DEV Community: AssetLoom Marketer

Employee Asset Tracking Without Giving Everyone a Login

AssetLoom Marketer — Fri, 16 Oct 2026 04:47:19 +0000

Employee asset tracking usually gets tested on the worst possible day. An auditor asks for every laptop still held by people who left this year. IT exports the asset list, HR exports the staff list, and the two files disagree on almost everything.

The devices are rarely the problem. The people are. And there is a quiet reason why. The 200 people holding your laptops are not the 3 people who log in to your asset tool.

The good news is that the people side is the easier one to fix. You can keep an accurate record of who holds what, for every employee, contractor and intern, without handing everyone a login.

Employee Asset Tracking Starts With the Person, Not the Device

Employee asset tracking links every company-owned item to the person who holds it, with a start date, an end date, and its condition at each handover. It is the custody layer on top of your inventory. Done well, anyone can open a person’s record and see their full kit in seconds.

Most IT asset tracking focuses on the asset. It answers “Where is laptop LP-014?” just fine. HR, managers and employees ask something else. What does this person hold right now?

A laptop’s serial number never changes. A person’s name, email, team and contract type change all the time, and each change can quietly cut the link between a person and their kit. The asset record stays perfect. The people record rots.

Personal devices (BYOD) stay off the list. Shared gear like projectors belongs in a check-in and check-out system, not on one person’s record.

Every Assignee Needs an Identity, Not an Account

One customer asked us a simple question. Could they assign a laptop by typing the employee’s name, like a location, and keep access limited to a few admins?

Fair request. Giving 200 people a login just to “own” a laptop record is overkill. But a typed name breaks too. Micle Trertern, Trertern M and Micle.T look like three different people to any system. That is how Spreadsheet IT is born. No errors, just quietly wrong data.

There are three ways to record who holds an item.

Free-text name. It costs nothing up front, but you get typos, duplicates, and no way to reach the person at exit.
A user account for everyone. You pay in invites and password resets, and most people never log in anyway.
A people record with no login. It takes a one-time import or sync, and someone (usually HR or IT) must own the list.

The third option is what most small IT teams want from employee asset tracking. Each person gets one record keyed to a work email or employee ID, and only the admins who manage assets log in. That split is the difference between a list you can audit and a list you have to defend.

The People Your HR System Forgets

Most tools that rank for this topic put assets on the HR profile. That works until the person holding the laptop is not in HR at all. These six person types break records most often.

Person type	What usually goes wrong	Practical rule
Contractors and agency staff	They hold company laptops but are missing from HR, so nobody triggers a return	Add them with a work email and contract end date
Interns	They join and leave in groups, so returns pile up in one week	Treat each intern group as one planned recovery event
Rehires	A new email creates a second record, and old items stay on the “ghost” one	Merge the two records before you assign anything new
Name or email changes	Assignments look orphaned after a marriage, a typo fix or a domain change	Link records by employee ID, not by name
Shared roles	Items get assigned to “Front Desk” and nobody is responsible	Always assign to a named person who signs for it
Long leave	Nobody decides what happens to the kit	Record-keep or collect, with a review date

Picture a common version. A designer leaves, then returns eight months later with a new email. IT creates a fresh record and issues a new MacBook. Her old MacBook sits in the cupboard, still assigned to her old record. It never gets reused, and at the next audit it looks missing. The fix takes five minutes. Finding it takes a whole audit.

Who Owns the People List and the Changes in the Middle

The fix for most employee asset tracking errors is to stop asking one system to do everything.

The HR system owns status. Hired, on leave, transferred, left. Your identity provider owns the matching key. Google Workspace, Microsoft Entra ID or Okta already gives each person a unique ID tied to their work account. The asset tool owns custody. Who holds which item, since when, and in what condition.

Then follow one rule. Match people on employee ID or work email, never on names. In Vietnam, Nguyễn is by far the most common family name, so two employees named Anna Ritter in one company is not rare. Anna ID does not get typed without accents.

These everyday changes freeze your employee asset tracking in the past when HR does not tell IT.

The pattern is the same every time. The person changed, but the record did not. A cheap fix is to add “update asset records” as one line on the HR change form.

Let Employees Check Their Own Kit Without Logging In

Most employee asset tracking treats employees as records to update. A better approach makes them part of the check, without making them learn another tool.

When employees can see what is assigned to them, they spot mistakes early. At exit, there is less to argue about, because they have seen the list all along. A short email with each person’s list works fine as a start.

Twice a year, ask each person to confirm their list. This is called asset attestation, and it takes a few minutes. Only the exceptions go to IT. For remote teams, it is far less work than a full physical check, though it does not replace one.

One guardrail. Employee asset tracking records who holds company property, not what people do all day. Before you turn on any device location feature, write a clear policy and check local law.

The Employee Asset Health Check: Three Numbers to Watch Monthly

Three numbers tell you, in about 20 minutes a month, whether your employee asset tracking can be trusted.

Orphan rate. The share of assigned items held by people who are inactive or unknown. Compare your assignment list with HR’s active staff list. In our view, anything above zero needs a name and a follow-up date.

Unmatched people. Active staff whose record does not match the identity provider, such as duplicates and old emails. Each one is a future ghost assignment.

Attestation exception rate. The share of confirmations where the employee says “that’s not what I have.” A rising rate means handovers are not being recorded.

Here is an illustrative example. A 120-person company runs its first check after a confirmation round. It finds 7 of its 260 assigned items (about 3%) still assigned to 4 people who already left, 3 duplicate records, and 9 exceptions out of 110 confirmations (about 8%). Better to find it this way than in a surprise audit.

How AssetLoom Supports Employee Asset Tracking Today

Shaped by that customer request, we are working on the People Directory feature. It will let you add employees, contractors and interns as assignees by work email, with no AssetLoom login. It is coming in a future release.

Until then, here is what IT teams can already use today.

Assign and recover by person. Assign laptops, monitors and licenses to individual employees, and see what each person holds when they move or leave.
Predefined Kits. Bundle the standard laptop, headset and accessories for a role, and assign the whole kit to a new hire in one step.
Automated return reminders. When an item is due back, reminders go out automatically, so nobody has to chase returns from memory.
QR codes and mobile scanning. Label assets with QR codes or barcodes and check items in and out from a phone at the handover desk.
Asset Booking for shared gear. Keep projectors and test devices off personal records with reservations and returns.
MDM integrations. Microsoft Intune and Jamf Pro bring device details into each asset record.

AssetLoom is free forever for teams managing under 250 assets. Explore AssetLoom to see the full flow.

Conclusion

Most asset records don’t fail because a laptop goes missing. They fail because a person changes and the record does not. A transfer, a rehire with a new email, or a contractor who never made it into HR is enough to turn a clean list into a guessing game.

The fix is not more logins or more spreadsheets. Give every assignee one real identity, keyed to a work email or employee ID. Keep logins for the few people who manage assets, let everyone else check their own kit, and watch three numbers every month.

Start with this month’s health check. It takes about 20 minutes and shows quickly whether your employee asset tracking really works.

FAQs

1. Should employee asset tracking live in the HR system or an ITAM tool?

Both, with separate jobs. The HR system owns employment status, like hired, on leave or left. The ITAM tool owns custody, meaning who holds which item, since when, and in what condition. HR systems often miss contractors and interns, so link the two by employee ID or work email, never by name.

2. Is employee asset tracking the same as employee monitoring?

No. Employee asset tracking records which company items each person holds. Monitoring looks at what people do. Consent rules for device location vary by country, so write a policy first.

3. Should contractors be tracked the same way as employees?

Yes. Contractors often hold the same laptops and badges as staff but are missing from HR. Add them with a work email and an end date that matches their contract.

4. What happens to assigned assets during long leave?

Decide per item and write it down. A laptop can often stay for a short leave, but specialist gear others need should come back. Set a review date either way.

5. How often should employees confirm what they hold?

Twice a year works for most teams. Add a quick check after any transfer, role change or move to remote work, since those are the moments records drift. If your exception rate climbs above a few percent, move to quarterly until it settles.

BYOD Asset Discovery: How to Track Personal Devices That Reach Company Data

AssetLoom Marketer — Fri, 16 Oct 2026 04:41:43 +0000

BYOD asset discovery usually starts the same way. Your asset sheet looks great. Every company laptop has a tag, an owner, and a color-coded status column someone spent a weekend on. Then a customer security review lands in your inbox with one simple question. Which personal devices can open your files?

The spreadsheet goes very quiet.

Here's the thing. Finding personal devices is the easy part, because your identity provider already knows about most of them. The hard part is turning that evidence into records you'd actually show an auditor, with a named owner, a known access path, and an honest level of confidence. Here's how one IT team did it in six steps, with two admins and two weeks.

The Question the Asset Sheet Couldn't Answer

Picture a 120-person company where a quarter of the staff are contractors. People work from the office, from home, and from cafés with questionable Wi-Fi. Two admins run IT on Microsoft 365, with Intune managing the company laptops.

Then a big customer's security questionnaire asks how many personal devices can access customer data. The deadline is two weeks away. The identity records list about two and a half times as many devices as the asset sheet.

BYOD asset discovery is the process of finding personal devices that access company systems or data, then recording who uses them, how they connect, and what they can reach. You track the access, not the ownership. For the basics of running a BYOD program, see our separate guide.

Why Personal Devices Never Reach the Asset Inventory

Most IT asset management(ITAM) records start with a purchase. IT buys a laptop, tags it, and adds it to the list. Personal devices skip that step completely. They show up through a sign-in instead, usually in one of three ways.

A personal phone with work email. An employee adds their work account in two minutes. The phone never appears anywhere IT checks.
A contractor's own laptop. They log in from it on day one. When the contract ends, the laptop leaves with them.
A shared family PC. Someone opens Slack "just for a minute." Now a computer used by two people has a company login on it.

The problem isn't the tools. It's the process. Onboarding never asks, "Which device will you use?" So the IT inventory only shows what the company bought, and BYOD asset discovery has to start with sign-ins, not purchases.

How to Turn BYOD Asset Discovery Into Accountable Records: 6 Steps

Most BYOD asset discovery can run on data you already have in your identity provider and MDM. Many personal devices never touch the office network, so identity data does the heavy lifting. A network scan covers the devices that do, and our guide to IT asset discovery explains how the methods fit together.

Step 1. Decide Which Company Data Puts a Device in Scope

Start with data, not devices. A device is in scope when it can reach something that would hurt if it leaked. Think customer files, finance systems, source code, and work email.

The team listed five sensitive apps. Any personal device that signs in to one of them counts. This took one afternoon.

Watch out. Don't try to inventory every phone on guest Wi-Fi. That's a lot of work for a list nobody will use.

What you get. A short scope list of apps and data that the whole team agrees on.

Step 2. Pull Device Evidence From Identity, MDM and Network Records

This step is about collecting evidence. Export from four sources.

Your identity provider. Pull the device list and sign-in logs from Microsoft Entra ID, Okta, or Google Workspace.
Your MDM. In Intune, filter by ownership type. In Jamf, check devices enrolled through account-driven User Enrollment.
Work mailboxes. List the mobile devices connected to them.
The office network. Our free Network Scanner finds every device on your LAN, including personal phones and laptops on office Wi-Fi. Export the results as a CSV and add them to your spreadsheet.

The team ended up with about 300 device entries. The asset sheet had 118 laptops.

Some entries won't have a device name. A laptop that signs in through a browser often shows only an OS and a browser in Entra sign-in logs. Keep those rows anyway. They're real access.

Watch out. Don't rely on MDM alone. The devices you most need to find are never enrolled, so MDM can't see them. Also, don't fully trust Intune's "Personal" label. Intune marks self-enrolled devices as Personal by default, so a few company laptops may be in that list.

What you get. One raw spreadsheet with a column showing where each record came from. You'll need it in Step 4.

Step 3. Clean the List Before You Count Anything

Raw device data is messy. Clean it with four rules before you report any number.

Merge duplicates. One phone can appear several times after a reset or an app reinstall. Match by user, model, and OS, not by name. Half your users' phones are just called "iPhone."
Match scan results by hostname. Phones use a random MAC address on office Wi-Fi, so the MAC can't tell you it's the same device.
Mark old devices as stale. No sign-in for 90 days means stale. Don't delete them, since you may need the history later.
Flag shared devices. Follow up instead of guessing the owner.

Here, cleanup merged 61 duplicates, marked 52 devices as stale, and flagged 6 shared ones. That left 187 active personal devices, after about two days of work.

Watch out. Don't send the raw number to management. The first BYOD asset discovery number always looks scary. Report the cleaned one.

What you get. A clean list of active personal devices.

Step 4. Sort Every Device: Seen, Attributed or Accountable

This is the step most teams skip, and it's the one that makes BYOD asset discovery worth trusting. Sort each device by how much IT actually knows about it.

Use these three levels to label every device on your clean list.

The goal isn't to make every device Accountable. The goal is that no device with access to sensitive data stays at Seen. Auditors trust honest uncertainty more than fake completeness.

Most devices on the team's list started at Seen, including every browser-only row from Step 2. A short message to each employee and contractor ("Is this your device?") moved most of them to Attributed within three days.

Watch out. "Registered in Entra ID" doesn't mean "managed." Registered only means the device signed in. It says nothing about whether IT controls it.

What you get. Every device has a confidence level.

Step 5. Choose Control Levels Based on Data, Not Device Type

Next, decide how much control each Attributed device needs. Let the data it can reach make the call.

Sensitive data. Use app protection (MAM, or mobile application management) or allow browser-only access.
Everything else. Require sign-in with conditional access rules, which check things like location and device health before letting someone in.

The team started with contractors. Their devices change the most, IT knows the least about them, and they leave when the project ends. We'd start there every time.

One manager refused to put MDM on their phone. Fair enough. A one-page note explaining what IT can and can't see fixed it. Track work access only. Never collect location, personal apps, or browsing history.

Watch out. Forcing full MDM on every personal device causes pushback, and people find workarounds. The workaround is usually worse.

What you get. Every Attributed device has a control level, which moves it to Accountable.

Step 6. Build Lifecycle Triggers So Records Stay Current

A BYOD record starts going out of date the day you create it. People buy new phones, and contractor projects end. Without triggers, BYOD asset discovery becomes a one-time project that's stale by next quarter. Tie updates to moments that already happen.

Onboarding. Add one question to the checklist, "Which device will you use?" Then create the record.
Device change. Update the record when someone gets a new phone or laptop.
Offboarding. Revoke access, wipe work data if the device is enrolled, and close the record with a date.

The team gives every contractor record an end date on day one, so access expires on time. That's what turns a one-time cleanup into real IT inventory tracking.

Watch out. Don't delete the record at offboarding. The closed record proves access ended. Auditors like proof. They're less fond of "we're pretty sure."

What you get. Records that update through normal work, plus a quick monthly check to move leftover Seen devices to Attributed.

What IT Can Answer Now That It Couldn't Before

The questionnaire is no longer scary. That's the practical payoff of BYOD asset discovery.

After two weeks, the team's 300 raw entries came down to 187 active personal devices. Of those, 142 were fully Accountable, 31 had a confirmed owner, and 14 were still unconfirmed and blocked from sensitive apps. The answer to the customer was short. In total, 173 personal devices can reach customer data, every one has a named owner, and 14 unconfirmed devices are blocked. It's not a perfect number. It's a defensible one.

The team can now also answer the usual follow-ups, like who owns each device, what IT actually controls, and which devices lose access when someone leaves.

This matters for security, too. Verizon's 2025 Data Breach Investigations Report looked at devices infected with password-stealing malware. Of those that held company logins, 46% weren't managed by IT. Knowing your BYOD devices won't change that number. But it shows you which of those devices could be yours.

How AssetLoom Supports Accountable BYOD Records

Most inventory management software for IT assumes the company bought the device. BYOD breaks that assumption. Identity and MDM tools give you the evidence and the controls. AssetLoom is where the inventory record lives once BYOD asset discovery has done its job.

See what's on the office network. The free AssetLoom Network Scanner finds devices on your LAN without agents and exports the results as a CSV, ready to import into AssetLoom.
Bring device data into one place. Import your cleaned device list as a CSV, including scan results and identity-provider exports.
Track every device through its lifecycle. Each record has a status, so you can see which devices are active and which have been closed.
Automate onboarding and offboarding. Workflows handle the repetitive steps, so offboarding doesn't depend on someone's memory.

Your MDM controls devices. AssetLoom keeps the inventory record of which devices exist and where they stand. It doesn't replace your MDM or wipe devices. It keeps the record that tells you which devices to act on.

Start With Evidence, End With Records You Can Defend

Personal devices were never missing from your company, only from your IT inventory. Scope by data, clean before you count, be honest about confidence, and let normal work keep records current.

Start with the free Network Scanner to see what's on your office network. Still on spreadsheets? AssetLoom offers free IT inventory management for teams under 250 assets. Accurate records are what make BYOD asset discovery worth the effort.

FAQs

1. What happens to a BYOD record when someone leaves?

Close it with a date and a note on how access was revoked. Don't delete it. The closed record proves that access ended.

2. Should personal devices be part of your ITAM inventory?

Yes, as a separate asset class. Track the owner, access scope, control level, and status. Skip cost and depreciation, since the company doesn't own the hardware.

3. Is it legal to record employees' personal devices?

Recording work access is common, but rules differ by country. Tell employees exactly what you collect and why. This isn't legal advice, so check with your legal team.

4. Why does one phone show up as several devices?

In identity records, resetting a phone or reinstalling a work app can register a new device object. On a network scan, phones often use a randomized MAC address on each Wi-Fi network. Match by user, model, and OS in identity data, and by hostname in scan results.

5. How is BYOD different from CYOD and COPE?

It comes down to ownership. With BYOD, the employee owns the device. With CYOD, employees choose from company-approved devices. With COPE, the company owns the device but allows some personal use.

Snipe-IT Alternatives for Inventory Management: When Is It Time to Switch?

AssetLoom Marketer — Fri, 09 Oct 2026 04:49:09 +0000

Snipe-IT inventory management works well until keeping the records true becomes a second job. You open Snipe-IT the week before a count. It says you have 14 spare USB-C docks. The shelf has 6. Nobody stole anything. The docks just moved, and nobody told the system.

So when is it time to switch? Switch when keeping records accurate costs more time than the tool saves you. That usually shows up as devices in Intune or Jamf missing from your IT inventory, monthly CSV cleanups, and physical counts that keep finding gaps. If only one or two of these apply, a process fix, a sync setup, or moving to hosted Snipe-IT is often enough.

Here is how to tell which camp you're in.

What Snipe-IT Does Well for Inventory

Let's be fair first. Snipe-IT is a solid record-keeper, and many IT teams run it happily for years. It is one of the best-known options for free IT inventory management. You can self-host it at no cost, or pay for cloud hosting if you'd rather skip the server. If you want the bigger picture of where inventory fits, our guide to IT asset management (ITAM) covers it.

Here is where Snipe-IT earns its place.

Five record types. Assets, licenses, accessories, components, and consumables each get their own logic. A laptop keeps a full history. Toner just goes down in quantity.
Custody tracking. Check assets out to a person, location, or another asset, and see who had what.
Proof of receipt. Users confirm receipt, which helps when someone says "I never got that."
Kits. Pre-defined kits make new-hire checkouts faster.
Labels and scanning. Barcode and QR labels work with most handheld scanners.
Alerts. Low stock, expiring warranties and licenses, and due audits.
MDM sync. Since v8.8, native sync adapters connect Intune, Jamf Pro, Kandji, and other MDM tools. They are still in beta.
Openness. A REST API, LDAP or Active Directory sync, and SAML login.

Snipe-IT fits best in a small, mostly on-site estate with an admin who enjoys running a server. If that is you, a lot of what follows is a process question, not a tool question. For a full feature walkthrough, see our guide to Snipe-IT asset management.

Where Snipe-IT Inventory Management Requires More Manual Work

Snipe-IT is honest software. It records exactly what you tell it, and nothing more. Your devices change faster than people type.

Records only exist if someone creates them

Devices arrive through manual entry, CSV import, the API, or an MDM sync. Anything outside your MDM, like printers, network gear, or a contractor's laptop, still needs a person to add it.

MDM sync is new and still in beta

Snipe-IT v8.8 added native sync adapters, so teams no longer need scripts like jamf2snipe for the common MDM tools. That removes a lot of plumbing. But self-hosted teams must upgrade first, and early users report issues like duplicate assets when serial numbers don't match. Test on one device group before you trust it with real data.

Alerts depend on the scheduler

On a self-hosted server, low-stock and audit emails rely on a cron job that runs Snipe-IT's scheduler. The installer usually sets it up. After a manual install or a server move, it can quietly stop, and nobody notices until the toner runs out.

The server is yours too

Upgrades, backups, PHP versions, and database care all land on the same small team.

Picture a 300-device team that spends about two hours every Monday exporting from Intune and fixing mismatched serial numbers by hand. That is roughly 100 hours a year of IT inventory tracking. Snipe-IT was supposed to replace the spreadsheet. Now there is a spreadsheet that feeds Snipe-IT. The new sync adapters can fix this, once they are stable and set up well.

Why Inventory Records Start Drifting From Reality

Most drift doesn't come from the software. It comes from moments when something real happened and the record didn't change. Four causes of most damage include:

The help desk swap. A user's laptop dies. The tech hands over a spare. The spare is checked out, but the dead one is never checked in. Now one person "has" two laptops.
The rushed offboarding. The laptop comes back on the last day and goes straight to a shelf. The record says the laptop is "with Mike." Mike left in March.
The part pulled for a repair. Someone takes 16 GB of RAM from a spare machine to fix another. The component count is now wrong, and nobody knows until the next upgrade.
The loaner grabbed from a shelf. A projector or a test phone leaves without a check-out because "it's just for today." Today becomes three weeks.

Consumables add one more trap. In Snipe-IT, a checked-out consumable can't be checked back in. One wrong click, and the count stays wrong until someone fixes it by hand.

Audits help, but only so far. A count checks the records you have. A device nobody entered never shows up as "overdue," because Snipe-IT doesn't know it exists.

A clean audit report is not a correct inventory. You usually find out when an auditor wants a full device list by Friday.

No tool fixes everything. Better software catches data-entry drift, like wrong serials. It can't stop handoff drift, like skipped check-ins. Mobile check-in and offboarding workflows help, but only if people use them.

Signs It's Time to Look Beyond Snipe-IT Inventory Management

Check the symptoms before you shop. This 15-minute monthly check uses Snipe-IT reports and your MDM console.

Be strict when you score. Zero to two signals usually means a process gap. Three signals point to a data problem that MDM sync might fix. Four or more means the cost of keeping records true has become structural. Signal 5 alone points to hosting, not necessarily a new tool. The 5% line is our own rule of thumb, not an industry standard.

Switch, Integrate, Host or Stay? Matching the Option to Your Signals

Not every Snipe-IT inventory management problem needs a new tool. Let your score point to the real cause.

If you scored 0 to 2, stay. Keep your setup and fix the habits instead. Check in before check-out, audit on a fixed schedule, and give each location one owner. Vendors rarely admit it, but this is often the right call. A new tool with old habits is the same mess with nicer screens.

If signals 1 and 2 dominate, integrate. Upgrade to v8.8, test the sync adapter on one device group, and turn on serial-number matching to avoid duplicates. If signal 5 is your main pain, move to hosted Snipe-IT. You keep the same data and workflows, minus the server work, which makes it the cheapest switch you can make.

If you scored 4 or more, it's time to switch. Expect migration effort, retraining, and a new tool to learn.

What to Look for in a Snipe-IT Alternative for Inventory Management

Alternatives come in three types. SaaS ITAM platforms remove the server work. Self-hosted tools like GLPI keep you on your own servers. MDM consoles show device data but rarely track custody or consumables.

When you compare inventory management software for IT, judge it by the manual work it removes. Ask these questions in every trial.

Is MDM sync native and stable? Check which tools connect out of the box, and whether the connection is still in beta.
Do labels work without extra setup? QR and barcode labels should print in formats your scanners read.
Can people check items in and out from a phone? Check which phones are supported today.
Is there a clear path out of Snipe-IT? Ask how CSV import maps your fields and custody history.
Does it cover the full lifecycle? Assignment, maintenance, and depreciation in one record.
Who runs the infrastructure? SaaS takes upgrades and backups off your list.
Can onboarding and offboarding run as workflows? That's where most drift starts.

One tip. Vendor demos use clean data. Yours isn't. Test with your messiest location, the storage room with the mystery boxes. If the tool handles that, it handles everything.

AssetLoom as an Alternative to Snipe-IT

If you're ready to switch, put AssetLoom through the same checklist. Here's what it brings.

Device sync. Native Intune and Jamf Pro integrations, with no server to upgrade.
Labels and scanning. QR and barcode labels in CODE128, CODE39, and EAN13, exported as PNG, SVG, or PDF.
Mobile. Scan to check items in and out.
Migration. CSV import for your Snipe-IT export.
Maintenance and depreciation. Log repairs and warranty work with costs and dates through asset maintenance. Depreciation is tracked for assets.
Infrastructure. Fully managed SaaS. No servers, cron jobs, or upgrades.
Onboarding and offboarding. Automation assigns kits to new hires and creates return tasks for leavers.
Shared equipment. Booking and reservations for loaners and project gear.
Pricing. Free forever for teams managing under 250 assets.

Fair warning. AssetLoom runs as SaaS today. Private hosting is planned for enterprise and custom plans, but if you need to self-host now, Snipe-IT is still the safer pick.

Conclusion

Snipe-IT remains a solid choice for teams that are comfortable running both the inventory records and the server behind them. With native MDM sync arriving, it is also a stronger option than it was. Many teams should stay, fix a few habits and move on.

But if keeping your IT inventory accurate has become a second job, the tool no longer saves you time. That is the moment to look around. Run the six-signal check, pick your path, and judge every alternative by the manual work it removes.

Not sure the switch is worth it? AssetLoom's free plan stays free forever for teams managing under 250 assets, so you can test a move from Snipe-IT inventory management at no cost.

FAQs

1. What is the difference between IT inventory and IT asset management?

IT inventory tells you what you own, where it is, and who has it. IT asset management goes further. It covers the full lifecycle, including purchase, maintenance, cost, depreciation, and when to replace a device. Inventory is the foundation. ITAM is what you do with it.

2. How often should IT teams audit their inventory?

There is no single rule, but a common pattern is a full count once a year and spot checks every quarter. High-value or mobile devices like laptops deserve more frequent checks. Also run a count after big events, such as an office move or a wave of departures.

3. What should IT inventory tracking record for each device?

At minimum, record the asset tag, serial number, model, current owner, location, and status. Add purchase date, cost, and warranty end date for budgeting. The most useful field over time is assignment history, because it tells you who had the device before something went wrong.

4. Is free IT inventory management software good enough?

For small teams, often yes. The license is free, but the work is not. Check the asset limits, which integrations are included, and who runs the server. A free tool that needs hours of upkeep every month can cost more than a paid one.

5. How do you keep IT inventory accurate between audits?

Fix the moments where drift starts. Check old devices in before checking new ones out, scan items at every handoff, and tie offboarding to asset returns. Sync device data from your MDM so serials stay correct. Give each location one owner who answers for its records.

How to Scan a Private IP Range Without Touching the Wrong Network

AssetLoom Marketer — Thu, 08 Oct 2026 07:39:29 +0000

If you need to scan private IP range safely, the scan itself is the easy part. The hard part is knowing which addresses are really yours.

We hear some version of this story every year. A new admin runs nmap -sn 10.0.0.0/8 on a Friday to "see everything." By Monday, the firewall is sluggish, security has an alert, and a payment vendor is asking why their network got probed through the VPN tunnel.

Nothing malicious happened. The scan was just too big and pointed at unchecked space.

The short answer is simple. Don't sweep the whole private space. Rule out ranges that belong to vendors, cloud peers, or containers. Map the subnets you actually use, probe gateways to find the live ones, and sweep only those.

A Private IP Isn't Always Your IP

Private only means an address can't travel across the public internet. It says nothing about who owns the network behind it.

RFC 1918 defines three private IP ranges. Most companies use pieces of all three, often without a full list of where. Here's where each private IP range usually shows up in a real company network.

The 10.x range is the one people accidentally sweep. It's huge, and it's where most internal routing lives.

Inside these ranges, some addresses are reachable from your network but belong to someone else. Rule these out before you scan anything.

Site-to-site VPN tunnels to vendors, payment processors, or a parent company
Cloud networks peered with a partner's account
An MSP's management network
Pod and service ranges on your Kubernetes clusters. These are yours, but they change by the minute and usually aren't reachable from outside the cluster.
100.64.0.0/10 used by carrier NAT and some mesh VPNs. It isn't RFC 1918, but people often treat it like private space.

If a probe gets routed into a vendor tunnel, you aren't scanning your network anymore. You're scanning theirs. A technical task just became a contract question, and maybe a legal one.

Overlap causes a quieter problem. Two branches that both use 192.168.1.0/24 look like one subnet from headquarters. Your scan shows one office and silently skips the other.

The Real Risk Hides in Empty Address Space

The three private ranges hold about 17.9 million IPv4 addresses. A company with 300 people might use a few dozen /24 subnets. That's a few thousand addresses, well under 1% of the space.

So a blind sweep spends almost all its effort on addresses that don't exist. And that space isn't free.

Every probe that crosses a stateful firewall can create a session entry. An unthrottled sweep opens thousands of new sessions per second, which is enough to choke a smaller branch firewall.
Empty addresses never reply, so a blind sweep spends most of its time listening to silence.
A steady sweep across a /8 looks a lot like the reconnaissance that IDS and EDR tools are built to catch.

These are calculated estimates at 100 addresses per second, a polite rate for a production network.!

Fifty hours is a full weekend of traffic aimed mostly at nothing.

Map Your Private Space Before Sending a Single Packet

To scan private IP range safely, start with what your network already knows. You just have to ask it in the right places. Begin with the fastest sources and work down.

DHCP scopes. They show every user and device subnet you hand out.
Routing tables on core switches and firewalls. If a subnet is routed, it's in there.
Firewall address objects and VPN tunnel settings. These show what is not yours, so they become your excluded list.
Cloud network ranges. Include any peering connections.
Device IPs from Microsoft Intune or Jamf Pro. Useful if you already manage laptops there.
The IT inventory spreadsheet someone stopped updating in 2022. Use it as a hint, never as the truth.

Then turn what you find into three short text files.

ours.txt for subnets you know and can document
unknown.txt for space that is routed, but nobody can explain
exclude.txt for vendor tunnels, peered networks, and segments you've been told not to touch

Before you run anything, confirm the target count with a dry run, as covered in our safe network scanning practices guide. If you expect a few thousand hosts and see a few million, stop and fix the list.

Run a Gateway Census, Then Sweep Only Live Subnets

Your unknown.txt list still needs checking, but you don't need to probe every address in it. Knock on the front door of each /24 before you check every room.

Most subnets put their gateway on .1 or .254. Probe only those two addresses in each /24, and you learn which subnets are alive at a fraction of the cost.

Most scanners can run a census like this if you set four things.

Targets. Only the .1 and .254 addresses of each /24 in your unknown list.
Discovery only. Check whether hosts are alive, with no port scanning.
No DNS lookups. Reverse lookups on every live host slow the scan and add load to your DNS server.
A rate limit. Around 100 addresses per second is gentle enough for most production networks.

At that rate, a full sweep of the 10.x range checks 16,777,216 addresses and takes about 47 hours. The census checks 131,072 addresses and takes about 22 minutes. Same question, about 128 times less traffic.

A census has limits. Some gateways ignore ping, so add a TCP check on common ports like 22 or 443. The census also assumes /24 subnets. A /22 has one gateway for four /24 blocks, so three of them look empty. Compare the results with your routing table, which shows the real subnet sizes. A subnet that stays silent is unconfirmed, not empty.

Then run your normal discovery sweep on the live /24 subnets only.

Where You Scan From Changes What You Find

The same scan gives different answers depending on where it starts. On the same segment, ARP works and almost every device has to answer. Cross a router, and you only see what ping, TCP, and the firewall allow. Over VPN, split tunneling may reach only part of the network, while a full tunnel pushes scan traffic through the concentrator your remote colleagues rely on. In the cloud, scan from inside, where security groups decide what answers.

Even your own laptop can mislead you. Docker and WSL often claim 172.17.x, so probes to that range never leave your machine.

Our rule is simple. Use one scanner per site or VLAN, not one laptop at headquarters.

When Scan Results Lie

Scan results look precise, which is exactly why they fool people.

Every address looks alive. Locally, that's usually proxy ARP. Across a router, it's often a firewall answering TCP probes for every address.
Windows machines look offline. Windows Firewall blocks ping by default.
Two sites merge into one list. Overlapping subnets produce duplicate IPs for different devices.

The fix is a cross-check against your DHCP and routing data. A device that shows up in only one source deserves a closer look.

Read more about how ARP, TCP and passive checks find devices that ignore ping in our guide to IT asset discovery.

How AssetLoom Supports Ongoing Device Visibility

Even a clean IP list is not an IT inventory. It tells you something is answered. It doesn't tell you what it is, who owns it, or whether anyone should care.

This is where the surprises show up. That mystery device on an undocumented subnet is often a printer a department bought on a company card and plugged in themselves. Nobody did anything wrong. It just never made it into the spreadsheet.

We built two tools that cover both halves of IT inventory tracking. The free scanner finds what's connected, and AssetLoom, our IT asset management (ITAM) platform, turns those results into records your team can act on. Here's how the workflow looks.

Scan your approved ranges. Run the AssetLoom Free Network Scanner against the live subnets from your census. It works on Windows, macOS, and Linux, needs no agents or sign-up, and runs locally, so your network data stays with you. Start with a dry run to confirm the target count before any packet leaves your laptop.
Export a clean list. The scanner writes one record per device, with details like IP address, MAC address, hostname, and vendor. Choose CSV for spreadsheets and imports, or JSON for scripts.

Import your device list. Bring the CSV into AssetLoom. Each live device becomes an asset record instead of a row in a file nobody opens again.
Assign an owner. Give every asset an owner and an assignment. When the mystery printer shows up in next quarter's scan, you already know which department to call.
Label the hardware. Generate QR code and barcode labels so the device on the desk matches the record on screen. Your team can check devices in and out with the AssetLoom mobile app.
Track the lifecycle. Keep each device's status and assignment in one place, from purchase to retirement.
Compare it with your MDM. Connect Microsoft Intune or Jamf Pro to sync your managed devices. Anything in your scan that's missing from that list deserves a conversation.

The scanner finds what's connected. AssetLoom keeps it accounted for.

Final Thoughts

Safe scanning in private space comes down to order. Rule out what isn't yours, map what you use, run a gateway census, then sweep only live subnets. Most of the risk is gone before the first packet leaves your laptop.

Map your private space first, then run your sweep with the AssetLoom Free Network Scanner and import the CSV into AssetLoom. That's how you scan private IP range safely.

FAQs

1. Is it legal to scan my company's private IP range?

Scanning your own network is normal IT work, but you still need written approval. Be careful with ranges reached through vendor tunnels or peering. Those belong to someone else, and scanning them without consent can break a contract or create legal problems.

2. How long does it take to scan `10.0.0.0/8`?

At 100 addresses per second, a full sweep takes about 47 hours. A gateway census that checks only .1 and .254 in each /24 takes about 22 minutes.

3. Can I scan private IP range from the internet?

No. Private addresses aren't routable on the public internet. To scan private IP range safely, run the scan from inside the network, from a scanner at each site, or over a VPN connection.

4. Can I sweep IPv6 private ranges (ULA, fd00::/8) the same way?

No. A single IPv6 /64 subnet has far too many addresses to sweep. Use neighbor discovery, DHCPv6 leases, and router tables to find IPv6 devices instead.

5. What if our private ranges overlap with a vendor's or an acquired company's network?

You can still scan private IP range safely when ranges overlap. Scan each site with a local scanner and keep the results in separate jobs. Label every result set by site, so two devices with the same IP never end up in one record.

DEV Community: AssetLoom Marketer

Employee Asset Tracking Without Giving Everyone a Login

Employee Asset Tracking Starts With the Person, Not the Device

Every Assignee Needs an Identity, Not an Account

The People Your HR System Forgets

Who Owns the People List and the Changes in the Middle

Let Employees Check Their Own Kit Without Logging In

The Employee Asset Health Check: Three Numbers to Watch Monthly

How AssetLoom Supports Employee Asset Tracking Today

Conclusion

FAQs

1. Should employee asset tracking live in the HR system or an ITAM tool?

2. Is employee asset tracking the same as employee monitoring?

3. Should contractors be tracked the same way as employees?

4. What happens to assigned assets during long leave?

5. How often should employees confirm what they hold?

BYOD Asset Discovery: How to Track Personal Devices That Reach Company Data

The Question the Asset Sheet Couldn't Answer

Why Personal Devices Never Reach the Asset Inventory

How to Turn BYOD Asset Discovery Into Accountable Records: 6 Steps

Step 1. Decide Which Company Data Puts a Device in Scope

Step 2. Pull Device Evidence From Identity, MDM and Network Records

Step 3. Clean the List Before You Count Anything

Step 4. Sort Every Device: Seen, Attributed or Accountable

Step 5. Choose Control Levels Based on Data, Not Device Type

Step 6. Build Lifecycle Triggers So Records Stay Current

What IT Can Answer Now That It Couldn't Before

How AssetLoom Supports Accountable BYOD Records

Start With Evidence, End With Records You Can Defend

FAQs

1. What happens to a BYOD record when someone leaves?

2. Should personal devices be part of your ITAM inventory?

3. Is it legal to record employees' personal devices?

4. Why does one phone show up as several devices?

5. How is BYOD different from CYOD and COPE?

Snipe-IT Alternatives for Inventory Management: When Is It Time to Switch?

What Snipe-IT Does Well for Inventory

Where Snipe-IT Inventory Management Requires More Manual Work

Records only exist if someone creates them

MDM sync is new and still in beta

Alerts depend on the scheduler

The server is yours too

Why Inventory Records Start Drifting From Reality

Signs It's Time to Look Beyond Snipe-IT Inventory Management

Switch, Integrate, Host or Stay? Matching the Option to Your Signals

What to Look for in a Snipe-IT Alternative for Inventory Management

AssetLoom as an Alternative to Snipe-IT

Conclusion

FAQs

1. What is the difference between IT inventory and IT asset management?

2. How often should IT teams audit their inventory?

3. What should IT inventory tracking record for each device?

4. Is free IT inventory management software good enough?

5. How do you keep IT inventory accurate between audits?

How to Scan a Private IP Range Without Touching the Wrong Network

A Private IP Isn't Always Your IP

The Real Risk Hides in Empty Address Space

Map Your Private Space Before Sending a Single Packet

Run a Gateway Census, Then Sweep Only Live Subnets

Where You Scan From Changes What You Find

When Scan Results Lie

How AssetLoom Supports Ongoing Device Visibility

Final Thoughts

FAQs

1. Is it legal to scan my company's private IP range?

2. How long does it take to scan 10.0.0.0/8?

3. Can I scan private IP range from the internet?

4. Can I sweep IPv6 private ranges (ULA, fd00::/8) the same way?

5. What if our private ranges overlap with a vendor's or an acquired company's network?

2. How long does it take to scan `10.0.0.0/8`?