Otukan device management runs as a dedicated tenant for your institution, arranged along three choices you make: where it is hosted, who operates it, and who administers the fleet. You choose the hosting location for the service, its database, backups and logs. Otukan either operates the environment for you or supports your own team in operating it. Administration always stays with your people. Whatever the arrangement, the platform accounts and services the fleet depends on are listed with their owners, and backup, recovery and maintenance duties are written down before the first device enrols.
Supported models
Hosting, operation and administration are often bundled together in procurement documents. Otukan treats them as separate decisions, which gives institutions room to meet their own rules. What a public institution should specify for a managed fleet is covered on government mobile device management.
| Otukan-operated environment | Environment operated by your team | |
|---|---|---|
| Hosting location | Chosen by you | Chosen by you |
| Runs the servers | Otukan | Your operations team, with Otukan’s support |
| Applies product updates | Otukan, in announced maintenance | Your team, using Otukan’s release package and notes |
| Administers the fleet | Your administrators | Your administrators |
| Tenant | Dedicated to your institution | Dedicated to your institution |
| Best suited to | Institutions that want to focus on the fleet, not the servers | Institutions whose rules require their own staff to run infrastructure |
Both columns run the same product and the same management workflows. The difference lies in who carries each operating duty, and that is written into the service description. How data residency, supplier access and exit interact with these choices is covered on MDM data sovereignty.
Choosing between them
Three questions usually settle the choice. Does a rule require your own staff to run the servers? Does your operations team have the capacity to apply updates and test restores on schedule? And does your security team want infrastructure logs in its own systems? If the answers lean towards independence, the environment your team operates fits. If they lean towards focus on the fleet, the Otukan-operated environment fits better. Otukan talks the questions through with you before anything is signed.
Dependencies
No mobile management service stands alone. Otukan names every account and service your deployment relies on and records who owns each.
Platform accounts
- Apple devices. An Apple Business Manager or Apple School Manager account, the push certificate used for management, and the token linking the account to your tenant.
- Android devices. An Android Enterprise binding through a managed Google account or domain, and the zero-touch portal where devices are bought through participating resellers.
These belong to your organisation and stay in its name, whatever the hosting arrangement.
Services and network paths
Apple devices are reached through Apple’s push notification service, and Android Enterprise relies on Google services. Devices and the management service must be able to reach those destinations, so Otukan documents the network paths your firewall rules need. Where the arrangement uses them, Otukan also connects to your directory service for administrator and user identity and to your certificate authority for device certificates.
The dependency register lists each item with its owner, renewal date where one applies, and what stops working if it lapses. It is reviewed whenever an account owner leaves your organisation, because a credential tied to a departed person is a frequent way for a healthy fleet to lose contact with its devices.
Operations
A deployment is only as dependable as the duties behind it. Otukan assigns each one before rollout.
| Duty | What is agreed |
|---|---|
| Backup | What is backed up, how often, where copies are stored and for how long |
| Restore | Who can trigger a restore, the procedure, and a restore test on the pilot tenant |
| Updates | How product updates are released, announced and applied, and how they are rolled back |
| Monitoring | Who watches service health and platform credential expiry, and who is alerted |
| Incidents | How incidents are reported between the parties and who leads recovery |
On an Otukan-operated environment, maintenance is announced ahead of time and every change is recorded in the tenant’s change history. On an environment your team operates, Otukan supplies release packages, upgrade notes and the support route your operators use. In both cases, a restore test and an update run on the pilot tenant before the wider fleet depends on the service.
What runs inside the tenant is covered on mobile device management. Connections to your existing systems are covered with the rest of MDM deployment and integrations.