Mobile Application Management in London
Mobile Application Management (MAM) is a Microsoft Intune capability that protects company data inside approved mobile apps such as Outlook, Teams, OneDrive and SharePoint, without taking control of the personal device it runs on. It is how London businesses keep work data secure on staff phones while personal photos, messages and apps stay completely private.
Overview
What is mobile application management?
Mobile application management protects company data at the app level rather than the device level. When a member of staff signs into Outlook, Teams, OneDrive or SharePoint on their phone, the app applies a set of protection rules to work data only. Everything else on the phone is left untouched.
That distinction matters more than it sounds. Traditional device management asks employees to hand over control of a personal phone, which is an awkward conversation and one of the most common reasons mobile security projects stall halfway. MAM removes the objection entirely, because there is nothing personal to hand over.
Copy and paste restrictions between managed and unmanaged apps
Saving work files to approved cloud storage only, meaning OneDrive for Business and SharePoint
Screen capture protection on iOS and Android
Encryption of company data at rest, kept separate from personal content
Selective wipe of company data without touching anything personal
MAM vs MDM: what is the difference?
The difference between MDM and MAM is scope. Mobile device management (MDM) enrols and manages the whole device, including its settings, its operating system and often its apps. Mobile application management (MAM) manages only the approved apps and the company data inside them, and leaves the rest of the device alone.
What is managed
MDM manages the entire device. MAM manages approved apps and company data only.
Best suited to
MDM suits company-owned laptops, phones and tablets. MAM suits personal phones and BYOD.
What a wipe removes
An MDM wipe can reset a whole device. A MAM selective wipe removes company data only.
Employee privacy
MDM gives visibility of the device. MAM gives no visibility of personal content whatsoever.
Rollout effort
MDM requires full device enrolment. MAM is a one-time app sign-in taking a couple of minutes.
Why does mobile application management matter to your business?
Mobile is usually the least protected route into company data. Staff read email, approve invoices and share files from phones that sit well outside the corporate network, and if that data is not controlled at the app level it can be copied, forwarded or backed up somewhere nobody has visibility of.
Prevents data leakage
Stops company files being saved to personal cloud storage, AirDrop or unmanaged apps.
Encrypts work data
Company data inside managed apps is encrypted at rest and held separately from personal content.
Removes work data only
If a device is lost or an employee leaves, only company data goes.
Supports compliance
Mobile controls align with Cyber Essentials, ISO 27001 and most cyber insurance requirements.
How staff access company apps on a managed device
On a managed device, staff must use an approved managed application to sign into Microsoft 365 on a phone or tablet. If someone tries to sign in with an unsupported app, access is blocked. There are three steps, and after the first time the whole thing is invisible.
Why the control matters
Without this control, company email and files could be reached through apps with no data protection policy at all. Note that this targets iOS and Android only. Laptops, desktops and browser sign-ins are unaffected.
How it works
Sign in on mobile
The user opens Outlook, Teams, OneDrive or SharePoint on iOS or Android.
The app is checked
We confirm it is an approved managed app that supports our protection rules.
Access is granted
The user works as normal and company data is protected automatically in the background.
What changes inside managed apps
Six things behave differently inside a managed app. Outside managed apps, nothing changes at all. WhatsApp, Safari, the camera roll and personal email carry on exactly as before.
Copy and paste
Copying from a managed app can only be pasted into another managed app. Pasting in from personal apps is still allowed.
Save As
Saving work files to personal locations is blocked. Saving to OneDrive for Business or SharePoint is permitted.
Open In and Share
Work files can only be opened in other managed apps. Sharing into personal apps such as WhatsApp is blocked.
Screen capture
Screenshots and screen recording of company data are blocked on iOS and Android.
Cloud backup
Company data is excluded from iCloud and Google backups, so it cannot be restored onto a personal device.
Printing and AI tools
Printing is allowed. AI writing tools and Genmoji on iOS are disabled inside managed apps to prevent data exposure.
Privacy
What your IT provider can and cannot see on your phone
With mobile application management, your IT provider can see device and compliance information but never personal content. This is far and away the most common question staff ask during a rollout, and answering it plainly at the start is what makes adoption smooth rather than a fortnight of helpdesk tickets.
What we can see
The device model and operating system version
Which managed apps are installed and their version
Whether the device meets compliance rules
Sign-in events to company apps and services
When a managed app was last used
What we cannot see
Personal photos, videos or files
Personal email, messages or call history
Which personal apps you have installed
Browsing history outside managed apps
Your device location
When and how company data is removed
Company data can be removed from a device without touching anything personal. This is called a selective wipe and it only ever affects content inside managed apps. Six situations trigger it. In every one of these cases, only company data is removed. Personal photos, contacts and apps are not affected.
Too many failed PIN attempts
After ten incorrect attempts, app data is wiped to protect against guessing.
Device offline for 30 days
If the device cannot reach the service for 30 days, company data is removed as a safety net.
Device reported lost or stolen
On request, we can wipe company data from a single device immediately.
A user leaves the company
Company data is removed as part of the standard leavers process.
Device fails security checks
Jailbroken, rooted or non-compliant devices are blocked and wiped of company data.
A mobile threat is detected
If a high-risk threat is found, access is blocked until the device is cleaned up.
Mobile application management services for London businesses
We deliver mobile device management in London as a live service rather than a one-off project. Devices have to stay compliant for staff to keep reaching company data, so the policies are configured, monitored, enforced and tuned on an ongoing basis.
Configure
We maintain the protection rules in line with Microsoft and industry guidance.
Monitor
We monitor enrolment, compliance and security signals across your whole mobile estate.
Respond
Non-compliant devices are blocked from company data and the user is guided through remediation.
Improve
We tune the policies as Microsoft releases new controls and as your business changes.
One-time setup
Enrol each approved app the first time you open it.
What staff need to do on their own device
The first time a user opens an approved app after deployment, they are prompted to enrol that app into the protection policy. It is a one-time setup taking a couple of minutes, and there are three settings sitting behind it.
Set a six-digit app PIN
Required on every approved app. Simple PINs such as 111111 are blocked, and Face ID or Touch ID can be used once configured. After ten incorrect attempts, app data is wiped.
Re-authenticate after 12 hours offline
If the device has not checked in for 12 hours, the user signs in again before reaching work content. After 30 days offline, company data is removed.
Keep the device and apps up to date
Older versions of iOS and Android receive warnings and are eventually blocked.
None of this is unfamiliar territory for most people. It is the same thinking we set out in our IT security guidelines for employees, applied to the device that tends to get overlooked.
How we deploy mobile application management with you
Rollout is phased and built to cause as little disruption as possible, because a mobile policy that irritates people is a mobile policy that gets worked around.
Before rollout
Staff should update their phones to the latest operating system, update their Microsoft apps from the App Store or Play Store, and set aside a few minutes to complete the prompts. Our team supports the pilot and the full rollout, with a quick-resolution path for anything that looks wrong.
Rollout phases
Communication
A short guidance document goes out to your team to set expectations before anything changes.
Pilot group
Policies are applied to a small pilot group to validate the experience before going wider.
Full deployment
Policies extend to all users, who sign in to managed apps and complete the one-time setup.
Steady state
We monitor compliance, handle exceptions and adjust policies as your business changes.
Frequently asked questions
What is mobile application management (MAM)?
Mobile application management is a Microsoft Intune capability that protects company data inside approved mobile apps, such as Outlook, Teams, OneDrive and SharePoint, without managing the device itself. Protection rules apply to work data only, so personal photos, messages and apps stay entirely private.
What is the difference between MDM and MAM?
MDM manages the whole device, including its settings and operating system, and suits company-owned hardware. MAM manages only approved apps and the company data inside them, and suits personal phones. Most businesses run both: MDM on company devices, MAM on staff-owned ones.
Can my employer see my personal phone?
No. Under mobile application management, your employer and IT provider can see the device model, operating system version, which managed apps are installed and whether the device meets compliance rules. They cannot see personal photos, messages, call history, personal apps, browsing history outside managed apps, or your location.
Will my personal photos be deleted if my company wipes my phone?
No. A MAM wipe is selective and only removes company data held inside managed apps. Personal photos, contacts, messages and apps are untouched, which is the main practical difference between MAM and a full device wipe under MDM.
Do I need mobile device management for Cyber Essentials?
Cyber Essentials scope includes any device that connects to organisational data or services, so staff phones used for company email fall in scope. You need appropriate controls on those devices, and app-level management is the usual way to achieve it without enrolling personal hardware.
Does mobile application management work on both iPhone and Android?
Yes. Protection policies apply to approved Microsoft 365 apps on both iOS and Android. Laptops, desktops and browser sign-ins are not affected by mobile app protection policies.
How long does setting up MAM take for staff?
A couple of minutes per person. The first time someone opens an approved app after deployment, they set a six-digit app PIN and confirm enrolment. After that it runs in the background, with re-authentication prompted only after 12 hours offline.
Totality Services is a London based managed service provider working with over 150 organisations across the capital and beyond. We are ISO 27001 and ISO 9001 certified, a Microsoft Partner, a Cyber Essentials certification body and a Crown Commercial Service supplier on the G-Cloud framework. Mobile sits alongside our wider IT security London work and our managed IT services London offering, and is included as standard for clients on our IT support London plans.
Cyber Essentials scope covers any device that connects to organisational data, which means staff phones count whether they are company-owned or not. Closing the mobile gap is one of the best cybersecurity practices a growing business can adopt, and it is considerably cheaper than the alternative. If you are reviewing your security and compliance service more broadly, mobile is usually the quickest win on the list.
Get your mobile estate reviewed
If you are not sure what company data currently sits on staff phones, that is the honest starting point for most businesses we speak to, and it is exactly what a review is for. We will come back with a clear picture rather than a sales pitch.
Step 01
Devices
We look at which devices currently reach your Microsoft 365 tenant.
Step 02
Protection
We check what protection is applied today and where the gaps are.
Step 03
Plan
We set out what closing those gaps would involve.