Managed app configuration

How it works

The word "managed" is the key. Only an app installed by the MDM, as a managed app, can receive this configuration; a copy the user installed from the store won't. The server sends a dictionary of key-value pairs, the OS stores it in a location only that app can read, and the app picks it up at launch or when it changes.

On iOS and iPadOS the mechanism dates from iOS 7 in 2013: the MDM pushes an app configuration dictionary through the ManagedAppConfig channel, and the app reads it from user defaults under a reserved key. On Android it's called managed configurations, introduced with Android 5.0 Lollipop, where the app declares the settings it accepts in an XML schema and reads them through the RestrictionsManager API. Windows offers something similar for a smaller set of apps through Intune-style configuration policies, but it's far less standardized.

Because each vendor could have invented its own key names, the AppConfig Community was formed in 2016 by a group of MDM and app vendors to agree on conventions. That's why a server URL key often has the same name across platforms.

Some apps also send feedback the other way: Android's managed configuration feedback channel lets an app report whether it accepted each value, which the console can display. Not every MDM reads it, and not every app writes it.

Why it matters for a fleet

First launch is where deployments fail. Multiply one typo in a tenant ID by 300 scanners and the support queue fills for a week.

It also keeps configuration out of the binary. A backend URL that changes should be a value edited in the console and pushed in minutes, not a rebuild and a redeploy. Teams that hard-code settings in the APK learn this the first time a hostname moves.

The limit is the app itself. If the developer declared no configuration schema, there's nothing to push. Most enterprise vendors (Microsoft, Salesforce, SAP, Zebra) document their keys; for in-house apps, adding a handful of keys is an afternoon of work.

How Appaloosa handles it

Appaloosa pushes managed app configuration at install time, per app and per device group, to public apps from Managed Google Play and Apple VPP that support it and to your own private builds. Changing a value in the console updates enrolled devices without a reinstall, and the same channel carries OEM-specific settings through OEMConfig on Android. Everything sits alongside app distribution on the Mobile Application Management page.