What Is Mobile Application Management (MAM)?

Mobile application management (MAM) is the control of work apps and the data inside them, without managing the whole device. IT sets rules for specific apps, such as a PIN to open them, a block on copying data out of them, and the ability to wipe only the company data from them.

That makes MAM the tool for personal phones and tablets that staff use for work. The employee keeps their photos, messages and apps. You protect the email, files and business apps that matter. This guide explains how mobile app management works, what a MAM policy contains, how MAM differs from MDM, and when a small business needs it.

How mobile application management works

MAM works at the level of the app and the signed in user, not the device. A work account signs in to a managed app, and the MAM service applies the policies assigned to that user and app.

• Policy enforcement. The app checks the policy when it opens and again while it runs. Typical rules cover a PIN or biometric check, which apps can receive company data, and whether data can be saved to personal storage.
• App integration. Apps take policy either through a vendor SDK built into the app or through a wrapping tool that adds the same hooks to an existing app. An app without either cannot be managed.
• Work and personal context. Policies apply only when the app is used with the work account. Microsoft's documentation describes this for Intune: a document opened from a work mailbox is protected, while the same app used with a personal account is left alone.
• Selective wipe. IT can remove company data from a managed app and leave the app and the personal data on the phone. The app checks for the wipe request when it opens and at set intervals while it runs.

MAM can run with or without device enrollment. Without enrollment, you cannot push apps, certificates, Wi-Fi or VPN settings to the phone. The employee installs apps from the store.

What a MAM policy controls

A MAM policy, also called an app protection policy, is a set of rules attached to a managed app. The names differ between vendors. The settings fall into three groups.

Microsoft groups these into three levels in its data protection framework: a basic level with PIN, encryption and selective wipe, an enhanced level that adds leak prevention and minimum OS rules, and a high level for users who handle high risk data. Use it as a model for your own tiers, even if you never use Intune.

MAM vs MDM

MDM manages the device. MAM manages the apps on it. A company phone usually needs MDM, and often MAM on top. A personal phone often gets MAM only.

The full comparison, including how to choose between the two, is in MDM vs MAM.

When a small business needs MAM

You need MAM when employees open company data on phones you do not own and cannot ask them to enroll. The usual cases:

• A bring your own device policy where staff will not hand over control of a personal phone. See BYOD best practices and BYOD policies for SMBs.
• Contractors and seasonal staff who need email or a single business app for a short time.
• A leaver who has company email on a personal phone and you need to remove it without touching their photos.

You may not need it if every phone that touches company data is company owned. In that case device management already covers the apps, the settings and the wipe.

What to look for in a MAM tool

• The apps you actually use. MAM only protects apps that support the vendor's SDK or can be wrapped. Check your email, file storage and chat apps first.
• Your identity provider. Policies follow the signed in user, so the tool has to work with the accounts you already have.
• Both iOS and Android, with the same policy options on each. Settings and behavior differ between the platforms, such as how Intune PIN prompts behave after a reboot on each platform.
• Selective wipe, and how fast it takes effect. Ask when the app checks for a wipe request.
• Whether it works without enrolling the device, and what you give up when it does not.
• Licensing. Microsoft Intune app protection, for example, needs an Intune license assigned to each user.

For a Microsoft 365 company, Microsoft Intune app protection policies are the obvious first look. Microsoft documents that they work independently of any MDM and that they apply to Microsoft 365 apps and other apps that include the Intune SDK or are wrapped with its tool (Microsoft Learn, app protection policies overview, updated 2026).

Managing this across many devices

trio.so manages devices, not the app layer. It enrolls Windows, macOS, Linux, iOS and iPadOS, and Android devices, and deploys apps to enrolled devices. On Android, trio.so deploys apps through managed Google Play and pushes apps into the work profile. On iOS, it deploys through Apple Business (formerly Apple Business Manager). If your question is how to control company phones, start with mobile device management and read Apple Business (formerly Apple Business Manager) for the app side. If your question is how to protect data in apps on devices you cannot enroll, that is a MAM tool's job, and the checklist above is how to choose one.