My 2 cents:
cjoseph is right. You don't want to put devices into managed mode unless you've built up the desired configuration in the AMP.
Things to know for Aruba devices -
You can either do Global config (for all devices on the AMP), or group based config. The setting that determines this is found on AMP Setup -> General tab -> Device Configuration box -> "Use Global Aruba Configuration" -> yes/no (by default, the option is set to 'no')
Group based:
If you're doing group based Aruba config, then all configurations need to be done from Group -> select group -> Aruba Config tab. With overrides that can be created per device on the device's manage page. Each group will have it's own Aruba config tab.
Global:
If you're doing global Aruba config, then every profile used in your network should be added to the Device Setup -> Aruba Config tab. Then on the Group -> select group -> Aruba Config tab, you can select / deselect which profiles are used in that group. And then each device's manage page will still allow for overrides.
Creating Desired Config:
The quick way to build a desired configuration is to go to a controller's audit page, and choose to 'Import' - this will update the desired for the group or global based on what the device is currently running. You should at least see the Configuration of the device you imported from become 'Good'.
Best Practiced:
When you are not managing config, it's best to keep all devices in monitor only mode.
When rolling out config changes, test on a single device before rolling out to the masses.
You can also schedule a maintenance window from the device's manage page - this is a window where AMP will switch a device from monitor only mode to management mode, and then back to monitor only mode when the window closes.