Microsoft Technology Licensing, LLC

Brian Stuart Perlman

Wen-Pin Scott Hsu

Richard Scott Eizenhoefer

Yanan Zhang

Manoj Jain

Peter J Kaufman

Shayak Lahiri

Ning Zhang

Sean Anderson Bowles

Tarik Soulami

Hung Minh Dang

Adrian Francisco Teran Guajardo

Haipeng Li

Venkata Raghuram Pampana

Peter John Richards

Mark Zagorski

Dhruma Kishan Parikh

Jonathan M Andes

Colin William Hassett

Caglar Gunyakti

Ajay Arvind Bhave

Jay Robert Girotto

Kalin Georgiev Toshev

Anni Dong

Michael Sean Kirby

Helen Harmetz

Abigail Christine Motley

Padmanabhan Vasu

William Saunders Jack, Iii

Mark Zhang

Techniques are described herein that are capable of registering a user device with a cloud-based management service using an intermediate cloud storage. For instance, the intermediate cloud storage may store an encrypted data blob including information that identifies the user device. The intermediate cloud storage or a registration system may decrypt the encrypted data blob so that the registration system may use the decrypted data blob to register the user device with the cloud-based management service. For instance, the registration system may retrieve the encrypted or decrypted data blob from the intermediate cloud storage by providing a requisite secret to the intermediate cloud storage. The requisite secret may be provided to the registration system by the user device (e.g., via a matrix barcode, such as a QR code).

Cloud-based management service device registration using intermediate cloud storage

This document relates to a process for supporting the management of a variety of types of deployed devices. Administrators utilizing enterprise services can provide generic configuration data using configuration templates, which can be provided to a management server. The management server can then precompute device-specific configuration settings and resolve any conflicts that may arise based on the configuration templates. The configuration templates can also include placeholders for secret values, and once a managed device checks in to the management server, the secret values can be retrieved from an applicable enterprise service and provided to the managed device at the time of applying the configuration template.

Secure management of devices

This document relates to a process for deploying devices and automatically provisioning the devices to connect to a managed network upon powering on with minimal user involvement. Upon deployment of the device to an end point, a record can be established in a management server regarding the device, which can associate device specifications with a deployment profile to be used in provisioning the device. Upon powering on of the device at the end point, the device can automatically perform attestation with the management server, which can then provision the device according to the deployment profile without additional user intervention.

Securely configuring target devices using device identity

This document relates to a process for autopilot re-enrollment of managed devices in a network following a reset of the managed devices. Upon determining that the managed devices lack a hardware authenticator, a one-time password can be issued to the managed devices that may be stored in a persistent memory, and upon reset of the managed devices, the one-time password can be returned for validation and the managed devices can be automatically re-enrolled in the network upon validation of the one-time password.

Autopilot re-enrollment of managed devices

This document relates to securing ownership of devices to particular users when the devices are shipped directly from an original equipment manufacturer in order to prevent malicious use of devices that are lost or stolen. A purchaser may purchase a device from an original equipment manufacturer, and as part of the purchasing process, may provide ownership information for the device, which may include a user identifier and an identity provider. The ownership data can be written to firmware, and upon powering on of the device, the device can request a user identifier, which is then validated by the identity provider before allowing operating systems operations to continue on the device.

Secure user assigned device from manufacturer

Techniques are described for ensuring data integrity and authentication of received messages. One technique includes sending a request from a first module to a second module in which the request includes a first portion that is a shared secret encrypted with a public key, obtaining by the second module a private key from a secure and trusted information store, such as a license information store, including license information or other application specific information for the first module, using the private key to decrypt the first portion and obtain the shared secret, sending a response from the second module to the first module in which the response includes authentication data and at least one data item used with the shared secret to determine the authentication data, and performing by the first module verification processing to verify the authentication data included in the response.

Techniques for ensuring authentication and integrity of communications

A system grants 'provisional privileges' to a user request for the purpose of provisionally performing a requested transaction. If the provisionally-performed transaction does not put the system in a degraded state, the transaction is authorized despite the user request having inadequate privileges originally.

Provisional administrator privileges

An instance of an application hierarchy can be stored on a client computer to facilitate enforcement of software licensing by a software license component of a software protection system. The application hierarchy is a tree structure (e.g., unordered) that includes a top node, one or more product offering group(s), and, one or more selling unit(s). A computer-implemented software protection system can facilitate enforcement of software licensing on a client computer. The software protection system includes a software license component that can store and enforce software licensing rule(s). The software license component can further manipulate state data of an instance of the application hierarchy stored in a licensing data store via application program interface(s) (APIs). State data and/or property(ies) of a particular node of the instance of the application hierarchy can be accessed through the API via an assigned identifier.

Application hierarchy and state manipulation

A centralized process is provided for elevating portions of an application running under a user account to administrator privilege. A service security identifier is temporarily associated with the user and the portions of the application to be elevated to administrator privileges. The service security identifier is registered in the access control list to be accessed by the operating system. The centralized process may be used in the activation of software products.

System and methods for exchanging user interface data in a multi-user system

Growing community of inventors

Bothell, WA, United States of America

Brian Stuart Perlman