Endpoint Management Modes
CapaOne manages Windows, Android, and Apple devices using different management frameworks — each platform has its own enrollment methods and management capabilities. This reference summarises the key modes and what each one enables.
Windows
Section titled “Windows”Windows endpoints are managed through the CapaOne Agent — a lightweight service installed on each device.
| Mode | How enrolled | Management level |
|---|---|---|
| Agent (standard) | MSI or PowerShell installer, or via Provision Manager | Full management: apps, configurations, drivers, privileges, security, experience monitoring |
All Windows management in CapaOne requires the agent. There is no agentless Windows management. The agent communicates with CapaOne over HTTPS and checks in periodically to receive configurations, app assignments, and policy updates.
See Windows Enrollment for enrollment options.
Android
Section titled “Android”Android management uses Android Enterprise and varies by how much of the device is managed.
| Mode | Use case | Management level |
|---|---|---|
| Fully Managed | Corporate-owned devices, IT controls the entire device | Full device management: all apps, configurations, restrictions |
| Fully Managed with Work Profile | Corporate-owned, but user has a personal space | Full control of the managed side; personal side is separated and unmanaged |
| Work Profile (BYOD) | Personal devices, IT manages only the work container | Manages only the work profile; personal data and apps are not visible to IT |
The enrollment mode is chosen during device setup and determines what CapaOne can and cannot manage on the device. It cannot be changed after enrollment without wiping and re-enrolling.
See Android Enrollment for enrollment methods (QR code, token, zero-touch, Samsung Knox).
Apple (iOS / iPadOS / macOS)
Section titled “Apple (iOS / iPadOS / macOS)”Apple devices use MDM (Mobile Device Management) profiles, with the level of management determined primarily by whether the device is Supervised.
| Mode | How enrolled | Management level |
|---|---|---|
| Supervised (DEP) | Enrolled through Apple Business Manager during initial device setup | Full management: silent app install, advanced restrictions, lock screen messages, supervised-only configurations |
| Unsupervised (BYOD) | User installs MDM profile manually | Limited management: configurations and apps, but many restrictions and supervised-only features unavailable |
Supervised mode requires the device to be registered in Apple Business Manager (ABM) before first setup. A device that has been set up by the user without DEP cannot be made Supervised without a factory reset.
See Apple Enrollment and Apple DEP Integration.
Choosing the right mode
Section titled “Choosing the right mode”The right mode depends on device ownership and the level of control required:
- Corporate-owned devices — use Fully Managed (Android) or Supervised/DEP (Apple) for the broadest management capabilities.
- BYOD — use Work Profile (Android) or Unsupervised enrollment (Apple) to manage only the work portion while respecting user privacy.
- Shared/kiosk devices — use Fully Managed Android with a Kiosk configuration, or Supervised Apple with a locked-down profile.
Good to know
Section titled “Good to know”- Management mode is set at enrollment — you cannot upgrade an unsupervised Apple device to supervised, or change an Android device from BYOD Work Profile to Fully Managed, without wiping and re-enrolling.
- Supervised-only features — some Apple configuration profile settings only apply to Supervised devices. Applying them to unsupervised devices has no effect.
- Android Enterprise is required — all Android management modes require a linked Android Enterprise account. See Android Enterprise Setup.