Business devices & technology hardware

Buy, lease or subscribe is really a question about refresh cadence

The three models transfer different risk. Buying takes the residual value risk and the disposal problem, and suits an organisation that holds equipment longer than four years or wants to recover value by redeploying it. Leasing spreads the cost across a fixed term and makes the replacement date a contract term rather than a decision, which suits fleets refreshed on a two-to-three-year rhythm. Device-as-a-service bundles hardware, warranty, deployment, break-fix and retirement into one recurring charge, which suits organisations that want a flat operating line and no asset register. None is cheaper in the abstract; each is cheaper for a particular refresh cadence, which is why the cadence has to be fixed first — and it is not entirely yours to set, because the vendor publishes the date the operating system stops being patched.

• Decide how long the fleet should last before deciding how to pay for it.
• Establish whether the equipment has residual or redeployment value to you.
• Check what the lease or subscription actually includes: deployment, support, disposal.
• Model the exit: what happens to the devices if the contract ends early.

Total cost of ownership has five parts, and three are not the device

The acquisition price is the visible component and rarely the largest. A working total cost of ownership adds deployment and imaging, ongoing support and repairs, the operational cost of the downtime while a device is out of service, and disposal at the end — less any value recovered by resale or redeployment. In a fleet of any size the middle three dominate, which is why the productive comparison is not between two hardware quotes but between two whole-life propositions: the same device with depot support and self-managed imaging versus the same device with on-site support and vendor deployment is a different purchase at a different total cost.

• Price deployment and imaging, not just the box.
• Include the downtime cost of a device out of service for each user group.
• Account for disposal and any data-destruction requirement at end of life.
• Compare propositions rather than specifications.

Zero-touch provisioning ties part of the purchase to the sales channel

A zero-touch deployment — the device arrives and configures itself from the organisation's own profile, with no technician at the desk — is bought, not configured: the enrolment record has to exist before the device is delivered, and whether it can depends on how the device was bought and on which platform it runs. Microsoft's Windows Autopilot registers a device by its hardware hash and associates it with the organisation's Entra tenant, and a customer can capture that hash on an eligible device and upload it whatever the seller, so Autopilot is not gated on the shop. The convenient path, though — the seller registering the device against the buyer's tenant before shipment — runs through an OEM or a Cloud Solution Provider partner the tenant administrator must authorise. Apple draws the line differently. Automated Device Enrollment works through Apple Business Manager, and a device normally has to be bought from Apple, an Apple Authorised Reseller or a participating carrier for the purchase to attach to the organisation's Business Manager account; a machine from an unconnected retailer or the secondary market does not appear automatically, whatever was paid for it. Enrolment is therefore a specification line beside the model and the warranty, and it decides whether the rollout is hands-off or a technician's weekend.

• Put the enrolment method (Autopilot registration, Apple Automated Device Enrollment) in the purchase order, not in the post-delivery checklist.
• Name the OEM or reseller that will register devices against your tenant, and authorise that partner before the order is placed.
• For Apple, buy through Apple, an Apple Authorised Reseller or a participating carrier, or the device will not attach to Business Manager.
• Treat retail and secondary-market sources as an exception route with a manual enrolment cost, not an equivalent one.

Support tiers differ by where the repair happens

Support is priced by response time and by location of repair, and the tiers are genuinely different products. A depot arrangement means the device goes to a repair centre and the user is without it until it returns, which is acceptable for a spare-device culture and unacceptable where the device is the workstation. On-site next-business-day service puts a technician at the premises the following business day, and costs more because it removes the shipping interval. The decision is arithmetic on the downtime cost you established earlier: on-site support is justified where an hour offline costs the business more than the difference in support price. Read what the tier includes as carefully as its response time — accidental damage, battery coverage, retained drives and the geographic scope of on-site attendance are commonly separate inclusions, and they decide whether the service removes the outage or only shortens it.

• Establish the downtime cost per user group before choosing a tier.
• Check whether accidental damage and battery coverage are included or excluded.
• Confirm the geographic scope of on-site coverage for each location.
• Decide whether a spare pool is a cheaper answer than faster repair.

The refresh date is published, and the hardware has to qualify

End-of-support dates decide when a fleet becomes a liability rather than an asset: after that date security patches stop, replacement parts become scarce and lead times lengthen. They are published per product and per edition. Windows 10 Enterprise and Education reached end of support on 14 October 2025, with version 22H2 the final release of that line; Windows 10 Enterprise LTSB 2016 reached its end of updates on 13 October 2026, and Microsoft's release-health page for that build now points the devices it runs on at Windows 11 Enterprise LTSC 2024; Windows Server 2016 continues to receive updates until 12 January 2027. Long-term servicing editions sit on a different clock from the annual release train, which is why one estate can carry three deadlines at once — and why a three-to-four-year horizon for laptops and endpoints, four to six years for servers and five to seven for network equipment is a convention rather than an arbitrary rule. The distinction worth keeping on an asset list is between a date ahead of you and a date behind you: a device past its end-of-updates date cannot be brought back into support by maintenance, so it belongs in the replacement queue rather than the patching queue, and the spend lands in the quarter it is finally replaced instead of in a support contract. The date is not the only test, because the current operating system sets a hardware bar the fleet has to clear. Windows 11 requires a 64-bit processor of 1 GHz or faster with two or more cores, 4 GB of memory, 64 GB of storage, UEFI firmware that is Secure Boot capable, a Trusted Platform Module at version 2.0, DirectX 12 graphics and a 720p display of nine inches or more. A device that fails any of those — the TPM and the firmware mode are the usual casualties — cannot move onto the current release train, so it stops receiving security updates when its own date arrives rather than degrading gradually. Build the refresh calendar from the published lifecycle date of the specific models you own, run the eligibility check against the asset list beside it, and align lease terms to land on that date.

• Build the refresh calendar from published vendor lifecycle dates per model.
• Run the eligibility check against the asset list, not against the model family.
• Treat a failed TPM or firmware requirement as a replacement, not a repair.
• Align lease and subscription terms to the vendor's support end date.
• Treat out-of-support equipment as a security exposure, not only a maintenance issue.

The platform clocks measure different things, so their dates cannot be compared

A mixed fleet carries several deadline rules at once, and they are not the same kind of date. Apple classifies hardware by how long it has been since Apple last distributed the product: a device is vintage once more than five years have passed and obsolete once more than seven, at which point Apple generally stops hardware service, with a standing exception that Mac notebooks may stay eligible for battery-only repair for up to ten years, subject to parts. That clock starts at Apple's last distribution rather than the customer's purchase, so two identical machines bought a year apart age at the same rate. Google's rule is a software cutoff attached to the model rather than a service classification: every ChromeOS device has a published Auto Update Expiration date, after which automatic ChromeOS updates stop, and models released from 2021 carry a ten-year window. Microsoft's rule is a software-version schedule rather than either: Windows Server runs five years of mainstream support followed by five of extended support, so a server's security clock is set by the release installed on it, not by the box. Keep three columns per asset — hardware service status, operating-system update cutoff, software-version lifecycle — because a device can miss any one of the three first, and the earliest date is the replacement trigger.

• Record the platform rule that applies to each asset, rather than one assumed lifespan for the whole fleet.
• For Apple hardware, age the device from Apple's last-distribution date, not the invoice date.
• For ChromeOS, read the model's published Auto Update Expiration date, which is separate from the warranty.
• For Windows Server, track the installed release's mainstream and extended support dates.
• Take the earliest applicable date as the refresh trigger and let it set the lease term.

Disposal is a sanitisation decision with three defined levels

The end of a lease is where the data-handling obligation lands, and disposal is not one activity but a choice between three defined ones. NIST's Guidelines for Media Sanitization, SP 800-88 Revision 1, separates Clear — logical techniques that defeat non-invasive recovery, such as overwriting or a supported factory reset — from Purge, which is intended to make recovery infeasible even with laboratory techniques, and from Destroy, which renders the media unusable. Which one applies depends on the media and on what it held: a solid-state drive and a spinning disk do not answer to the same technique, and a unit leaving the premises for resale carries a different requirement from one scrapped internally. Name the required level, and who certifies it, in the lease or subscription return clause and in the asset record before the order is placed, because the question is expensive to answer once the equipment has left the building.

• Name the sanitisation level per device class in the contract, not at collection.
• Record which media type each asset carries, because the technique follows the media.
• Require a certificate of sanitisation or destruction for every unit returned.
• Keep the disposal record as long as you would have kept the data it protected.

Certification answers two different questions, at purchase and at retirement

Two certification regimes sit at opposite ends of a device's life, and a procurement standard needs both because neither answers the other's question. At purchase the question is which product to buy, and that is a product-level registration: EPEAT evaluates equipment against the IEEE 1680 family of criteria — 1680.1 for computers and displays, 1680.2 for imaging equipment, 1680.3 for televisions — covering energy, materials and chemicals, longevity and repairability, packaging and end-of-life handling, while ENERGY STAR is narrower and verifies energy performance alone. An EPEAT-registered product meets the applicable ENERGY STAR specification plus additional criteria, which is why US federal agencies must ask for both in computer purchases and leases; a private buyer is reached only if it writes the requirement into its own specification. At retirement the question is who processes the asset, and that is a service-provider certification: R2v3, run by SERI, audits the facility's management system and its control of downstream vendors, while e-Stewards, run by the Basel Action Network, adds stricter controls on exporting hazardous electronic waste. Neither certificate covers the whole chain, because R2v3 lets a certified facility use a non-certified downstream vendor once it has verified that vendor under its Appendix A requirements. Close the gap with disclosure: name the certification and its scope, and require the downstream chain, the processing locations and the final disposition in the asset record.

• Require an EPEAT-registered, ENERGY STAR-qualified product where the category exists, and name the label in the specification.
• Name the disposition certification — R2v3 or e-Stewards — and the certificate scope in the return clause.
• Ask for the downstream chain and processing locations, not only the provider's own certificate.
• Remember that a certified provider may lawfully pass material to a verified, non-certified downstream vendor.

Standardisation is the lever that makes support affordable

A fleet of a few standard models is cheaper to support, quicker to image, easier to stock spares for and simpler to retire than a fleet assembled from whatever was available when a device was needed. Standardisation is usually where the largest saving sits, and it is a policy decision rather than a purchase. The standard can also carry an efficiency floor: the EPA's ENERGY STAR programme certifies computers to use roughly thirty to forty per cent less energy than standard models, and it publishes a product finder, so the standard configuration can be chosen from certified models rather than audited afterwards. The corollary is that exceptions have to be deliberate: a designer or engineer with a genuine performance requirement should have a specified model, not a general exemption. Written standards also make the disposal and data-destruction step enforceable, because the devices being retired are known.

• Define a small number of standard configurations by role.
• Route exceptions through a named approver rather than leaving them informal.
• Keep the asset record accurate enough to support warranty and disposal.
• Make data destruction on retirement a documented step, not an assumption.

What to gather, and how HighGround helps

Bring the current asset list with models and warranty end dates, the count of users by role, the support arrangement you have now, the downtime cost by user group, and the refresh date the business needs. Add the two facts that shape the replacement: which devices fail the current operating system's hardware requirements, and the sanitisation level the business has to certify at disposal. HighGround sources devices, warranty and lifecycle services through the AppDirect catalog and scopes each requirement individually. Availability, pricing and terms depend on the models specified, the locations being served and the contract term. An inquiry places no order and commits you to nothing, and HighGround may receive compensation from a provider on a completed purchase.

• Asset list with model, age and warranty end date.
• Users grouped by role, and the performance each role actually needs.
• Current support arrangement, response times and any recurring problems.
• The date the fleet must be refreshed, and why that date.
• The sanitisation level the business must be able to certify at disposal.

PUT THE OPTIONS SIDE BY SIDE

Your comparison checklist

Common questions