A method comprising: receiving, by a server computing device, a request for an identity assertion from a client application (224a, 224N) executed in a mobile device; detecting, by the server computing device, a platform associated with the mobile device; sending, by the server computing device, to the mobile device, a response to the request for the identity assertion based at least in part on the detected platform, the response requesting authentication by a management credential; then, determining, by the server computing device, whether the mobile device is a managed device, wherein a managed device is a device managed by a device management service; in an instance in which the mobile device is not a managed device: determining, by the server computing device, whether the client application is permitted to execute on the mobile device according to a policy; requesting, by the server computing device, authentication by user-supplied credentials in an instance in which the client application is permitted to execute on the mobile device which is not a managed device; after the requesting of authentication by user-supplied credentials, receiving and validating, by the server computing device, the user-supplied credentials from the client application; generating, by the server computing device, the identity assertion in response to determining that the user-supplied credentials are valid; and sending, by the server computing device, the identity assertion to the mobile device; and in an instance in which the mobile device is a managed device: after sending the response, receiving, by the server computing device, data generated by the management credential from the mobile device; after the receiving, determining, by the server computing device, that the management credential is valid for the identity assertion; and sending, by the server computing device, the identity assertion to the mobile device in response to determining that the management credential is valid for the identity assertion. receiving, by a server computing device, a request for an identity assertion from a client application (224a, 224N) executed in a mobile device; detecting, by the server computing device, a platform associated with the mobile device; sending, by the server computing device, to the mobile device, a response to the request for the identity assertion based at least in part on the detected platform, the response requesting authentication by a management credential; then, determining, by the server computing device, whether the mobile device is a managed device, wherein a managed device is a device managed by a device management service; in an instance in which the mobile device is not a managed device: determining, by the server computing device, whether the client application is permitted to execute on the mobile device according to a policy; requesting, by the server computing device, authentication by user-supplied credentials in an instance in which the client application is permitted to execute on the mobile device which is not a managed device; after the requesting of authentication by user-supplied credentials, receiving and validating, by the server computing device, the user-supplied credentials from the client application; generating, by the server computing device, the identity assertion in response to determining that the user-supplied credentials are valid; and sending, by the server computing device, the identity assertion to the mobile device; and determining, by the server computing device, whether the client application is permitted to execute on the mobile device according to a policy; requesting, by the server computing device, authentication by user-supplied credentials in an instance in which the client application is permitted to execute on the mobile device which is not a managed device; after the requesting of authentication by user-supplied credentials, receiving and validating, by the server computing device, the user-supplied credentials from the client application; generating, by the server computing device, the identity assertion in response to determining that the user-supplied credentials are valid; and sending, by the server computing device, the identity assertion to the mobile device; and in an instance in which the mobile device is a managed device: after sending the response, receiving, by the server computing device, data generated by the management credential from the mobile device; after the receiving, determining, by the server computing device, that the management credential is valid for the identity assertion; and sending, by the server computing device, the identity assertion to the mobile device in response to determining that the management credential is valid for the identity assertion. after sending the response, receiving, by the server computing device, data generated by the management credential from the mobile device; after the receiving, determining, by the server computing device, that the management credential is valid for the identity assertion; and sending, by the server computing device, the identity assertion to the mobile device in response to determining that the management credential is valid for the identity assertion.