Policy-based application management

Non-transitory computer readable media storing

• instructions that, when executed, cause a system to perform:
• receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;
• receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application;
• and
• running, by the processor, the managed application on the mobile device, the managed application limited by the access controls defined in the set of policy files and enforced by the mobile device management system,
• wherein the set of one or more policy files, when applied to the managed application, cause the managed application to restrict a data sharing feature available to one or more unmanaged applications executing on the electronic mobile device.

An apparatus comprising:

• a processor;
• and
• memory storing computer readable instructions that, when executed by the processor, cause the apparatus to perform:
• receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;
• receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application;
• and
• running, by the processor, the managed application on the mobile device, the managed application limited by the access controls defined in the set of policy files and enforced by the mobile device management system,
• wherein the set of one or more policy files, when applied to the managed application, cause the managed application to restrict a data sharing feature available to one or more unmanaged applications executing on the electronic mobile device.