Managing applications across multiple management domains
Techniques to manage applications, such as mobile apps, across multiple management domains are disclosed. In various embodiments, a set of one or more application management policies to be enforced with respect to a mobile device is received from a management entity to which a scope of authority to manage applications with respect to the mobile device has been delegated. A management agent on the mobile device is used to enforce the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity.
1. A method of managing applications, comprising:
receiving, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforcing, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein enforcing the one or more application management policies at least includes:
receiving an indication to install an application;
detecting that an instance of the application is already present on the mobile device;
in the event the instance of the application cannot be shared with the management entity, installing a separate instance of the application for use by the management entity; and
in the event the instance of the application can be shared with the management entity, configuring the application to be shared by the management entity and a second management entity; and
providing via a display device of the mobile device a display of applications installed on the mobile device, in which each application is represented by a corresponding application icon, the respective application icons of at least a subset of the applications including for each a graphic or other visual indication of one or more management domains to which authority to manage that application has been delegated.
2. The method of claim 1 , further comprising receiving a definition of the management entity and the scope of authority.
3. The method of claim 1 , wherein the management entity comprises a first management entity included in a plurality of management entities to which respective scopes of authority have been delegated with respect to the mobile device.
4. The method of claim 3 , wherein enforcing the one or more application management policies further comprises resolving a conflict between a first application management requirement of the first management entity and a second application management requirement of the second management entity included in the plurality of management entities.
5. The method of claim 1 , wherein the scope of authority includes an authority to install the application on the mobile device.
6. The method of claim 1 , wherein the second management entity comprises an owner or other personal user of the device.
7. The method of claim 1 , wherein configuring the application to be shared by the management entity and a second entity comprises configuring the application to store application data associated with the management entity separately from application data associated with the second management entity.
8. The method of claim 1 , wherein the scope of authority includes an authority to remove the application from the mobile device; and further comprising receiving from the management entity an indication to remove the application; determining that the application remains in use by the second management entity; and removing or otherwise securing application data associated with the management entity without removing the application, based at least in part on the determination that the application remains in use by the second management entity.
9. A system, comprising:
a communication interface; and
a processor coupled to the communication interface and configured to:
receive, via the communication interface, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforce, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein to enforce the one or more application management policies, the processor is further configured to:
receive an indication to install an application;
detect that an instance of the application is already present on the mobile device;
in the event the instance of the application cannot be shared with the management entity, install a separate instance of the application for use by the management entity; and
in the event the instance of the application can be shared with the management entity, configure the application to be shared by the management entity and a second management entity; and
provide via a display device of the mobile device a display of applications installed on the mobile device, in which each application is represented by a corresponding application icon, the respective application icons of at least a subset of the applications including for each a graphic or other visual indication of one or more management domains to which authority to manage that application has been delegated.
10. The system of claim 9 , wherein the processor is further configured to receive a definition of the management entity and the scope of authority.
11. The system of claim 9 , wherein the management entity comprises a first management entity included in a plurality of management entities to which respective scopes of authority have been delegated with respect to the mobile device.
12. The system of claim 11 , wherein the processor is further configured to resolve a conflict between a first application management requirement of the first management entity and a second application management requirement of the second management entity included in the plurality of management entities.
13. The system of claim 9 , wherein the scope of authority includes an authority to install the application on the mobile device.
14. The system of claim 9 , wherein the second management entity comprises an owner or other personal user of the device.
15. The system of claim 9 , wherein configuring the application to be shared by the management entity and a second management entity comprises configuring the application to store application data associated with the management entity separately from application data associated with the second management entity.
16. A computer program product to manage applications, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforcing, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein enforcing the one or more application management policies at least includes:
receiving an indication to install an application;
detecting that an instance of the application is already present on the mobile device;
in the event the instance of the application cannot be shared with the management entity, installing a separate instance of the application for use by the management entity; and
in the event the instance of the application can be shared with the management entity, configuring the application to be shared by the management entity and a second management entity; and
providing via a display device of the mobile device a display of applications installed on the mobile device, in which each application is represented by a corresponding application icon, the respective application icons of at least a subset of the applications including for each a graphic or other visual indication of one or more management domains to which authority to manage that application has been delegated.