Skip to content

Azure Enterprise Mobile Hosting, Distribution & CI/CD

Intune / MDM & MAM

  • MDM = full device management; MAM = app-level management.
  • MAM-WE (without enrollment) protects corporate data on unmanaged BYOD via App Protection Policies (PIN, encryption, copy/paste/save-as restrictions, selective wipe checked every 30 min). Must be paired with Conditional Access requiring an app-protection policy.
  • App Config Policies push settings; on enrolled iOS, IntuneMAMUPN/IntuneMAMOID/IntuneMAMDeviceID auto-flow to managed apps. Data-protection framework has three levels (Enterprise basic/L1 → high).
  • Apps become managed via the Intune App SDK or App Wrapping Tool — the SDK team officially supports native Android/iOS/.NET/MAUI, NOT React Native (RN integration is unsupported, at-your-own-risk; validate with Microsoft).
  • Enrollment: Apple Business Manager (ABM), Android Enterprise (Work Profile/COPE/COBO). Defender for Endpoint and Play Integrity / hardware attestation feed compliance → Entra ID → Conditional Access. Distribute LOB .ipa/.apk/.aab as line-of-business apps.

Backend & data tier

  • Azure API Management as the mobile gateway (throttling, policies, JWT validation, developer portal).
  • Hosting on AKS (ingress, TLS termination) or Azure Container Apps (serverless scale-to-zero, built-in Dapr 1.13.x-msft, Easy Auth built-in).
  • Azure Static Web Apps (Standard) serves PWA/hybrid content and links a backend under /api (no CORS; pass-through X-MS-CLIENT-PRINCIPAL auth).
  • Cosmos DB for data: partition strategy; change feed (always returns the full document — foundational for offline sync); multi-region conflict resolution (LWW default on _ts, or a Custom merge stored procedure — NoSQL API only; patch resolves at path level).
  • Azure SignalR for realtime; Azure CDN for assets; Functions for event-driven endpoints; Private Endpoints / NSGs / Azure Firewall for network isolation.

CI/CD after App Center (retired March 31, 2025)

App Center was retired except for Analytics & Diagnostics (support extended, initially to June 30, 2026, then to end of March 2027 pending the Azure Monitor mobile migration — confirm the live date). Replacements:

  • Builds: Azure DevOps Pipelines (macOS agents for iOS, signing certs in Azure Key Vault) and/or GitHub Actions + Fastlane (match signing, gym build, deliver/supply store uploads, snapshot/screengrab screenshots). Bitrise/Codemagic are mobile-first alternatives.
  • OTA: EAS Build/Update for Expo; CodePush continues standalone — both with version / mandatory-update enforcement.
  • Distribution: TestFlight + App Store Connect API; Google Play Internal Testing; Intune LOB; Firebase App Distribution.
  • Bundle optimization: Hermes bytecode, R8/ProGuard, AAB over APK. Semantic versioning + build numbering. Manage iOS distribution/enterprise certs and Android keystores in Key Vault.

Observability tie-in

Crash via Sentry / Crashlytics; performance via New Relic Mobile / Dynatrace / Firebase Performance; OpenTelemetry → Azure Monitor Application Insights (@azure/monitor-opentelemetry-exporter). Hermes lacks OTel auto-instrumentation, so create spans manually and correlate to backend traces via W3C Trace Context. (See mobile-react-native for RN-side wiring.)

  1. Foundation (wk 0–4): RN New Architecture (or native), Entra ID + MSAL broker auth, decommission App Center, move CI/CD to Azure DevOps/GitHub Actions + Fastlane (certs in Key Vault).
  2. Secure backend & data (wk 4–10): APIM → Container Apps/AKS → Cosmos DB with Private Endpoints; Easy Auth + JWT validation at APIM; offline-first persistence with change-feed sync + explicit conflict strategy; public-key cert pinning with a backup pin.
  3. Hardening & distribution (wk 10–16): Intune App Protection Policies + Conditional Access (MAM-WE for BYOD); Play Integrity / App Attest; passkeys/FIDO2 + step-up auth; Sentry + App Insights; distribute via Intune LOB / TestFlight / Play Internal Testing.

Plugin: mobile-development · View SKILL.md on GitHub