Imagine: you have a legacy Xamarin.Forms app that needs Intune policy protection. The source code is only with the vendor, who hasn't responded in ages. App Wrapping is the only way. We do it in 1–2 weeks. In 7 years, we've completed over 50 wrapping projects for iOS and Android, including vendor products. Choosing the right tool and understanding the limitations is key to success. We guarantee stable operation: 90% of projects pass policy testing on the first try.
According to the Microsoft Intune App Wrapping Tool, the tool supports iOS 13+ and Android API 21+. But not every app can be wrapped without issues. Most often, difficulties arise from custom frameworks, aggressive ProGuard, or WKWebView.
Why App Wrapping Isn't Suitable for All Apps
Wrapping is not magic. Some SDK features are unavailable when wrapping: multi-identity, custom wipe handler, Intune-targeted conditional launch checks. If the app uses WKWebView for the main UI, JavaScript content is not intercepted by MAM. Either SDK integration or manual tweaking via WKUserContentController is needed. On Android, wrapping works through bytecode instrumentation: the tool rewrites Dalvik/ART bytecode, replacing system class calls with MAM wrappers. This is less stable than the iOS approach and can break with aggressive ProGuard/R8 optimizations. In 80% of cases, problems are related to custom ProGuard rules.
Solving ProGuard Issues
If the app crashes after wrapping, disable aggressive obfuscation for MAM classes. Add to proguard-rules.pro: ``` -keep class com.microsoft.intune.** { *; } -keep class android.content.ClipboardManager { *; } ``` Or use the `-dontobfuscate` configuration during the build.How to Automate Wrapping in CI/CD
Each new release requires repeating the wrapping procedure. Manual process is time-consuming and error-prone. We integrate wrapping into your pipeline: Jenkins, GitHub Actions, GitLab CI. For iOS, we use IntuneMAMPackager on a macOS agent:
./IntuneMAMPackager/Contents/MacOS/IntuneMAMPackager \ -i /path/to/app.ipa \ -o /path/to/wrapped-app.ipa \ -p /path/to/provisioning-profile.mobileprovision \ -c "Apple Distribution: Company Name (TEAMID)" \ -e /path/to/entitlements.plist \ --use-secondary-ipa-keychain-group true For Android — IntuneMAMPackager.jar:
java -jar IntuneMAMPackager.jar \ -i app-release.apk \ -o app-wrapped.apk \ -c RSA_KEY_ALIAS \ -ks keystore.jks \ -ksPass keystorePassword \ -alias keyAlias \ -aliasPass aliasPassword After automation, each build completes wrapping in 5–10 minutes.
What's Included
| Step | Duration | Result |
|---|---|---|
| Compatibility analysis | 1–2 days | Conclusion on wrapping feasibility |
| Intune Portal setup | 1–2 days | App linked to AAD and policies |
| Wrapping + re-signing | 1–2 days | Protected IPA/APK |
| Policy testing | 1–3 days | Test protocol, screenshots |
| CI/CD integration | 2–4 weeks | Automated wrapping pipeline |
| Documentation and training | 1–2 days | Administrator guide |
Project Phases and Timelines
- Analysis of the source app: compatibility with wrapping, architecture, used frameworks.
- Intune Portal setup: create the app in Microsoft Endpoint Manager, configure App Protection Policy.
- Wrapping and re-signing (iOS: provisioning profile + certificate; Android: keystore).
- Testing: verify all policies (copy-paste, wipe, PIN), regression test functionality.
- CI/CD integration for automatic wrapping on each build.
- Rollout: distribute via Intune Company Portal or MDM solution.
Estimated timelines: one-time wrapping — 1–2 weeks. Full pipeline with CI/CD — 3–5 weeks. Cost is determined after analysis. Contact us — our engineers will check your app's compatibility for free.
Wrapping vs MAM SDK: Detailed Comparison
The choice between wrapping and SDK integration depends on source code access and required security policies.
| Criterion | App Wrapping | MAM SDK |
|---|---|---|
| Source code access | Not needed | Required |
| Multi-identity | No | Yes |
| Custom wipe handler | No | Yes |
| Implementation time | 1–2 weeks | 2–6 weeks |
| Cost | Determined after analysis | Determined after analysis |
Wrapping is the right choice for third-party and legacy apps without source code. MAM SDK is chosen when advanced policies are needed: separation of corporate and personal data in one app, custom wipe handler. A hybrid approach — wrapping the base version plus partial SDK integration for critical components — is our frequent choice for medium enterprises.
Order wrapping of your corporate app — get a turnkey protected version in 2–3 weeks.