Re: EMS and FortiClient
Yes, that's how the endpoint profiles function. As long as the client is registered and managed by the EMS server, it will belong to a profile group (perhaps even default). When you modify the profiles, the changes are pushed to the clients when the clients check in to the EMS. This is how EMS is designed to work. You don't have to touch all of the endpoints.
Opinions expressed are my own and may not represent the official opinion of my employer.