# Endpoint Management Modes

> The management frameworks, enrollment methods, and capabilities available for Windows, Android, and Apple devices.

Source: https://docs.capaone.com/capaone/reference/endpoint-management-modes/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

CapaOne manages Windows, Android, and Apple devices using different management frameworks —
each platform has its own enrollment methods and management capabilities. This reference
summarises the key modes and what each one enables.

## Windows

Windows endpoints are managed through the **CapaOne Agent** — a lightweight service installed
on each device.

| Mode | How enrolled | Management level |
|---|---|---|
| **Agent (standard)** | MSI or PowerShell installer, or via Provision Manager | Full management: apps, configurations, drivers, privileges, security, experience monitoring |

All Windows management in CapaOne requires the agent. There is no agentless Windows management.
The agent communicates with CapaOne over HTTPS and checks in periodically to receive
configurations, app assignments, and policy updates.

See [Windows Enrollment](/capaone/enrollment/windows-enrollment/) for enrollment options.

## Android

Android management uses **Android Enterprise** and varies by how much of the device is managed.

| Mode | Use case | Management level |
|---|---|---|
| **Fully Managed** | Corporate-owned devices, IT controls the entire device | Full device management: all apps, configurations, restrictions |
| **Fully Managed with Work Profile** | Corporate-owned, but user has a personal space | Full control of the managed side; personal side is separated and unmanaged |
| **Work Profile (BYOD)** | Personal devices, IT manages only the work container | Manages only the work profile; personal data and apps are not visible to IT |

The enrollment mode is chosen during device setup and determines what CapaOne can and cannot
manage on the device. It cannot be changed after enrollment without wiping and re-enrolling.

See [Android Enrollment](/capaone/enrollment/android-enrollment/) for enrollment methods (QR
code, token, zero-touch, Samsung Knox).

## Apple (iOS / iPadOS / macOS)

Apple devices use **MDM (Mobile Device Management)** profiles, with the level of management
determined primarily by whether the device is **Supervised**.

| Mode | How enrolled | Management level |
|---|---|---|
| **Supervised (DEP)** | Enrolled through Apple Business Manager during initial device setup | Full management: silent app install, advanced restrictions, lock screen messages, supervised-only configurations |
| **Unsupervised (BYOD)** | User installs MDM profile manually | Limited management: configurations and apps, but many restrictions and supervised-only features unavailable |

Supervised mode requires the device to be registered in Apple Business Manager (ABM) before
first setup. A device that has been set up by the user without DEP cannot be made Supervised
without a factory reset.

See [Apple Enrollment](/capaone/enrollment/apple-enrollment/) and
[Apple DEP Integration](/capaone/mobile-manager/apple-mdm/apple-dep-integration/).

## Choosing the right mode

The right mode depends on device ownership and the level of control required:

- **Corporate-owned devices** — use Fully Managed (Android) or Supervised/DEP (Apple) for the
  broadest management capabilities.
- **BYOD** — use Work Profile (Android) or Unsupervised enrollment (Apple) to manage only the
  work portion while respecting user privacy.
- **Shared/kiosk devices** — use Fully Managed Android with a Kiosk configuration, or Supervised
  Apple with a locked-down profile.

## Good to know

- **Management mode is set at enrollment** — you cannot upgrade an unsupervised Apple device to
  supervised, or change an Android device from BYOD Work Profile to Fully Managed, without
  wiping and re-enrolling.
- **Supervised-only features** — some Apple configuration profile settings only apply to
  Supervised devices. Applying them to unsupervised devices has no effect.
- **Android Enterprise is required** — all Android management modes require a linked Android
  Enterprise account. See [Android Enterprise Setup](/capaone/mobile-manager/android/android-enterprise-setup/).