A control pushes a single setting or behaviour to the devices you choose. Use this page to see which controls exist and which platforms each one supports before you create one.
Overview
Each control targets one of three scopes: every device, selected device groups, or a custom target. After you deploy a control, compliance monitoring keeps checking that each targeted device still reports the state you set.
Controls fall into seven families. The tables below show platform support for each one.
How to use
- Go to MDM > Controls.
- Click Add new control.
- Pick the platform.
- Set up the control and choose its targets: all devices, device groups, or a custom target.
- Deploy it.
OS updates
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Enforce minimum OS version | ✅ | ✅ | ✅ | ||
| Automatic app and OS updates | ✅ |
Security
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Password and screenlock | ✅ | ✅ | ✅ | ✅ | |
| Disk encryption | ✅ | ✅ | |||
| Firewall | ✅ | ✅ | |||
| recoveryOS protection | ✅ | ||||
| Lock MDM profiles pane | ✅ |
Restrictions
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| App blocking | ✅ | ||||
| AirDrop restriction | ✅ | ||||
| Screen capture blocking | ✅ | ||||
| USB storage blocking | ✅ | ✅ | ✅ |
Local admin accounts
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Admin management | ✅ | ✅ | |||
| Admin password rotation | ✅ | ✅ |
Login and SSO
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Mac login with Entra | ✅ | ||||
| Mac login with Okta | ✅ | ||||
| Windows login with Okta | ✅ |
Device configuration
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Wi-Fi | ✅ | ✅ | ✅ | ✅ | ✅ |
| Google Chrome | ✅ | ✅ | |||
| Device naming | ✅ | ✅ | ✅ | ||
| Remote access | ✅ | ✅ | ✅ | ||
| AirPrint | ✅ |
Custom configuration
| Control | macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|---|
| Custom file | ✅ | ✅ | ✅ | ✅ | |
| Generate settings via AI | ✅ | ✅ |
Tips and Best Practices
- Check the platform table first. If a platform cell is empty, the control does nothing there. Plan another route for those devices.
- Target device groups rather than everything. Roll a new control out to a small group, check it, then widen the scope.
- Prefer a ready-made control over a custom file. Use Custom file or Generate settings via AI only when no built-in control covers the setting.
- Watch compliance after deploying. It tells you which targeted devices have drifted from the expected state.
Troubleshooting and FAQ
Troubleshooting
- A control does not apply to some devices. Check the platform tables. The control may not support that operating system.
- A device shows as non-compliant after deployment. Compliance compares what the device reports with what the control expects. Open the device and look at which control it fails.
- You cannot find the control you need. Use Custom file to push your own configuration, or Generate settings via AI on macOS and iOS / iPadOS.
FAQ
-
Who receives a control?
Whatever you target: all devices, specific device groups, or a custom target.
-
How do I know a control is still in place?
Compliance monitoring checks that every targeted device keeps reporting the expected state.
-
Which control works on every platform?
Wi-Fi. It supports macOS, Windows, Linux, iOS / iPadOS and Android.
-
Can I block USB storage on Linux?
Yes. USB storage blocking covers macOS, Windows and Linux.