MobileIron integration for mobile app management

Integrating MobileIron for Mobile App Management

MobileIron—EMM platform, part of Ivanti since 2020 as Ivanti Mobile@Work and Ivanti Neurons for MDM. Found in enterprises with long MDM history: banks, government, retail. If customer already uses MobileIron/Ivanti—app integration built on MobileIron AppConnect SDK or standard Managed App Configuration protocol Apple/Android Enterprise.

Two Integration Paths: AppConnect SDK vs Managed Config

Path 1: MobileIron AppConnect SDK. Proprietary SDK creating isolated container around app. App data encrypted by independent key managed by MobileIron server. Container opens only with active MobileIron registration.

Path 2: Managed App Configuration (Apple) / Android Managed Configurations. Standard mechanism without proprietary SDK. MobileIron as MDM server supports both protocols. App doesn't depend on EMM vendor—works with Intune, Workspace ONE, MobileIron.

For new projects prefer Managed App Configuration—less vendor lock-in. AppConnect SDK justified if need specific functions: AppConnect Tunnel (per-app VPN), AppConnect Keychain encryption, or already on MobileIron with no migration planned.

AppConnect SDK: iOS Integration

Adding via CocoaPods:

pod 'AppConnectLib'

Initialization:

import AppConnectLib

@UIApplicationMain
class AppDelegate: UIResponder, UIApplicationDelegate, ACManagerDelegate {

    func application(_ app: UIApplication, didFinishLaunchingWithOptions options: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
        ACManager.shared().delegate = self
        ACManager.shared().startUp(with: self.window)
        return true
    }

    // Get config from MobileIron server
    func appConnectConfigReceived(_ config: [AnyHashable: Any]?) {
        guard let config = config else { return }
        let serverURL = config["server_url"] as? String
        let orgID = config["org_id"] as? String
        AppSettings.shared.configure(serverURL: serverURL, orgID: orgID)
    }

    // DLP policy changed
    func appConnectPolicyReceived(_ policy: [AnyHashable: Any]?) {
        let copyPasteAllowed = policy?["copy_paste_out"] as? Bool ?? false
        DLPEnforcer.shared.setCopyPasteEnabled(copyPasteAllowed)
    }
}

AppConnect Keychain: Isolated Secret Storage

AppConnect provides own Keychain encrypted by container key. If MDM registration revoked—keys inaccessible without reauth.

// Save via AppConnect Keychain
let acKeychain = ACKeychain()
acKeychain.setData(tokenData, forKey: "auth_token", inGroup: "corporate")

// Read
let tokenData = acKeychain.data(forKey: "auth_token", inGroup: "corporate")

Difference from standard iOS Keychain: on remote wipe via MobileIron, AppConnect Keychain clears independently. User's personal keys untouched.

Android: MobileIron Android AppConnect

On Android AppConnect works similarly, implemented via AppConnect wrapper around Application:

class MyApplication : AppConnectApplication() {
    override fun onCreate() {
        super.onCreate()
        // AppConnect intercepts ContentProvider, ClipboardManager, FileProvider
    }
}

Important: AppConnectApplication requires all Activity inherit from AppConnectActivity. Serious limitation for legacy apps on Fragment + ViewPager architecture. Partial workaround—AppConnectFragmentActivity as intermediate base class.

Ivanti Neurons for MDM: Modern API

After rebranding to Ivanti, new cloud-native MDM with REST API: GET /api/v1/devices, POST /api/v1/policies, DELETE /api/v1/apps/{appId}. Allows automating app management from CI/CD without UI console.

Example: auto-push new IPA on release via GitHub Actions:

# Ivanti Neurons REST API
curl -X POST "https://tenant.mobileiron.com/api/v1/apps" \
  -H "Authorization: Bearer $IVANTI_TOKEN" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@build/app.ipa" \
  -F "metadata={\"bundleId\":\"com.company.app\",\"appStoreId\":\"enterprise\"}"

Common Integration Issues

AppConnect not initializing on first launch. Reason: MobileIron Go (client app) not installed or not logged in. AppConnect SDK requires MobileIron Go as "container guardian". In production enrollment workflow—MobileIron Go installed first via MDM.

Config not arriving after policy change on server. AppConnect polling interval default—15 minutes. For force-sync: ACManager.shared().checkIn(). In production add checkin on every applicationWillEnterForeground.

Implementation Stages

Analyze MobileIron/Ivanti infrastructure → choose AppConnect SDK or Managed App Configuration → integrate SDK → implement config/policy callbacks → AppConnect Keychain → test enrollment and wipe → deploy via MobileIron App Catalog.

Timeline: Managed App Configuration (no SDK)—2–3 weeks. Full AppConnect SDK integration—4–7 weeks. Cost is calculated individually.