CliftonLarsonAllen

CliftonLarsonAllen (CLA) is one of the largest professional services firms in the United States. The organization provides audit, tax, wealth management, and advisory services and has recently expanded into building software solutions. That expansion has driven rapid employee growth in multiple regions around the world.

Today, CLA supports approximately 9,000 laptops and 600 Azure Virtual Desktop sessions across multiple geographies. With the business growing through both acquisition and organic hiring, ensuring consistent support for remote employees quickly became a strategic priority.

The Challenge

As CLA moved from domain joined and VPN centric devices to Microsoft Entra joined endpoints and lightweight VPN use, traditional support methods became increasingly difficult to manage. The service desk relied on older remote access tools and Microsoft Teams screen sharing, which slowed investigations, required unnecessary escalations, and often depended on the user being connected to VPN.

International hiring and acquisitions added to the complexity. Many new employees began working from regions without existing infrastructure or device management capabilities. When applications were missing or malfunctioning, IT often lacked visibility into affected devices or the ability to inspect them remotely.

Security investigations also depended heavily on a user’s ability to connect. When devices were isolated due to compliance concerns, engineers were unable to access those devices until users returned to an office location.

The Solution

CLA first introduced ControlUp to expand visibility into Remote Desktop workloads, then quickly expanded to use ControlUp for VDI to manage AVD deployments and ControlUp for Desktops for laptops and PCs.

With ControlUp, service desk teams and engineers gained the ability to view device performance, support login issues, terminate problematic processes, and open remote PowerShell sessions without requiring the user to connect through VPN. Remote shell capabilities became a central part of engineering workflows, allowing investigations to proceed while users continued working.

ControlUp also enabled CLA to build automated device isolation workflows. When a compliance issue occurs, CLA can isolate a device from internal resources while still maintaining ControlUp connectivity. This allows engineers to investigate and respond immediately rather than waiting for physical access.

As CLA expanded to new regions, ControlUp allowed the organization to support AVD sessions without deploying infrastructure in each geography. Administrators deploy the ControlUp agent and tag new devices, which enables centralized support for all global endpoints.

The Result

ControlUp has become a day-to-day support tool for the service desk and engineering teams across CLA. By consolidating remote viewing, remote shell, and device troubleshooting into a single platform, CLA has reduced reliance on legacy tools and improved consistency across global support processes.

The impact is especially noticeable during critical periods such as tax season when downtime tolerance is low and support responsiveness is essential. Analysts can investigate issues more quickly, reduce escalations, and spend less time coordinating remote screen shares.

Device isolation capabilities have strengthened security posture and reduced investigation delays. With ControlUp access maintained during isolation, engineers can perform diagnostics immediately, even for overseas endpoints.

Looking forward, CLA plans to deepen integration between ControlUp and ServiceNow, including chatbot initiated remediation for common issues and automated script execution. Engineering teams have already developed internal modules that streamline data collection and centralized logging using ControlUp APIs.

ControlUp now forms a consistent foundation for CLA’s global support strategy, enabling users across multiple continents to stay productive, secure, and connected to the organization’s core services without requiring traditional infrastructure or VPN dependencies.