Otukan delivers business apps to managed devices, keeps them at the version you choose and removes them cleanly when they are no longer needed. On Android, apps come from managed Google Play, including private apps visible only to your organisation. On iPhone and iPad, apps come from the App Store through Apple Business Manager, as custom apps or as your own in-house builds where you are eligible to distribute them. Every app can carry a managed configuration. The scope is app delivery and control; protecting an app’s code at runtime belongs to app shielding.
Distribution modes
Each platform offers its own channels for business apps, and Otukan works through them directly rather than around them.
| App type | Android (Android Enterprise) | iOS and iPadOS |
|---|---|---|
| Public store apps | Approved in managed Google Play | App Store apps with licences from Apps and Books in Apple Business Manager |
| Private business apps | Private apps in managed Google Play, visible only to your organisation | Custom apps assigned through Apple Business Manager |
| In-house builds | Delivered to managed devices as private apps | In-house apps, for organisations eligible for that route |
| Web shortcuts | Web apps added to the managed catalogue | Web clips pushed to the device |
The rows are not equivalent across columns. Apple ties store apps to licences that you purchase and assign; Android lets you approve apps for your organisation and choose who receives them. Otukan handles each channel on its own terms.
Install rules
For each group, an app is required or available, and apps can be blocked where the platform and enrolment mode allow it. Required apps install without a prompt on supervised Apple devices, on fully managed or dedicated Android devices and inside an Android work profile, where they never touch the personal side. On Apple devices that are not supervised, including User Enrollment, the user approves each managed install. Available apps appear in the managed catalogue for users to install when they need them.
Managed configuration
Many business apps accept settings from the management service, such as a server address, a tenant name or a feature switch. Otukan sends those settings per group, so an app opens ready to work and users never type configuration by hand. When a setting changes, such as a new server address after a migration, Otukan updates it for the whole group at once instead of asking each user to reconfigure the app. Which settings an app accepts is decided by its developer. On Android, the app publishes its configuration keys through managed Google Play; on Apple devices, they come from the developer’s documentation. Otukan confirms the keys for each app before you rely on them.
Lifecycle
Installing an app is the start of its management, not the end. Otukan runs each app from assignment to removal.
- Assignment. The app is linked to the groups that need it, with an owner who approves changes.
- Version rollout. A new version reaches a pilot group first. Once it works on the devices there, it widens one group at a time.
- Update behaviour. Otukan sets how each app updates within the options each platform provides, so a line-of-business app does not update in the middle of a shift.
- Version reporting. The installed version of every managed app is shown per device, so stragglers are easy to find.
- Removal. When an app is withdrawn, it is uninstalled from the devices in scope together with its work data.
Offboarding follows the same rule. When a device leaves management, its managed apps and their data go with it. On a personal device, only the work side is removed: the user’s own apps and photos stay exactly where they were. On Apple devices, store licences return to your pool for the next device.
Boundary with app shielding
Device management and app shielding answer different questions, and Otukan offers both.
| Device management | App shielding | |
|---|---|---|
| Question it answers | Which apps are on which devices, at which version and with which settings | Can this app’s code and data be trusted while it runs |
| Where it works | Through the platform’s management framework | Inside the app itself |
| What it controls | Installation, updates, configuration, sharing between managed and personal apps | Tampering, hooking, debugging and repackaging of the app |
| Devices it reaches | Enrolled devices only | Any device the app runs on, managed or not |
A banking or field app installed on a managed device still benefits from shielding, because management policy does not see inside a running process. Otukan’s application security product protects the app itself. For that side, see mobile app shielding.
App delivery to shared and single-purpose devices is covered on Android kiosk management. The parent overview is mobile device management.