Technical · Course T5Lesson 1 of 5
Policy types and management levels
7 min read- Match each policy type to its ownership model and management level
- Explain what Apple supervision unlocks and how a device gets it
- Know which choices are permanent and how to recover from a wrong one
Every managed device runs under exactly one policy, and the policy's type — chosen at creation — decides the ceiling of what you can manage. Settings can change daily; type is forever. That makes type selection the one decision worth slowing down for.
Android: three management levels
| Type | Level | Best for |
|---|---|---|
| Work Profile | Managed container only | BYOD — personal devices with a work/personal wall |
| Work Managed | Full device | Company-owned devices issued to employees |
| Kiosk | Full device + locked launcher | POS terminals, signage, shared tablets, rugged scanners |
Work Profile creates an encrypted container for corporate apps and data. The admin manages apps, passwords, and networking inside the profile — and can wipe it remotely — but never touches personal apps, photos, or device-level settings. That privacy wall is the selling point for BYOD programs.
Work Managed owns the entire device: every setting, every app, factory reset protection, OTA updates. Kiosk is Work Managed plus a replacement home screen that shows only the apps you allow — with its own branding, layouts, and unlock password.
Each type also has a Non-Play variant for devices without Google services — AOSP builds, rugged industrial hardware, regions without Play. App delivery there runs on private APKs instead of the Play Store. And OEM variants (Samsung, LG, Huawei) layer manufacturer capabilities — like Samsung Knox — on the same three levels. An OEM policy on the wrong brand of device doesn't break; the OEM-specific features simply do nothing.
Apple: supervision is the dividing line
Apple policy types pair each device class with a supervised and non-supervised form: iPhone/iPad, Shared iPad, Apple TV, and MacBook.
- Supervised devices — enrolled through Apple Business Manager (ABM/DEP) — expose the full restriction catalog (content filtering, app lock, AirDrop, iMessage, App Store controls) and the management profile cannot be removed by the user.
- Non-supervised devices get the essentials: app installation, Wi-Fi and VPN payloads, a basic restriction set — and the user can remove the profile at will.
When a customer asks why an iOS setting is greyed out, supervision is the first thing to check. The fix is re-enrollment through ABM — not a toggle.
Windows: two types
Company Owned for standard management, Kiosk for single-purpose machines. Simpler menu, same principle: pick by how the device is owned and used.
The one-way door, and the way back
Type cannot be changed after creation. Picked Work Profile and now need full control? Create a Work Managed policy and transfer the devices to it — transfers work between policies of the same platform and compatible type. It's a detour, not a disaster, but scoping the ownership model correctly up front is cheaper.