Sophos Connect SSL VPN - Managed vs Unmanaged Connections

I notice several of the help screens for SCCLI.EXE have verbiage to this effect (in this case, from 'SCCLI remove')--

* The remove command will fail in environments where policy does not allow
unmanaged connections to be used.
* The remove command can only remove connections added with the add command.
Managed connections cannot be removed.

I'm not finding a description of "managed" and "unmanaged" connections in the SSL VPN GUI (including in the SSL VPN Policy that the help text seems to be referencing), nor have I found it in a search on this site.

I've now made a significant investment in scripting deployment of what are, empirically, "unmanaged" connections, because I can add and remove them via SCCLI.

"Managed" connections have an appealing sound to them--if I only knew what they were. Especially if users don't need to be bothered with them during deployment, like they do with OVPN and PRO files, and if I don't have to roll my own deployment via scripting and Group Policy Preferences.

Where are "managed" connections documented?

TIA