MDM Setup for Enterprise Mobile Apps

Imagine: a fleet of 500 iOS devices, each needing a corporate app with unique backend settings forced onto it. Without MDM, it's a nightmare—manually distributing profiles, asking employees not to delete the app, and supporting each update. MDM solves this: centralized configuration management, security policies, and app deployment. Configuring MDM for enterprise mobile apps is our specialization. We set up MDM for your fleet—from 100 to 10,000 devices—accounting for platforms and your corporate app. Proper MDM integration cuts IT support costs by up to 50% through automation and incident prevention. Average ROI is 6–12 months. Contact us for a project assessment—we’ll prepare an optimal solution.

How Apple MDM Manages Devices

Apple MDM is built on a push-pull protocol: the MDM server sends a push notification via APNs (MDM topic), the device "pulls" the command from the server, executes it, and sends the result. All commands and responses are XML plist over HTTPS (details in Apple MDM Protocol).

To make a device manageable, two modes are used:

• Supervised mode via Apple Configurator 2 or ABM (Apple Business Manager)—maximum control. Only supervised devices support blocking app removal, silent install without user consent, and Single App Mode.
• User Enrollment (iOS 13+)—the device belongs to the employee (BYOD), MDM manages only the Managed Apple ID zone. Apps can be forced installed into the managed space; personal data is inaccessible.

For a corporate app on a managed device, key MDM commands are:

Managed App Configuration—a mechanism to pass configuration to the app via MDM without hardcoding. The app reads the dictionary from UserDefaults with the .managed suffix:

let managedConfig = UserDefaults.standard.dictionary(forKey: "com.apple.configuration.managed") let backendURL = managedConfig?["BackendURL"] as? String let tenantID = managedConfig?["TenantID"] as? String 

The MDM server sends the AppConfiguration plist during install or via a separate InstallApplication command with ManifestURL. The employee cannot see or change these parameters.

How Android Enterprise Manages Devices

Android Enterprise is the counterpart to Apple MDM, with a more flexible deployment model.

• Fully Managed Device (COBO—Corporate Owned Business Only). The device is set up through a DPC (Device Policy Controller) during initial boot: QR scan or NFC bump. DevicePolicyManager gives full control: app installs, network policies, forced VPN, hardware button blocking.
• Work Profile (COPE/BYOD). A managed profile is created alongside the personal space. Corporate apps live in the Work Profile with a separate launcher and a briefcase icon. IT manages only the Work Profile; personal data is inaccessible.

Key class for Fully Managed is DevicePolicyManager:

val dpm = getSystemService(DEVICE_POLICY_SERVICE) as DevicePolicyManager val adminComponent = ComponentName(this, DeviceAdminReceiver::class.java) // Force install packages dpm.setAlwaysOnVpnPackage(adminComponent, VPN_PACKAGE, true, null) // Block uninstall dpm.setUninstallBlocked(adminComponent, TARGET_PACKAGE, true) // Managed Config for the app val bundle = Bundle().apply { putString("backend_url", "https://corp.example.com") putString("tenant_id", "CORP-001") } dpm.setApplicationRestrictions(adminComponent, TARGET_PACKAGE, bundle) 

How to Choose an MDM Server

For a homogenous Apple fleet—Jamf. For a Microsoft-oriented infrastructure—Intune. For mixed fleets with on-premise requirements—MobileIron/Ivanti or Workspace ONE. According to our data, Jamf Pro reduces policy deployment time by 60% compared to Intune for iOS, while Intune offers stronger Azure AD integration.

Integrating the App with MDM: What Developers Need to Do

MDM manages the device, but the app must "know" its managed status:

• Check Managed App Configuration on every launch and on UIApplicationWillEnterForeground.
• React to MDM Remote Wipe: clear Keychain, database, cache.
• Support openURL scheme for enrollment deeplink.
• If using an MAM SDK (Intune App SDK, Workspace ONE SDK)—integrate the SDK for policy enforcement at the app level, not just the device level.

What's Included in MDM Setup

• Audit of current device infrastructure and app requirements.
• Selection of MDM platform based on fleet composition and integrations.
• Enrollment setup (ABM, QR, Google Zero Touch).
• Creation of profiles and security policies (Passcode, VPN, Restrictions).
• Integration of Managed App Configuration with the corporate app.
• Testing on a pilot group (5–10 devices).
• Full rollout to all devices.
• Documentation and IT department training.
• Guarantee support for 30 days after implementation.

Setup Steps

1. Device inventory and enrollment strategy.
2. MDM platform selection.
3. Create profiles: Wi-Fi, VPN, Passcode, Restrictions.
4. Configure VPP (Volume Purchase Program) for iOS or Managed Google Play for Android.
5. Develop and test Managed App Configuration in the app.
6. Pilot deployment on a control group.
7. Fix errors and refine policies.
8. Roll out to the full fleet (phased or all at once).
9. Monitor compliance and update policies.

Timelines and Cost

Basic MDM setup for an existing device fleet—2–4 weeks. Full rollout with app integration, enrollment workflow, and IT staff training—6–10 weeks. The cost is determined individually after analysis. Request a consultation to get the optimal solution for your fleet. We guarantee quality MDM integration within the agreed timeframe.