Trio
Iran-born, globally-sold enterprise device management. I designed every feature on the platform, end to end — from a solo MVP onward, in a market led by Kandji and Jamf.
An AI-powered unified endpoint management platform for SMBs and enterprises — device management, endpoint security, identity, and a purpose-built K-12 education suite.
Trio manages devices across macOS, Windows, iOS, and Android; handles endpoint security (EDR, patch and vulnerability management, compliance automation for HIPAA/GDPR/SOC 2) and identity and access (SSO, MFA, zero-trust conditional access). I led design across all four pillars for three years, and every one of them is a product in its own right. Marketing claims a 15-minute go-live and an 80% cut in IT workload.
Every feature on trio.so, designed end to end.
Every surface the product ships today came through my design — device management, endpoint security, identity and access, and the K-12 education suite. Not screens handed over at the end: I owned each feature from the first framing question through to the build review, and stayed with it until it shipped.
- → Frame it. What the IT admin is actually trying to do, how the category already solves it, and what each OS’s management protocol will genuinely allow.
- → Design the whole flow, not the happy path. Empty, loading, partial and failure states; permissions and roles; bulk actions across hundreds of devices; and what the screen says when a device is simply offline.
- → Specify it. Information architecture, interaction detail, in-product copy, and the design-system components every screen is assembled from.
- → Follow it into the build. Review what was implemented against what was designed, and keep adjusting with the team until the shipped thing matches.
Flows were checked with engineering before they were built
Every flow went through the teams that had to build it: backend on the data model and the shape of the API, front-end on what the console could realistically do, and the separate agent teams for macOS, Windows, iOS and Android — whose platform limits decide what a feature can honestly promise. In device management that check is not optional. A policy that Apple’s protocol will not enforce, or a command the Android agent cannot deliver, is a broken promise on screen no matter how clean the interface looks.
That loop is why the flows held up. By the time a spec reached a developer the hard questions had already been answered, so what got built was the whole feature rather than the parts that happened to be easy. After the MVP I did this alongside a team of designers. Framing each feature with the CEO and TPM stayed with me. As the designers grew, I handed them the flows and wireframes too, and by the end they demoed their own work to the CEO and engineering.
A market of tools IT admins tolerate rather than like.
MDM platforms are notoriously complex — dominated by products that admins put up with rather than enjoy. Trio needed to launch fast and differentiate on simplicity, in a category where the incumbents were Kandji and Jamf.
Ship the smallest coherent product, then compound on it.
Four products under one console.
What Trio ships today, and what an end-to-end brief had to cover on each of them. Every item below is a set of flows, states and screens I framed, designed and took through build.
- ·Zero-touch enrollment via Apple Business Manager and Apple School Manager
- ·Apple, Windows and Android MDM — configuration profiles, app deployment, OS updates
- ·Command Center: run commands and scripts across a fleet, targeted by device or group
- ·Policy management by role, team or location, with recommended templates
- ·Kiosk mode, BYOD work profiles, remote lock and wipe
- ·Location services, real-time tracking and geofencing
- ·Patch and vulnerability management, with silent updates that don’t interrupt the user
- ·macOS and Windows EDR — detection, alerting and auto-remediation
- ·Compliance automation: prebuilt HIPAA, GDPR, SOC 2 and CIS policy sets
- ·Audit trails, violation alerts and compliance reporting
- ·Data loss prevention and FileVault / BitLocker enforcement
- ·SSO and MFA — biometrics, OTP and certificate-based sign-in
- ·Conditional access and device zero trust, evaluated in real time
- ·Passwordless workflows across cloud apps, VPNs and on-prem resources
- ·Role-based access rules keyed to team, location or device health
- ·Cloud RADIUS for certificate-based Wi-Fi and VPN access
- ·A K-12 portal built as its own product surface, not a mode inside the admin console
- ·Classes, students and staff — set up and managed by school teams, not IT specialists
- ·Screen-time limits and app restrictions for shared and 1:1 devices
- ·Bulk setup of 100+ tablets, and usage reporting for teachers and administrators
Alongside them: the multi-tenant console MSPs use to run many customers at once, the integrations directory, migration from Workspace ONE and legacy MDM, and the built-in helpdesk — plus the design system underneath all of it.
Flows, the design system, and the platform surfaces.
- → Users consistently praised the UX and the clarity of the user flows.