Configuration profiles can be added and removed at any time just by changing the scope. Want it to be locked down and day, add it to the scope. Want it to be changed the next hour, remove it from the scope. Devices can have as many configuration profiles as you want. The recommended setup is that each configuration policy only has one payload. In other words add restrictions to one configuration policy and if you want to do something under networking or AppleID add that to another policy.
The JSS will ask if you want to modify all devices scoped or changed the newly added/removed devices.
