Academy
Technical · Course T5

Lesson 1 of 5

Policy types and management levels

7 min read
In this lesson you'll learn to
  • Match each policy type to its ownership model and management level
  • Explain what Apple supervision unlocks and how a device gets it
  • Know which choices are permanent and how to recover from a wrong one

Every managed device runs under exactly one policy, and the policy's type — chosen at creation — decides the ceiling of what you can manage. Settings can change daily; type is forever. That makes type selection the one decision worth slowing down for.

Android: three management levels

TypeLevelBest for
Work ProfileManaged container onlyBYOD — personal devices with a work/personal wall
Work ManagedFull deviceCompany-owned devices issued to employees
KioskFull device + locked launcherPOS terminals, signage, shared tablets, rugged scanners

Work Profile creates an encrypted container for corporate apps and data. The admin manages apps, passwords, and networking inside the profile — and can wipe it remotely — but never touches personal apps, photos, or device-level settings. That privacy wall is the selling point for BYOD programs.

Work Managed owns the entire device: every setting, every app, factory reset protection, OTA updates. Kiosk is Work Managed plus a replacement home screen that shows only the apps you allow — with its own branding, layouts, and unlock password.

Each type also has a Non-Play variant for devices without Google services — AOSP builds, rugged industrial hardware, regions without Play. App delivery there runs on private APKs instead of the Play Store. And OEM variants (Samsung, LG, Huawei) layer manufacturer capabilities — like Samsung Knox — on the same three levels. An OEM policy on the wrong brand of device doesn't break; the OEM-specific features simply do nothing.

Apple: supervision is the dividing line

Apple policy types pair each device class with a supervised and non-supervised form: iPhone/iPad, Shared iPad, Apple TV, and MacBook.

  • Supervised devices — enrolled through Apple Business Manager (ABM/DEP) — expose the full restriction catalog (content filtering, app lock, AirDrop, iMessage, App Store controls) and the management profile cannot be removed by the user.
  • Non-supervised devices get the essentials: app installation, Wi-Fi and VPN payloads, a basic restriction set — and the user can remove the profile at will.

When a customer asks why an iOS setting is greyed out, supervision is the first thing to check. The fix is re-enrollment through ABM — not a toggle.

Windows: two types

Company Owned for standard management, Kiosk for single-purpose machines. Simpler menu, same principle: pick by how the device is owned and used.

The one-way door, and the way back

Type cannot be changed after creation. Picked Work Profile and now need full control? Create a Work Managed policy and transfer the devices to it — transfers work between policies of the same platform and compatible type. It's a detour, not a disaster, but scoping the ownership model correctly up front is cheaper.

Knowledge check
1. A customer wants full control of company-owned Android devices. Which policy type?
2. You created a Work Profile policy but the customer now wants full device control. What do you do?
3. Which iOS restrictions are unavailable on a non-supervised iPhone?