1. A method of managing a virtual private network (VPN) connection, comprising: receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files; receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; receiving user authentication information from a user to initially authenticate the user; verifying the user is associated with permissions allowing the user to use the managed application; permitting the mobile device to launch the managed application only when the user is permitted to use the managed application; running, by the processor when the user is permitted to use the managed application, the managed application on the mobile device, the managed application operating in accordance with the set of one or more policy files, wherein one of the policy files defines a policy determining whether the managed application is permitted to create an application-specific VPN connection with an enterprise server, wherein said application specific VPN is available to the managed application, but is not usable by an unmanaged application executing on the electronic mobile device; determining whether the user is permitted to remotely access, using the managed application, an enterprise resource hosted remotely from the mobile device, wherein said determining comprises: receiving an authentication challenge from the enterprise resource, determining one or more security certificates the user is permitted to use based on the initial authentication of the user, and responding to the authentication challenge using one of the one or more security certificates; and instructing the managed application to create the application-specific VPN responsive to affirmatively determining that the user is permitted to remotely access the enterprise resource using the managed application.