When your employees install software on their own without company consent, this is called Shadow IT. They might have good intentions, but this activity can lead to unwanted results.

The answer to this is Azure Active Directory (AAD) as a part of the Enterprise Mobility + Security (EM+S) suite and Intune for remote device management. And in most cases, AAD is included in Office 365.