Evaluate managed app integration by checking two directions at once: can your device management platform deliver policy into the protected app, and does the app stay protected when that platform is absent? Otukan does both. A protected work app reads settings delivered through the managed app configuration features of Android and iOS, while its integrity and runtime checks run whatever the device’s enrolment state. Your platform keeps configuration and distribution; Otukan keeps the app genuine and its data governed. Each platform is scoped on its own, and nothing about one is assumed for the other.
The full evaluation checklist is in the managed app integration solution guide.
Boundary
Three jobs meet on a managed phone. Mixing them up is the fastest way to end up with duplicate rules and gaps between them.
App protection
This job makes the app itself hard to change: modified code is detected, hooks and debuggers are reported, and sensitive data stays encrypted and short-lived, so a compromised operating system finds little to read. It travels with the app binary, so it works on any phone the app is installed on.
App management
This job decides how a work app is installed, configured and removed, and what data may pass between managed and unmanaged apps. It needs a management relationship with the device or the user, such as an Android work profile or a set of iOS managed apps.
Full device administration
This job governs the whole phone: passcode rules, encryption, OS updates, remote lock and wipe. It is right for company-owned fleets and usually wrong for personal phones.
| Job | Travels with | Typical owner | Otukan product |
|---|---|---|---|
| App protection | The app | App owner and security team | Otukan Application Security |
| App management | The managed relationship | Enterprise mobility team | Your platform, or Otukan MDM |
| Device administration | The device | IT operations | Your platform, or Otukan MDM |
Integration
Before any pilot, write down every dependency outside the app and name who owns it.
Policy source
Decide which settings come from device management and which are fixed at build time. Otukan reads the keys you agree, validates their format and applies a safe default when a key is missing or unexpected. That default matters most on unmanaged phones, where no policy arrives at all.
Tenant and distribution
Confirm which management tenant owns each app, and what happens when a subsidiary or partner runs its own. Protected builds go out through the channel you already use: a managed store, private distribution or Otukan MDM.
Signing and release
Protection fits your existing build and release pipeline. Your team signs the final build with its own keys, so managed distribution sees the same identity it always has.
Protection that does not depend on policy
Some rules must never be switched off from a console. Integrity checks, hooking and debugger detection, and root and jailbreak checks are part of the protected build, so a misconfigured policy or an unenrolled phone cannot remove them. Configuration tunes the response; it does not decide whether protection exists. Keep that line explicit in your ownership map.
Operations
Integration is proven in daily operation, not on the day of the first install.
Enrolment behaviour
Install the protected app on an enrolled device and on one that is not. Confirm that the managed device receives its configuration and that the unmanaged one falls back to safe defaults, with protection active on both.
Data separation
On Android, check that corporate data stays inside the work profile. On iOS, check that it moves only between managed apps. Otukan follows each platform’s boundary; the evidence for each is recorded separately.
Compromised but compliant
A phone can be enrolled, compliant and still rooted or jailbroken by a determined user. Run one managed test device in that state and confirm that the protected app restricts sensitive functions even though the management console reports it as healthy. Put the app’s signal beside the device’s compliance status so both teams see the same picture.
Offboarding
Unenrol a test device, retire another and hand a third to a new user. In each case, confirm that the protected app stops serving corporate data, clears what it holds and asks for a fresh sign-in. Record devices, OS versions, expected results and the reviewer.
Data rules inside the app are covered on work app data controls.