Related to the announcement DINUM (France) is switching to NixOS, you might be interested in looking into their Sécurix project:
Considering their initial fleet of 250 machines across two machine types (one for IT admins, one for general users), I bet they have fleet management in consideration.