Custom 

Yes 

– 

Device restrictions 

Yes 

– 

Email (Samsung KNOX only) 

Yes 

– 

MX profile (Zebra only) 

Yes 

– 

PKCS certificate 

Yes 

Dependencies: Trusted Certificate 

PKCS imported certificate 

Yes 

– 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: PKCS, SCEP 

VPN 

Yes 

– 

Wi-Fi 

Yes 

– 

Settings catalog 

Yes 

– 

Device restrictions 

Yes 

– 

PKCS certificate 

Yes 

Dependencies: Trusted Certificate 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: PKCS, SCEP 

Wi-Fi 

Yes 

– 

Settings catalog 

Yes 

– 

Device restrictions 

Yes 

– 

OEMConfig 

Not supported 

– 

Wi-Fi 

Yes 

– 

VPN 

Yes 

– 

Trusted certificate 

Yes 

Dependencies: SCEP 

PKCS certificate 

Yes 

Dependencies: Trusted Certificate 

PKCS imported certificate 

Yes 

– 

Derived credential 

Yes 

– 

SCEP certificate 

Yes 

Dependencies: SCEP, Trusted Certificate 

Email 

Yes 

– 

Settings catalog 

Yes 

– 

Custom 

Yes 

– 

Derived credential 

Yes 

– 

Device features 

Yes 

– 

Device restrictions 

Yes 

– 

Edition upgrade & mode switch 

Yes 

– 

Email 

Yes 

– 

PKCS certificate 

Yes 

Dependencies: Trusted Certificate 

PKCS imported certificate 

Yes 

– 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: PKCS, SCEP 

Secure assessment (Education) 

Yes 

– 

VPN 

Yes 

– 

Wi-Fi 

Yes 

– 

Settings catalog 

Yes 

– 

Custom 

Yes 

– 

Device features 

Yes 

– 

Device restrictions 

Yes 

– 

Endpoint protection 

Not supported 

Deprecated by Microsoft 

Extensions 

Not supported 

Deprecated by Microsoft 

PKCS certificate 

Yes 

– 

PKCS imported certificate 

Yes 

– 

Preference file 

Yes 

– 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: SCEP 

Software updates 

Yes 

– 

VPN 

Yes 

– 

Wi-Fi 

Yes 

– 

Wired network 

Yes 

– 

Settings catalog 

Yes 

– 

BIOS Configurations and other settings 

Partially supported 

Backup and restore (create, not update). 

Custom 

Yes 

– 

Delivery Optimization 

Yes 

– 

Device firmware configuration interface 

Yes 

– 

Device restrictions 

Yes 

– 

Device restrictions (Windows 10 Team) 

Yes 

– 

Domain join 

Yes 

– 

Edition upgrade & mode switch 

Yes 

– 

Email 

Yes 

– 

Endpoint protection 

Yes 

– 

Identity protection 

Not supported 

Deprecated by Microsoft 

Imported Administrative templates (Preview) 

Yes 

– 

Kiosk 

Yes 

– 

Microsoft Defender for Endpoint (Desktop devices running Windows 10 or later) 

Not supported 

– 

Network boundary 

Yes 

– 

PKCS certificate 

Yes 

– 

PKCS imported certificate 

Yes 

– 

Properties catalog 

Not supported 

Requires additional permissions; planned for a future iteration. 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: SCEP 

Secure assessment (Education) 

Yes 

– 

Shared multi-user device 

Yes 

– 

VPN 

Yes 

– 

Wi-Fi 

Yes 

– 

Windows health monitoring 

Yes 

– 

Wired network 

Yes 

– 

Device restrictions 

Yes 

– 

SCEP certificate 

Yes 

Dependencies: Trusted Certificate 

Trusted certificate 

Yes 

Dependencies: SCEP 

VPN 

Yes 

– 

Wi-Fi 

Yes 

– 

All Apps 

Yes 

Managed Apps scope 

All Microsoft Apps 

Yes 

Managed Apps scope 

Core Microsoft Apps 

Yes 

Managed Apps scope 

Managed Devices 

Not supported 

App configuration policies targeted at Managed Devices are out of scope. 

Remediations 

Yes 

Linux (platform scripts) 

Yes 

See Limitation 1 (folder location in Keepit UI)

MacOS (platform scripts) 

Yes 

See Limitation 1 (folder location in Keepit UI)

Windows 10 and later (platform scripts) 

Yes 

See Limitation 1 (folder location in Keepit UI)

Update rings 

Yes 

See Limitation 1 (folder location in Keepit UI)

Feature updates — Feature update policy 

Yes 

Feature updates — Autopatch multi-phase release (Windows 11, 25H2) 

Yes 

See Limitation 2 (Autopatch group linkage and phase state)

Feature updates — Autopatch multi-phase release (Windows 11, 24H2) 

Yes 

See Limitation 2 (Autopatch group linkage and phase state)

Feature updates — Autopatch multi-phase release (Windows 11, 23H2) 

Yes 

See Limitation 2 (Autopatch group linkage and phase state)

Quality updates — Windows quality update policy 

Yes 

Quality updates — Expedite policy 

Yes 

Driver updates 

Yes 

Windows PC 

Yes 

HoloLens 

Yes 

iOS / iPadOS 

Yes 

Windows 10 and later 

Yes 

Android device administrator 

Yes 

Android Enterprise 

Yes 

Android (AOSP) 

Yes 

macOS 

Yes 

Android 

Yes 

iOS / iPadOS 

Yes 

Windows 

Yes