policy is an OU/container
devices can only be direct member of one policy, but policies can be beuilt on a hierarchy w/inheritance
MDM profile can be applied to a policy via intergrations sectrion
enrollment can be accomplished via profile download, url copy, or qr code (qr also has option to send download link to admin email assoc w/addigy acct)
addigy best installed via MDM, but can be installed via
- agent .pkg (not ideal after MacOS 10.14 due to permission request spam)
- terminal
- email (link to download .pkg)
addigy live terminal user has access to sudo w/o needing password on devices where that is enabled
wiping iOS devices via addigy factory zeroes device; macos is fully wiped (devices with modern recovery options still have recovery mode available if recovered)
- DEP enrolled devices are automatically re-enrolled after a wipe
some device facts can be changed in local device as well as in addigy

- be sure to install profile with policy
- device reports facts every 5mins, runs policy every 30 mins
- install of profile during system setup requires ABM/ASM acct for DEP
- when changing alert, must review changes and confirm
- addigy checks repos daily for the public software
- parent policy settings lock out the setting in child policies
* * best practice would probably be setting stuff from the bottom up
- - system/ms update options that are radio buttons are NOT inherited
- - create separate policies for test env, server
- global mdm profile intended for businesses that only manage their own devices, per-policy is intended for consultants

**HW: Adding Public Software to the Depolyments tab in GoLive article in Addigy KB