--- title: "Monitor and troubleshoot employee devices with Datadog End User Device Monitoring" description: "Catch degrading devices before employees file tickets, trace issues across devices and networks, and resolve recurring problems with Datadog End User Device Monitoring." author: "Erica Ho, Paolo Padua" date: 2026-11-10 tags: ["infrastructure monitoring", "network device monitoring", "bits ai", "digital experience monitoring", "root cause analysis"] blog_type_id: the-monitor locale: en --- When an employee’s Zoom call drops, Excel freezes, or an application fails to load, work stalls. Repeated interruptions put deadlines and business outcomes at risk, yet many disruptions go unreported as employees work around or ignore them. To move beyond firefighting, IT teams need tools that help them spot emerging issues, understand who’s affected, and act before disruptions spread. [Datadog End User Device Monitoring (EUDM)](http://datadoghq.com/products/observability/end-user-device-monitoring/) helps IT operations and service desk teams catch device problems early and fix recurring disruptions at the source. EUDM extends the [Datadog Agent](https://www.datadoghq.com/blog/datadog-agent.md) to employee laptops and workstations, combining visibility into device health with network and application context in the platform infrastructure teams already use. IT can investigate without prolonged back-and-forth with employees or waiting on other teams, and hand off issues with the evidence attached. In this post, we’ll show how EUDM helps IT teams move from firefighting to proactive resolution: - [Start the day knowing which devices need attention](#start-the-day-knowing-which-devices-need-attention) - [Find the cause before escalating to other teams](#find-the-cause-before-escalating-to-other-teams) - [Catch recurring problems and risks at their source](#catch-recurring-problems-and-risks-at-their-source) - [Start each fix with the root cause already identified](#start-each-fix-with-the-root-cause-already-identified) ## Start the day knowing which devices need attention IT teams often begin their days by working through a backlog of employee-submitted tickets. Let's say salespeople at a branch office are struggling through choppy Zoom calls with customers, while employees working from home cannot connect to an internal application. Before deciding what takes priority, IT needs to understand the scope of each problem. Gathering that information often starts with screen sharing and asking employees to collect diagnostics. EUDM gives IT a head start before anyone contacts the person who filed the ticket. The fleet overview shows other laptops with declining health at the same branch, including devices whose users haven’t reported a problem. The map shows that the pattern is concentrated at that branch. ![The EUDM Fleet Overview summarizes device health across the fleet and maps devices by location.](https://web-assets.dd-static.net/42588/1794336325-eudm-fleet-overview.png) In [Command Center](https://www.datadoghq.com/blog/auto-detected-endpoint-issues.md), now [available in preview](https://www.datadoghq.com/product-preview/end-user-device-monitoring/), IT reviews detected issues, ranked by severity. Each issue has a card that summarizes its scope and root cause, so the team can assess impact without piecing it together ticket by ticket. A high-severity issue covers the branch’s disrupted Zoom calls. A medium-severity issue shows increased connection errors for the internal application, affecting employees working remotely. ![Command Center lists detected device issues as cards ranked by severity, each showing the number of affected devices and a summary of the cause.](https://web-assets.dd-static.net/42588/1794336880-eudm-command-center.png) The application issue affects a few employees, while the critical Zoom issue is putting customer deals at risk. IT has a clear view of each issue's severity and can quickly set priorities: They get to work on the Zoom issue. Because the investigation findings are already attached, the team starts in on root cause analysis without any back-and-forth with employees. ## Find the cause before escalating to other teams EUDM narrows down root causes by correlating device performance, application activity, and network conditions. For the dropped Zoom calls, the Command Center card shows that all of the affected laptops at the branch are connected to the same access point. That makes the access point the likely culprit, so IT checks the laptops’ Wi-Fi metrics and network paths to confirm it before escalating. As more laptops report the same problem, related findings are added to the open issue. To see where the calls degrade, IT checks [Network Path](https://docs.datadoghq.com/network_monitoring/network_path.md), which uses real traffic to trace connections from devices to SaaS applications like Zoom, Microsoft Teams, or Salesforce. It shows latency at each hop, from the router through the internet service provider (ISP) to the application’s CDN and servers. ![Network Path shows six branch laptops reaching Zoom through the same access point, with latency highlighted on the first hop.](https://web-assets.dd-static.net/42588/1794336336-eudm-network-path-zoom.png) Network Path shows exactly where the connection degrades, pinpointing the problem at a network access point. Before escalating to the Network team, IT reviews the suggested next steps in EUDM’s Command Center to determine what needs to change. IT then hands off the issue with all the context the Network team needs to resolve it. ![An EUDM device page shows a laptop with critical Zoom meeting quality, connected to a degraded access point serving 60 devices.](https://web-assets.dd-static.net/42588/1794336343-eudm-device-access-point.png) In the meantime, IT moves affected employees to a nearby access point with more available capacity. Using the investigation findings, the network team confirms that the original access point is congested, serving 60 clients on a single channel, and adjusts its configuration to reduce the load. Because both teams work from the same data, IT is able to restore the branch's customer calls without the investigation bouncing between teams and tools. ## Catch recurring problems and risks at their source Investigating one ticket at a time obscures problems that affect multiple employees at once. A software update might cause the same application to crash on dozens of laptops, with each affected employee reporting it separately, leading service desk engineers on different shifts to repeat the same investigations. EUDM links the current issue to relevant past investigations, helping the team check whether similar issues have come up before. Earlier findings show which causes were already examined, so a returning problem doesn’t send the investigation back to square one. The Command Center issue card carries Bits Investigation’s root cause findings, supporting evidence, and recommended next steps. Its investigation trail records the diagnostic queries and hypotheses already examined, so the receiving team knows where the work left off. ![Bits Investigation’s hypothesis tree traces a poor Wi-Fi alert to rapid channel swaps that forced a laptop onto a weak access point, with suggested next steps.](https://web-assets.dd-static.net/42588/1794336348-eudm-bits-investigation-hypothesis-tree.png) [Bits Investigation](https://www.datadoghq.com/product/ai/bits-investigation/) correlates related issues across devices into a single issue card, and if the problem spreads, it updates that card instead of creating a duplicate. In this case, Bits identified that employees were reaching the internal application without first connecting to the VPN. IT can fix this issue at the source by reminding these employees of the VPN step. ## Start each fix with the root cause already identified EUDM uses Bits Investigation to help IT operations move from reactive to proactive, with faster issue detection and root cause analysis. Each issue card includes an investigation trail showing the diagnostic queries, hypotheses, and decision path behind the findings. IT teams can review this evidence before taking action or escalating the issue. To dig deeper, they can continue in [Bits Chat](https://www.datadoghq.com/blog/introducing-bits-chat.md) with the investigation context intact. For example, they can ask which laptops have low battery capacity or which devices use the most CPU. Recommended next steps include opening an incident, triggering a workflow, or notifying affected employees, all of which can be done in Datadog. The service desk assigns ownership, updates priority, and links related work in existing tools like Jira or ServiceNow without leaving the card. [Datadog Work Management](https://docs.datadoghq.com/incident_response/work_management.md) keeps those actions and the investigation together as one work item. A bidirectional integration keeps history in sync wherever updates are made, so both teams follow progress from the tools they use. ![A Work Management work item shows a Bits Investigation conclusion, supporting evidence, and suggested next steps.](https://web-assets.dd-static.net/42588/1794336354-eudm-work-management-work-item.png) With EUDM, IT catches device problems before employees report them, resolves them at the source, and hands off evidence that stays with the issue. Calls stay stable, applications stay available, and the team spends its time getting ahead instead of firefighting. ## Get started with End User Device Monitoring A problem affecting dozens of employees shouldn’t require dozens of investigations. Datadog End User Device Monitoring brings device, application, and network context together so IT can quickly understand what’s wrong, see which devices are affected, and coordinate a fix. With shared findings and recommended next steps, teams can spend less time piecing together the problem and more time resolving it across their fleet. End User Device Monitoring is now generally available. Explore the [documentation](https://docs.datadoghq.com/infrastructure/end_user_device_monitoring.md) to get started. If you’re new to Datadog, .