Factorial IT manages macOS, Windows, Linux, iOS, iPadOS, Android and ChromeOS from one place. This article lists the minimum version for each platform and what you can and cannot do on it, so you know what to expect before you enrol a device.

Overview

Check this article before you enrol a new platform or promise a capability to your team. Coverage is not identical everywhere: some limits come from the operating system itself, not from Factorial IT, and no configuration will work around them.

What each platform supports

How to use

Work through these before enrolling a platform for the first time:

1. Check the minimum version. Devices below it cannot enrol.
2. Check the capabilities you actually need in the table above, not the ones you assume are there. Remote wipe on Android and controls on Linux are the two that surprise people most often.
3. Read the platform note below if you are enrolling Windows, Linux, ChromeOS, or mobile.

Windows

Windows Home enrols, but it is not a managed device. It will appear in your inventory and report back, and that is close to where it stops: no BitLocker, it cannot join Microsoft Entra ID, and only part of the security controls apply.

Treat Home as a stopgap, not a configuration. If the machine belongs to the company, upgrade it to Windows Pro rather than working around the gaps. Use Pro, Enterprise or Education for anything you need to actually manage.

ARM devices work, with limits. Software installation is supported, but the maintained app catalogue holds mostly 64-bit x86 builds. Deploying those to an ARM device can fail or install something unexpected.

Mobile

Encryption is not yours to manage on either platform. iPhones and iPads are encrypted by Apple out of the box, with nothing to configure. Android encrypts itself too, enforced by the operating system — there is no MDM setting for it, and its absence from your controls is not a gap.

Remote wipe on Android needs a company-owned device, enrolled through zero touch in fully managed mode. A personal Android on a work profile cannot be wiped; disenrol it instead, which removes the work profile and everything in it.

Linux

You can report on encryption status across your Linux fleet and escrow recovery keys, so you keep access if a device locks. What you cannot do is manage encryption from your side — Linux has no mechanism to encrypt a disk after installation, so it has to be configured when the operating system is installed.

iOS, iPadOS and Android

These devices are encrypted by the operating system. There is nothing to switch on and nothing to manage — encryption cannot be toggled through MDM on either platform. Scripts and osquery are also unavailable, which is a platform limitation rather than a gap in Factorial IT.

ChromeOS

You can enrol ChromeOS devices for monitoring, but controls, software installation and policy enforcement run through your Google Admin console, not through Factorial IT. Contact support to set this up.

Troubleshooting and FAQ

Troubleshooting

• A Windows device will not enrol. Check the edition. Pro, Enterprise and Education enrol; Home does not, and no setting changes that.
• A Linux device reports no encryption. Encryption was not configured when the operating system was installed. The dashboard reports on Linux encryption but cannot apply it, so the device has to be rebuilt with encryption enabled.
• Controls are not applying to a Linux device. Controls are not supported on Linux. Use scripts instead.

FAQ

1. Can we manage encryption on iPhones and Android devices?
   No, and you do not need to. Both platforms encrypt at the operating system level and the setting cannot be managed through MDM.
    
2. Why can I not run scripts on mobile devices?
   iOS, iPadOS and Android do not expose script execution to MDM. It is a platform limitation.
    
3. Is ChromeOS fully managed by Factorial IT?
   Only monitoring. Controls, software and policy enforcement stay in your Google Admin console.