A method, comprising: monitoring, by a mobile device management agent on a mobile computing device (302, 402), state information associated with the mobile computing device; providing, by the mobile device management agent, at least some of the monitored state information to one or more policy management servers; applying, by the mobile device management agent, one or more policies to application tunneling functionalities on the mobile computing device based on the monitored state information to enable a dual-mode application on the mobile computing device to establish at least one tunnel to at least one enterprise resource (304, 408), the dual-mode application having a managed mode which provides access to enterprise data obtained from the at least one enterprise resource via the at least one tunnel and in which one or more management policies are enforced on the dual-mode application, and the dual-mode application having an unmanaged mode which limits access to the enterprise data and in which the one or more management policies are not enforced on the dual-mode application; receiving, by the mobile device management agent, from the one or more policy management servers, management information that comprises one or more commands generated by the one or more policy management servers based on the at least some of the monitored state information received from the mobile device management agent on the mobile computing device, the one or more commands comprising at least one command configured to cause the mobile device management agent to selectively disable the application tunneling functionalities for the dual-mode application on the mobile computing device; and selectively disabling, by the mobile device management agent, the application tunneling functionalities for the dual-mode application on the mobile computing device based on the at least one command. monitoring, by a mobile device management agent on a mobile computing device (302, 402), state information associated with the mobile computing device; providing, by the mobile device management agent, at least some of the monitored state information to one or more policy management servers; applying, by the mobile device management agent, one or more policies to application tunneling functionalities on the mobile computing device based on the monitored state information to enable a dual-mode application on the mobile computing device to establish at least one tunnel to at least one enterprise resource (304, 408), the dual-mode application having a managed mode which provides access to enterprise data obtained from the at least one enterprise resource via the at least one tunnel and in which one or more management policies are enforced on the dual-mode application, and the dual-mode application having an unmanaged mode which limits access to the enterprise data and in which the one or more management policies are not enforced on the dual-mode application; receiving, by the mobile device management agent, from the one or more policy management servers, management information that comprises one or more commands generated by the one or more policy management servers based on the at least some of the monitored state information received from the mobile device management agent on the mobile computing device, the one or more commands comprising at least one command configured to cause the mobile device management agent to selectively disable the application tunneling functionalities for the dual-mode application on the mobile computing device; and selectively disabling, by the mobile device management agent, the application tunneling functionalities for the dual-mode application on the mobile computing device based on the at least one command.