Administrators apply policy in Otukan by assigning versioned settings to device groups, and they verify it through status that each device reports back. Android policies use Android Enterprise settings; Apple policies use configuration profiles. Each policy is limited to what the device’s platform, management mode and OS version allow, and anything a target device cannot apply is marked rather than silently ignored. Every change is reviewed, piloted and rolled out in stages, with one-step rollback. Policy covers settings on the device; which apps are installed is handled by app management.
Policy scope
Android and Apple devices expose different settings, and each management mode changes what an administrator may enforce. Otukan builds every policy per platform.
| Policy area | Android (Android Enterprise) | iOS and iPadOS (configuration profiles) |
|---|---|---|
| Passcode | Device passcode rules, plus a separate work challenge in a work profile | Passcode rules for the device; under User Enrollment, a limited passcode requirement |
| Restrictions | Camera, screen capture, USB file transfer, factory reset, unknown sources, debugging | Camera, screen capture, sharing, account changes; many restrictions need a supervised device |
| Network | Wi-Fi, always-on VPN, proxy settings | Wi-Fi, VPN, per-app VPN where configured |
| Certificates | Certificates for Wi-Fi, VPN and app authentication | Certificates delivered in the profile |
| OS updates | Update scheduling and deferral on corporate-owned devices | Update deferral and enforcement on supervised devices |
The rows describe policy areas, not equivalent settings. A camera restriction is one switch on each platform, but a personally owned Android device with a work profile keeps its own camera for personal apps, and a User Enrollment device accepts only a limited set of Apple restrictions. Otukan shows which settings apply in each mode before you publish.
Settings a device cannot apply
A setting that a device ignores is worse than no setting, because it looks like protection. Otukan checks every setting against the platform, mode and OS version of the devices it targets. Unsupported settings are marked, and devices that fail to apply a setting are listed with the reason.
Assignment
Policies reach devices through groups. A group can follow ownership, department, site, device model or any mix, and a device can sit in several groups at once.
Precedence and conflicts
When two groups set the same setting to different values, the result must be predictable. You set a precedence order for groups, and Otukan uses it to work out one effective policy per device. Before a change is published, Otukan compares it with every other policy that reaches the same devices and shows any conflict to the author.
The effective policy view answers the question every help desk asks: why does this device behave like this? It lists each setting in force on a device and the group it came from, so the fix goes to the right policy the first time.
Group design
Otukan keeps group design simple on purpose. A small set of baseline policies per platform and ownership mode, with narrow exceptions layered on top, is easier to review than many overlapping policies. Otukan helps you draw that structure during the pilot.
Operations
A single policy change can reach every device in several groups at once, so Otukan treats each change as a controlled release.
- Versioning. Every edit creates a new policy version with its author and a short reason.
- Review. A second administrator can be required to approve a version before it leaves draft.
- Pilot. The version reaches a pilot group first, including each device model and OS version in the fleet.
- Staged rollout. Further groups receive the version in turn.
- Status evidence. Each device reports applied, pending or failed, with a reason for failures.
- Rollback. If a version causes trouble, the previous version is restored in one step and the rollback is recorded.
Devices keep reporting after rollout. At each check-in, Otukan compares what a device has applied with its assigned policy, reapplies enforced settings and flags drift, so the fleet stays where you put it.
Policy starts working once a device is enrolled into the right group. Enrolment paths and group assignment are covered on MDM device enrollment. The parent overview is mobile device management.