A device manager establishes a mobile device and a gateway as managed devices. The device manager generates management metadata and a split cryptographic key. The management metadata may include information identifying the mobile device. The metadata may include a gateway key part and a mobile key part which, in combination, are sufficient to decrypt information encrypted with the management split key. The device manager may encrypt the management metadata using the management split key. The device manager may send the gateway key part and the encrypted management metadata to the gateway and the mobile key part to the mobile device. Subsequent delivery of the mobile key part to the gateway, by the mobile device, enables the gateway to decrypt the encrypted management metadata and recognize the mobile device as a management device delegate sanctioned by the device manager to perform delegated management of the gateway.