# Mobile MDM / EMM companion stub

Preferred enterprise path for Android & iOS: **MDM owns the device**, Extreme owns enroll + seat binding.

## What Extreme ships

1. **Activation token** (platform-issued, seat-gated) — see `/app/team` Licenses and `/app/agents` wizard.
2. **Thin companion** (optional Expo app or managed webview) that:
   - Reads AppConfig / Managed App Configuration for `ECS_ACTIVATION_TOKEN` + `EXTREME_CLOUD_URL`
   - Calls enroll / heartbeat / fingerprint
3. **Webhook adapter** (server-side) mapping MDM inventory → fingerprint schema (no on-device spyware).

## What MDM owns

- Apple ADE / Android Enterprise enrollment
- Compliance, wipe, OS update policy
- Push of AppConfig keys:

```xml
<!-- illustrative Managed App Configuration keys -->
<key>ECS_ACTIVATION_TOKEN</key>
<key>EXTREME_CLOUD_URL</key>
<key>EXTREME_AGENT_CHANNEL</key> <!-- stable | beta -->
```

## Android

- Prefer Android Enterprise work profile / fully managed.
- Companion APK (when published) listed on the Agents portal as “MDM companion”, not sideload spyware.
- No Accessibility Service for keylogging.

## iOS

- Prefer ADE + Managed App Distribution.
- No Input Monitoring / Screen Recording entitlements for this companion.
- Use install-scoped identifier + hash for seat binding.

## Operator steps

1. Admin creates activation token (or MDM batch token on Enterprise).
2. Push companion + AppConfig via MDM.
3. Device appears under device seats after enroll.
4. Revoke seat from console if device is lost.