manageability, weaker build quality, and bundled junkware. Business lines — think the commercial ranges from the major vendors — give you longer warranties, TPM and firmware-level security features, driver stability, and machines you can enrol and manage centrally.

For a managed fleet, manageability is the quiet killer feature. Business devices support zero-touch provisioning through Windows Autopilot, so a new starter’s machine ships, gets unboxed, connects to wifi and configures itself with the right apps and policies — no engineer building it by hand. Consumer kit fights that process every step. The slightly higher upfront cost pays for itself the first time you onboard someone without a site visit.

Buy, lease or Device-as-a-Service

Buying outright is simplest: you own the asset, depreciate it, and there’s no contract. The downside is a lumpy capital cost every refresh cycle and the temptation to run machines years past their use-by date to avoid spending again. That’s how you end up with a fleet of slow, out-of-warranty laptops dragging productivity down.

Leasing or Device-as-a-Service (DaaS) spreads the cost into a predictable monthly figure and usually bundles refresh, warranty and sometimes provisioning into one line. For a growing business that values predictable opex and an automatic refresh cycle, that’s attractive — it forces the hardware discipline that buyers often skip. The trade-off is you’ll pay a little more over the full term, and you don’t own anything at the end. There’s no universally right answer; it depends on your cash flow and how disciplined you are about refreshes on your own.

Standardise the fleet

Whatever you buy, buy few models, not many. A fleet of three standard configurations — say a standard laptop, a power-user laptop and a desktop workstation — is dramatically cheaper to support than fifteen one-off machines bought ad hoc over the years. Standardisation means one set of drivers to test, spare parts that interchange, predictable imaging, and a swap-out that takes minutes instead of a half-day rebuild.

A professional services firm in Camberwell we work with had exactly that problem: every staff member had picked their own machine over five years, so no two were alike and every fault was a fresh investigation. We moved them to two laptop SKUs and one desktop for their finance team, all enrolled through Autopilot and encrypted with BitLocker. Support time dropped, onboarding went from a day to an hour, and their refresh budgeting finally became predictable. The cost saving wasn’t in the hardware — it was in everything around it. That fleet-management discipline is core to how our managed IT services work.

Frequently asked questions

Are desktops still worth buying in 2026?

Yes, for the right roles. Fixed workstations that never move, finance teams on multiple large monitors, and power users running CAD, video or heavy compute all get more performance per dollar and a longer, cheaper-to-maintain life from a desktop. For mobile or hybrid roles, a laptop with a dock is the better call.

How long should a business laptop last?

Plan on three to four years. The battery, hinges and keyboard wear with use, and after four years repair costs and slowdowns usually outweigh keeping the machine. Desktops stretch to four to six years and can be extended with a cheap RAM or SSD upgrade. Build those cycles into your budget rather than running kit until it dies.

Do we really need business-grade machines instead of cheaper consumer ones?

For a managed business fleet, yes. Business lines give you longer warranties, next-business-day on-site options, TPM and firmware security, driver stability, and central manageability through tools like Intune and Autopilot. Consumer machines look cheaper upfront but cost more in support, downtime and shorter usable life.

What’s the most important security control for laptops?

Full-disk encryption — BitLocker, managed centrally so recovery keys are stored safely. A lost or stolen laptop with client data can be a notifiable breach under the OAIC scheme; if it’s encrypted and you can prove it, the exposure is far lower. Pair encryption with conditional access and remote wipe.

Should we lease or buy our hardware?

Buying suits businesses with the capital and the discipline to refresh on schedule. Leasing or Device-as-a-Service suits those who prefer predictable monthly opex and want refresh, warranty and provisioning bundled in. You pay slightly more over the term but avoid lumpy costs and the temptation to run machines too long.

Getting the decision right

The 2026 rule is simple: match the machine to the role, not to a blanket policy. Map who actually moves, who needs raw compute, and who sits in one place all day, then standardise on a small set of business-grade configurations and manage them properly — encrypted, enrolled and on a sensible refresh cycle. That’s where the real savings live, well beyond the sticker price.

TechAssist is a Melbourne-based MSP founded in 2014, with 13 Australian-employed engineers and same-business-day on-site support across the metro — which means we can hand-deliver, swap or fix a machine fast when hardware does fail. If you want a straight recommendation on what to buy for which roles, or a managed fleet that runs itself, get in touch or take a look at our pricing and SLA. No upsell to gear you don’t need.