# How to allow access to corporate apps using only managed devices?

Last updated: July 24, 2026

Explains how to use Managed App Configurations so corporate apps only work on MDM-managed devices, when the app developer supports it. MDM embeds a token in the distributed app that the app's server checks before granting access. In App Repository, add the iOS app directly or via VPP, and the Android app via Android for Work. Open the app's Configurations tab (shown only if supported), upload the XML configuration file, then distribute the app to devices.

## Description

Managed App Configurations can be implemented to ensure that corporate apps are accessed only on managed devices if the app developer implements it in the code. This approach prioritizes data security and prevents unauthorized access to sensitive information. By incorporating Managed App Configurations into specific apps, developers can allow administrators to apply necessary configurations when distributing those apps to devices.

When using Managed App Configurations, the app developer makes use of Mobile Device Manager (MDM) server to embed a special token or identifier within the distributed apps. This token acts as a license key or a unique identifier. Consequently, the app server checks for the presence of this token, and only if it is detected, the user is granted access to the app. This mechanism ensures that access is restricted to managed apps only.

## Steps

Follow the steps given below, to configure the app with the configuration:

1. On the MDM console, click on the **Device Mgmt** tab and select **App Repository**.
2. In case of the iOS app, it can be added to the repository either directly, or using [Apple App Management](https://www.manageengine.com/mobile-device-management/help/app_management/ios_app_management.html#Using_Managed_Distribution).
3. For Android apps, the app must be added to the repository using [Android for Work](https://www.manageengine.com/mobile-device-management/how-to/mdm-silent-installation-android-apps.html).
4. Click the app (either iOS or Android) to which the configurations are to be applied.
5. Select the **Configurations** tab which appears only if Managed App Configurations is supported by the app developer.
6. Upload the XML file which has the [relevant configurations](https://www.manageengine.com/mobile-device-management/help/app_management/ios_app_management.html#iOS_app_config).
7. Once the file has been uploaded, the apps can be [distributed](https://www.manageengine.com/mobile-device-management/help/app_management/mdm_distributing_apps_to_devices.html#Distributing_Apps_to_Groups) to the devices.

## Frequently asked questions

### How do managed app configurations restrict access to corporate apps?

The app can check for an MDM-provided token or identifier and allow access only when the app is distributed and configured on managed devices.

### Can every app use managed app configurations for conditional access?

No. The configurations tab appears only when the app developer supports Managed App Configurations for that application.

### What file is required to apply the app configuration?

You must upload the XML file that contains the relevant app configuration values supported by the target application.