Controlling application behavior in the context of managed accounts. A device includes one or more applications. At least one of the applications is configured to be used with a plurality of user accounts including zero or more managed user accounts. The device includes or communicates with a client component. The client component is configured to identify active user accounts for the applications. The client component is further configured to receive policy from a management system, where the policy specifies application controls a user account basis. The client component is further configured to enforce application configuration based on the policy from the management system and the active user accounts.