Managing applications across multiple management domains
Techniques to manage applications, such as mobile apps, across multiple management domains are disclosed. In various embodiments, a set of one or more application management policies to be enforced with respect to a mobile device is received from a management entity to which a scope of authority to manage applications with respect to the mobile device has been delegated. A management agent on the mobile device is used to enforce the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity.
1. A method of managing applications, comprising:
receiving, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforcing, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein enforcing the one or more application management policies at least includes:
receiving an indication to install an application, wherein the application is already installed on the mobile device and subject to the scope of authority delegated to the management entity;
determining whether the application can be shared between the management entity and a second management entity;
in response to determining that the application can be shared between the management entity and the second management entity, configuring the application to be a mutually compatible version of the application that can be shared between the management entity and the second management entity; and
in response to determining that the application cannot be shared between the management entity and the second management entity, installing a second version of the application to be used by the second management entity.
2. The method of claim 1 , wherein enforcing the one or more application management policies at least includes backing up data associated with the application that is already present on the mobile device.
3. The method of claim 1 , wherein enforcing the one or more application management policies further includes:
determining whether more than one instance of the application is allowed to be installed on the mobile device; and
providing a notification that more than one instance of the application is not allowed.
4. The method of claim 1 , further comprising receiving a definition of the management entity and the scope of authority.
5. The method of claim 1 , wherein the management entity comprises a first management entity included in a plurality of management entities to which respective scopes of authority have been delegated with respect to the mobile device.
6. The method of claim 5 , wherein enforcing the one or more application management policies further comprises resolving a conflict between a first application management requirement of the first management entity and a second application management requirement of the second management entity included in the plurality of management entities.
7. The method of claim 1 , wherein the scope of authority includes an authority to install the application on the mobile device.
8. The method of claim 1 , wherein the second management entity comprises an owner or other personal user of the device.
9. The method of claim 1 , wherein configuring the application to be shared by the management entity and a second entity comprises configuring the instance of the application is configured to store application data associated with the management entity separately from application data associated with the second management entity.
10. The method of claim 1 , wherein the scope of authority includes an authority to remove the application from the mobile device; and further comprising receiving from the management entity an indication to remove the application; determining that the application remains in use by the second management entity; and removing or otherwise securing application data associated with the management entity without removing the application, based at least in part on the determination that the application remains in use by the second management entity.
11. A system, comprising:
a communication interface; and
a processor coupled to the communication interface and configured to:
receive, via the communication interface, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforce, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein to enforce the one or more application management policies, the processor is further configured to:
receive an indication to install an application, wherein the application is already installed on the mobile device and subject to the scope of authority delegated to the management entity;
determine whether the application can be shared between the management entity and a second management entity;
in response to determining that the application can be shared between the management entity and the second management entity, configure the application to be a mutually compatible version of the application that can be shared between the management entity and the second management entity; and
in response to determining that the application cannot be shared between the management entity and the second management entity, install a second version of the application to be used by the second management entity.
12. The system of claim 11 , wherein to enforce the one or more application management policies, the processor is further configured to back up data associated with the application that is already present on the mobile device.
13. The system of claim 11 , wherein to enforce the one or more application management policies, the processor is further configured to:
determine whether more than one instance of the application is allowed to be installed on the mobile device; and
provide a notification that more than one instance of the application is not allowed.
14. The system of claim 11 , wherein the processor is further configured to receive a definition of the management entity and the scope of authority.
15. The system of claim 11 , wherein the management entity comprises a first management entity included in a plurality of management entities to which respective scopes of authority have been delegated with respect to the mobile device.
16. A computer program product to manage applications, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, from a management entity to which a scope of authority to manage applications with respect to a mobile device has been delegated, a set of one or more application management policies to be enforced with respect to the mobile device within the scope of authority delegated to the management entity; and
enforcing, by a management agent on the mobile device, the one or more application management policies with respect to applications and application data that are within the scope of authority delegated to the management entity, wherein enforcing the one or more application management policies at least includes:
receiving an indication to install an application, wherein the application is already installed on the mobile device and subject to the scope of authority delegated to the management entity;
determining whether the application can be shared between the management entity and a second management entity;
in response to determining that the application can be shared between the management entity and the second management entity, configuring the application to be a mutually compatible version of the application that can be shared between the management entity and the second management entity; and
in response to determining that the event the application cannot be shared between the management entity and the second management entity, installing a second version of the application to be used by the second management entity.