Mobile application management (MAM) controls and protects specific business apps and the data inside them, without taking charge of the whole device. An administrator sets policies for managed apps, such as where their data may be copied, whether an app PIN is required and what happens when the user leaves, while personal apps stay outside that control. MAM suits personal phones, contractors and mixed fleets. It is distinct from app protection, which hardens an app against attack, and from full device administration, which manages the phone itself. Android and iOS implement managed apps through different platform features.
Protection, management and administration
| App protection | App management (MAM) | Device administration (MDM) | |
|---|---|---|---|
| Question it answers | Is this app being attacked or altered? | What may users do with company data in this app? | Is the device configured the way the organisation requires? |
| Who sets it | App owner, in the release and backend policy | IT administrator | IT administrator |
| Typical controls | Obfuscation, integrity checks, runtime detection | Copy and share limits, app PIN, selective wipe | Enrolment, passcode rules, kiosk mode, update policy, full wipe |
| Where it applies | Every installation | Managed apps for signed-in work users | Enrolled devices |
The three are complementary. Management policy trusts the app to enforce it, so it depends on the app being genuine. Device administration reaches further but needs the owner’s consent to manage the phone.
What MAM depends on
- App-side support. The app must understand the policy, through a management provider’s library, platform managed configuration or a wrapped build.
- Platform features. On Android, managed configurations and the work profile under Android Enterprise separate work apps from personal ones. On iOS, apps installed as managed receive managed app configuration and managed open-in rules, and User Enrollment keeps personal data separate on personally owned devices.
- Identity tenant. Policy usually attaches to the user’s work account, so the identity provider and the management service must agree on who is managed.
- Distribution. Managed apps reach users through managed Google Play on Android and through App Store assignment or private distribution on iOS.
- Policy ownership. Each setting needs one owner, or the app, the management service and the device policy will contradict one another.
Operating MAM
Test the whole lifecycle on real devices, managed and unmanaged:
- First launch. Signing in with a work account applies policy before any company data appears.
- Data separation. Copying text, sharing a file, saving to personal storage, screenshots and backups each behave as the policy says.
- Policy change. An updated rule reaches devices and takes effect without a reinstall.
- Offboarding. A selective wipe removes company files, caches, tokens and keys, leaves personal data alone, and your backend refuses the old session.
How Otukan fits
Otukan Application Security hardens the app itself and sends runtime signals to your backend whether the phone is managed or not, so an enrolled but compromised device stays visible. Otukan MDM handles enrolment, policy and app distribution for company devices on Android and iOS, and removes managed apps and their data when a device is retired. The two work separately or together, and Otukan maps with you which rule belongs where.
The integration is covered on managed app integration. For the device side, see what is mobile device management and mobile device management. More plain definitions are in the mobile security glossary.