There’s basically two approaches: inventory and enforcement.

In the former, you have your MDM inventory all the things and you follow up with folks that aren’t patched. In the latter, you lock it down and roll it out.

For dev environments, maybe try using a VM built using CI/CD and using that as the “dev environment”, so you can do it all in one go and make it easier to roll things out to folks once tested.

CodeSpaces is good for that… but, um…