If you're on Google Workspace, using Google's Device Manager (assuming you use Chrome as the 'forced' browser), you can get pretty far. It's not as full-featured as other enterprise device mangers by any means, but it should be sufficient for some compliance (ISO27001 and SOC2) as I know companies who have passed with this setup.