Up to Lollipop, native `app2sd` moved `.apk` files as encrypted `.asec` files <sup>([1][1])</sup> to `.android_secure` folder in `/mnt/sdcard/` or `/storage/sdcard[0|1]/`. On every boot these encrypted files were decrypted and placed in a temporary filesystem mounted at `/mnt/asec/` <sup>([2][2])</sup> by `vold`, to which the symlinks from app directories in `/data/app/` and possibly from library directories in `/data/data/` were pointing.

Starting with Marshmallow, the native method of moving apps to external SD card works only if SD card is formatted as `Adoptable Storage` <sup>([3][3], [4][4])</sup>:
> ASEC containers have been deprecated since MNC, which is when we
introduced the "adoptable storage" feature.  Adoptable storage is a
much better user experience, since we move both the APK and private
app data together as a single unit.

<sup>* MNC is *Macadamia Nut Cookie*; code name for Android Marshmallow (6.x).</sup>  
And:

> new installs into ASEC containers are no longer supported; use adoptable storage instead.

[Adoptable Storage][5] is a Full Disk Encrypted SD card, completely managed by `vold`, not visible to user as external SD card. See [here][6] how it differs from traditional [Portable Storage][7]. You can format SD card as partially Adoptable and partially Portable too.

Like the pre-Marshmallow `app2sd` phenomenon <sup>([5][8])</sup>, apps only with `installLocation` set to `preferExternal` or `auto` in app's `manifest` are moveable:
> Apps can be placed on adopted storage media only when the developer has indicated support through the `android:installLocation` attribute.

For apps with install location `auto`, default install location (set using `pm set-install-location`) decides where app will be installed. See [this answer][9] for details.

If you want to move all apps, use a third party solution like `Apps2SD` or `Link2SD`.

**PS:**  
An even better approach is to move `/data/media` instead of apps. Create an extra partition on external SD card and `on post-fs-data` mount it to `/data/media` using an `init.d` script or Android's `init` service. Other bigger directories `/data/app` or `/data/data` can also be moved in the same way.

If you want to keep files encrypted on external SD card, this can be achieved through native methods `dm-crypt` (Android's `FDE`) for block device encryption, `ecryptfs` for stacked filesystem encryption, or third party solution like `EncFS` for stacked encryption. New native method of filesystem encryption `fscrypt` (Android's `FBE`) may also work, but I haven't tried. See details in [this answer][10].

---

**RELATED:**

- [How to free Internal Storage by moving data or using symlink / bind-mount with Adoptable Storage?][11]


  [1]: https://en.wikipedia.org/wiki/.asec
  [2]: https://android.googlesource.com/platform/system/vold/+/refs/tags/android-5.1.1_r38/Volume.cpp#77
  [3]: https://android.googlesource.com/platform/frameworks/base/+/8c61e39e042c31dd21567897c834c7c45fe7181b
  [4]: https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-9.0.0_r42/core/java/android/content/pm/PackageManager.java#732
  [5]: https://source.android.com/devices/storage/adoptable
  [6]: https://fossbytes.com/android-sd-card-internal-storage-adoptable-storage/
  [7]: https://source.android.com/devices/storage/traditional.html
  [8]: https://developer.android.com/guide/topics/data/install-location
  [9]: https://android.stackexchange.com/a/43522/218526
  [10]: https://android.stackexchange.com/a/216780/218526
  [11]: https://android.stackexchange.com/a/214706/218526