What is mobile application management?
Mobile application management (MAM) applies security policy to individual business apps, such as email, chat and file-sharing apps, rather than to the whole phone or tablet. It controls what can happen to company data inside those apps: who can open them, where the data can be copied or saved, and how it is removed. MAM works on devices that are also enrolled in mobile device management (MDM) and on personal devices that are not enrolled at all, which makes it the usual answer for bring your own device (BYOD) users who will not hand control of their phone to the company.
How MAM works
A MAM policy, called an app protection policy in Microsoft Intune, is tied to the user's work account and enforced by apps that support it. An app gains that support by building in the management vendor's software development kit or, for some in-house apps, by being wrapped with a management layer. When the user signs in to a supported app with a work account, the app fetches the policy and enforces it inside itself. Personal accounts in the same app, such as a private mailbox added to the same email client, are left alone.
Typical policy settings include:
- a PIN or biometric to open the app, separate from the device passcode
- copy, paste and Save As allowed only into other managed apps
- attachments opened only in approved apps, and backups to personal cloud storage blocked
- encryption of the app's stored data
- minimum app and OS versions, and refusal to run on jailbroken or rooted devices
- a wipe of the app's company data if the user has not checked in for a set number of days
Example: auditors on their own phones
A firm brings in 60 auditors for a three-month engagement. They need company email and the document library on their own iPhones and Android phones, and none of them will enroll in MDM. IT publishes an app protection policy for the email, chat and file apps, plus a conditional access rule that admits only those protected apps to the mail service. An auditor who tries to add the account to the phone's built-in mail app is refused. One who copies a client spreadsheet out of the file app can paste it into the managed email app but not into a personal messaging app. When the engagement ends, IT disables the accounts and sends a selective wipe that deletes the company data inside the managed apps and leaves the auditors' photos, messages and personal apps alone.
MAM vs. MDM and containerization
| MDM | MAM | |
|---|---|---|
| Manages | The whole device: settings, passcode, every app | Specific work apps and their data |
| Enrollment | Required | Not required |
| Wipe | Full or selective | App data only |
| Best fit | Corporate-owned devices | BYOD and contractors |
Containerization, such as an Android work profile, separates work and personal data at the operating system level and normally involves some form of enrollment. MAM draws the boundary around each app instead. Many organizations combine them: full MDM on corporate devices, MAM on personal ones, and app protection policies on both, because the policies also stop data moving from a managed app to an unmanaged one on a corporate phone.
MAM has limits. It protects only apps that support it, it cannot touch the device's other apps or settings, and because the device itself is unmanaged, malware elsewhere on the phone remains a risk that jailbreak and root checks only partly cover.
Mobile application management on the CompTIA Security+ exam
Mobile application management is taught with mobile device management among the mitigating controls in SY0-801 objective 4.1, and MAM is not on the exam's acronym list. Read the ownership clue first. Employees use personal phones and refuse to enroll, protect company data without controlling the device or stop users pasting work data into personal apps points to MAM and app protection policies, while company-issued tablets points to full MDM. Distractors include a full remote wipe, which needs enrollment and would erase personal data; geofencing, which changes policy by location; and device encryption, which protects data at rest but does not control where users move it.