TL;DR
Equipment for dual role employees is a question about separation rather than about hardware. Somebody working across two entities, two brands or two very different functions usually needs one machine with separated access. A second device is justified when something genuinely must not touch the same endpoint, and that is rarer than people claim.
- Start from one device. Make the second one earn its place.
- Separation is usually an access problem, not a hardware problem.
- Two devices means two of everything, including two things to recover.
- Decide which cost centre owns it before procurement, not after.
- Genuine reasons exist: regulated separation, client requirements, conflicts.
The moment this becomes real
Say somebody splits their week between two companies in the same group. Both have their own systems, their own IT contact and their own budget. Neither has met the other’s IT contact.
Both issue a laptop, because each process starts with a new person appearing in its own joiner list and neither knows about the other. The employee now has two machines, uses one of them most of the time, and carries both to the office on the day they need the second.
Best tools for HR Operations
Nobody made a decision to issue two devices. Two separate processes each made the correct decision in isolation. The real issue is not the duplicate laptop. It is that a person with two roles appears twice in every system and nothing joins them up.
When this is lighter than you think
Four stages where this barely arises.
- Two roles in one entity. One employer, one laptop, one record. The roles are a reporting question rather than an equipment one.
- Shared systems across the group. If both roles use the same tenant and tools, separation happens through permissions and nothing physical is needed.
- Short term secondary roles. Somebody covering a second function for a quarter does not need a second machine.
- Cloud based work. Where everything runs in a browser, switching between two sets of credentials is trivial.
It becomes a real decision where the two roles sit in separate legal entities with separate systems, or where a regulator, client or contract requires separation.
The five questions teams actually ask
Can one device serve both roles? Usually yes. Separate accounts, separate profiles and properly scoped permissions handle most cases, and modern device management can apply different policies to different work contexts on one machine. Start here and require a reason to move away from it.
When is a second device justified? When separation must be demonstrable rather than merely configured. Regulated environments, client contracts that specify dedicated equipment, and genuine conflicts of interest are the real cases. A preference for keeping things tidy is not.
Who pays? Agree before procurement, because this is where it stalls. The common approaches are the primary entity owning it, a split by time allocation, or whichever entity has the greater security requirement. Any of them works. None of them works if decided after the order is raised.
Whose asset is it? One entity owns the device even if two use it, and the register should say which. This matters at offboarding, when somebody has to know who is responsible for getting it back and who writes it off if they do not.
What happens when one role ends? The usual outcome, and it is rarely planned. If they leave one entity and stay with the other, does the device stay, get swapped or get wiped and reissued. Decide at issue rather than at the exit.
Three ways teams handle it, and where each breaks
Two devices by default. Each entity issues its own. Simplest for each IT team and nobody has to coordinate. It breaks on cost, on the employee carrying two machines, and on recovery, since two devices is two chances for one to go missing.
One device, separated accounts. A single machine with distinct logins and scoped access. Best for most situations. It breaks where separation must be evidenced to a third party, because configuration is harder to demonstrate than physical separation.
One device, one owner, formal access agreement. As above, with a written note of which entity owns the asset and how the other’s data is handled on it. The most defensible version. It breaks on effort, since somebody has to write that down for what feels like an edge case.
Five questions before issuing a second machine
Deciding on equipment for dual role employees takes five questions.
Is there a stated requirement for separation? From a regulator, a client contract or a policy. If not, one device.
Do the two roles share systems? If yes, separation is a permissions exercise.
Which entity owns the asset? Decide before ordering anything.
Who recovers it if they leave one role? Name them now.
Does the person want two machines? Ask. Many actively do not, and that is useful evidence.
What is actually available
Five honest options, including ours.
One device, two accounts. Best default for most cases. Cheapest and simplest for the person. Struggles where separation must be shown to an external party.
One device with managed work profiles. Best where the device management platform supports separating work contexts properly. Good balance of separation and practicality. Struggles on configuration effort and on platform support varying.
Two devices, one owner. Best where separation is genuinely required. Clear and demonstrable. Struggles on cost and on the person managing two machines day to day.
Virtual desktop for the secondary role. Best where the second role needs a controlled environment occasionally. No second physical device. Struggles on licensing cost and on performance for demanding work.
RemoAsset. Relevant mainly where a second device is justified and the person is remote, since asset tracking records which entity owns which machine and device security and data handling covers the end of life question for both. Where it struggles: the decision about whether two devices are needed is entirely internal and is the only hard part here. Its published pricing starts with a pay as you go plan and a yearly subscription above it.
Where to start, by situation
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Two roles, one entity | Any | Shared systems | None | One device, adjust permissions |
| Two entities, shared tenant | Any | Common tools | Access scoping | One device with separated accounts |
| Two entities, separate systems | Any | No coordination | Two devices issued by accident | Decide ownership before either orders |
| Regulated or contractual separation | Any | External requirement | Must be demonstrable | Two devices with documented ownership |
| One role ending | Any | Dual arrangement | Nobody owns recovery | Agree the exit path when the device is issued |
What the gap actually costs
A duplicate laptop is the visible cost and the least important one. One extra machine for somebody doing two jobs is not a budget problem for any company large enough to have dual role employees.
The real cost is at the exit, which is where this always surfaces. Somebody leaves one of their two roles and nobody is clearly responsible for the device, because each entity assumes the other issued it. That is how a machine ends up staying out indefinitely with two teams each believing the other handled it.
The third cost is security. A person with two roles and no clear separation model tends to use whichever machine is in front of them, which means data from one entity on a device owned by another, with neither IT team aware. So the question is not one laptop or two. It is whether anybody has written down which entity owns what and who recovers it.
When nothing joins the two records up
The underlying problem is not equipment at all. It is that a person with two roles exists twice in your systems, and almost nothing is designed to notice that. Two joiner records, two IT queues, two asset entries and no link between any of them.
The cheap fix is a flag. If your HR system can mark somebody as holding a second role elsewhere in the group, equipment decisions can at least be made with knowledge rather than in parallel ignorance. Most systems can and almost nobody uses the field.
After that it is about ownership being recorded explicitly, which matters most at the exit. Where the register names an owning entity and the device chain is tracked, as with a laptop lifecycle management service, the question of who collects a machine from somebody leaving one of two roles has an answer before anybody needs it.
See how devices are tracked across entities and roles
Read our guide to equipment for part time and job share staff
Related reading
- Equipment for part time and job share staff
- Equipment for board members, advisors and non employees
- Equipment during secondment
- Designing an equipment approval workflow
- Separation of access is a recognised control. See ISO 27001 on access control and the NCSC device security guidance.
Frequently Asked Questions
Does equipment for dual role employees mean two laptops?
Usually not. Separate accounts and properly scoped permissions on one machine handle most situations, and modern device management can apply different policies to different work contexts. Start from one device and require a specific reason before issuing a second.
When is a second device genuinely justified?
When separation has to be demonstrable to somebody outside the company rather than simply configured. Regulated environments, client contracts specifying dedicated equipment and real conflicts of interest are the legitimate cases. Tidiness and preference are not.
Which entity should pay for the device?
Agree it before procurement, because this is where the decision stalls. Common approaches are the primary entity owning it, splitting by time allocation, or the entity with the higher security requirement taking it. Any is workable; deciding afterwards is not.
Who owns the asset if two entities use it?
One entity, recorded explicitly in the register. This matters most at offboarding, when somebody must know who is responsible for recovery and who writes it off if the device does not come back. Shared ownership in practice means nobody owns it.
What happens when one of the two roles ends?
Decide at the point the device is issued rather than at the exit. If they leave one entity and remain with the other, the options are keeping the machine, swapping it or wiping and reissuing. All are reasonable. Having no answer is what causes the device to stay out.
How do two IT teams end up issuing two laptops by accident?
Because each process starts from its own joiner list and neither knows about the other. Both teams make the correct decision in isolation. A flag in the HR record marking a second role elsewhere in the group is usually enough to prevent it.
Is a virtual desktop a reasonable alternative?
Often, particularly where the secondary role needs a controlled environment only occasionally. It gives demonstrable separation without a second physical machine. Weigh it against licensing costs and whether performance is adequate for the work involved.
