Working for a customer project which required MAM-Only, I was looking for some more information and I made some tests.
There is a MAM-Only Mode which has been introduced with the 10.3.5 version of XenMobile.
To distinguish the prior and new MAM modes, Citrix documentation refers to the new mode as “MAM-only” and refers to the prior MAM mode as “legacy MAM mode.” While the legacy MAM functionality is the same as before, Citrix won’t enhance it in future releases.
MAM-only mode is in effect when the Server Mode property of XenMobile is MAM. Devices register in MAM mode.
How to configure the “new” MAM-Only Mode?
Connect on the Web Portal Admin of the XMS and click on Server Properties
In the search box, enter Mode and hit Enter
Select Server Mode and click on Edit
Possible Values are:
ENT: MDM+MAM
MDM: MDM Only
MAM: MAM Only
A restart of the XMS server need to be done to apply the new Value.
What happen for MDM Value
On a previously enrolled device (in ENT Mode), the device still appears in the console as MDM/MAM Mode:
On a new enrolled device (in MDM Mode), the device appears in the console as MDM Mode:
What happen for MAM Value
On a previously enrolled device (in ENT Mode), the device still appears in the console as MDM/MAM Mode:
On a new enrolled device (in MAM Mode), the device appears in the console as MAM Mode:
On the MAM Device I can see the MDX Apps and download them from the public Store
New features available for MAM-Only mode are:
Certificate-based authentication
MAM-only mode supports certificate-based authentication. Users will experience continued access to their apps even when their AD password expires. If you choose to switch to certificate-based authentication for MAM devices, you must configure your NetScaler Gateway. By default, in the XenMobile Settings > NetScaler Gateway, Deliver user certificate for authentication is set to Off, meaning that user name and password authentication is used. You must change that setting to On to enable certificate authentication.
Self Help Portal, to enable end users to perform their own app lock and app wipe. Those actions apply to all apps on the device. You can configure the App Lock and App Wipe actions in Configure > Actions.
All enrollment modes, including High Security, Invitation URL, and Two Factor, configured through Manage > Enrollment.
Device registration limit for Android and iOS devices. The Server Property Number of Devices Per User has moved to the new Configure > Enrollment Profiles page and now also applies to the new MAM-only mode.
MAM-only APIs. For MAM-only devices, you can call REST services by using any REST client and the XenMobile REST API to call services that are exposed through the XenMobile console.
The above features do not apply to MAM legacy Mode.
Note: Those information are provided based on my own experience.