A method implemented by an Internet-connected device (102, 120, 130), the method comprising: transmitting, to a server (104a, 104b) associated with a first device management service, a request to enroll the Internet-connected device (102, 120, 130) with the first device management service; receiving, from the server (104a, 104b) associated with the first device management service, a first policy profile including one or more first device management policies, the first policy profile defining at least one restriction on management of the Internet-connected device (102, 120, 130) by other device management services with which the Internet-connected device (102, 120, 130) enrolls; transmitting, to a server (104a, 104b) associated with a second device management service, a request to enroll the Internet-connected device (102, 120, 130) with the second device management service; prior to transmitting the request to enroll the Internet-connected device (102, 120, 130) with the second device management service, transmitting an indication of the at least one restriction to the server (104a, 104b) associated with the second device management service; receiving, from the server (104a, 104b) associated with the second device management service, a second policy profile including one or more second device management policies; identifying a subset of the one or more second device management policies which comply with the at least one restriction; and applying the identified subset of the one or more second device management policies on the Internet-connected device (102, 120, 130), wherein the at least one restriction indicates one or more features of the Internet-connected device (102, 120, 130) which are not manageable by the second device management service. transmitting, to a server (104a, 104b) associated with a first device management service, a request to enroll the Internet-connected device (102, 120, 130) with the first device management service; receiving, from the server (104a, 104b) associated with the first device management service, a first policy profile including one or more first device management policies, the first policy profile defining at least one restriction on management of the Internet-connected device (102, 120, 130) by other device management services with which the Internet-connected device (102, 120, 130) enrolls; transmitting, to a server (104a, 104b) associated with a second device management service, a request to enroll the Internet-connected device (102, 120, 130) with the second device management service; prior to transmitting the request to enroll the Internet-connected device (102, 120, 130) with the second device management service, transmitting an indication of the at least one restriction to the server (104a, 104b) associated with the second device management service; receiving, from the server (104a, 104b) associated with the second device management service, a second policy profile including one or more second device management policies; identifying a subset of the one or more second device management policies which comply with the at least one restriction; and applying the identified subset of the one or more second device management policies on the Internet-connected device (102, 120, 130), wherein the at least one restriction indicates one or more features of the Internet-connected device (102, 120, 130) which are not manageable by the second device management service.