Microsoft Technology Licensing, LLC

Justin Alexander Hou

Peter J Kaufman

Yuhang Zhu

John Chadwell Spaith

Janani Vasudevan

Vladimir Holostov

Richard Ivan June

Javier Novales

Scott Randall Shell

Peter David Waxman

Feng Yue

Roy Williams

Giridhar Viswanathan

Sean Anderson Bowles

Kinshuman Kinshumann

Sandeep Paruchuri

Christopher William Thilgen

Oren Freiberg

Sonia Prabhu

Erhan J Kartaltepe

A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.

Device attestation through security hardened management agent

Various technologies described herein pertain to managing multiple enrollments of a computing device into configuration sources. Respective enrollment types for the enrollments into the configuration sources can be detected. Moreover, respective control data for the enrollments into the configuration sources can be set based on the enrollment types. Provisioning elements (e.g., policies, preferences, configuration profiles, and resources) that satisfy the respective control data can be permitted to be applied to the computing device by the configuration sources as part of the enrollments. Further, disparate provisioning elements that fail to satisfy the respective control data can be prevented from being applied to the computing device as part of the enrollments.

Multi-enrollments of a computing device into configuration sources

Methods, systems, and computer program products are provided that enable secure remote modification of device credentials using device-generated credentials. A plurality of credentials policies is stored by the user device. The credentials policies are merged to generate a merged credentials policy. An instruction is received by the user device from a trusted service to initiate a device credentials change. A new device credentials is generated on the user device based at least on the merged credentials policy.

Secure remote modification of device credentials using device-generated credentials

Various technologies described herein pertain to policy management on a mobile device. The mobile device includes a device policy manager system that includes a unified interface component and a policy handler component. The unified interface component is configured to receive policy configuration requests from multiple policy sources, including at least an internal policy source component executed by the mobile device and a device management server external to the mobile device. The policy configuration requests include at least a first policy configuration request (a first policy value for a policy) from a first policy source and a second policy configuration request (a second policy value for the policy) from a second policy source. The policy handler component is configured to resolve the conflict between the first and second policy values based on a conflict resolution technique to set a current policy value for the policy that controls the mobile device.

Device policy manager

A facility for maintaining the state of a managed device is described. The facility receives an indication that the managed device is to be unenrolled from management. In response to receiving the indication, during a first time period, the facility performs a first unenrollment task with respect to the managed device. In response to receiving indication, during a second time period that does not intersect the first time period, performing a second unenrollment task with respect to the managed device that is distinct from the first unenrollment task.

Persistent unenrollment for devices under management

Contextually aware device management techniques are described. Identifying data is provided via a communication connection by a client device to a service provider via a network that is usable by the service provider to identify the client device or functionality of the client device. One or more contexts are received at the client device from the service provider via the network that correspond to the identifying data. Each of the one or more contexts includes management objects along with one or more triggers configured to cause the context to transition to a corresponding one of a plurality of context states and thereby cause performance of one or more actions corresponding to the context state. The one or more contexts are implemented locally by the client device effective to identify and perform the one or more actions corresponding to the context state by the client device based on identification of the one or more triggers without use of network communication by the client device.

Contextually aware device management

Growing community of inventors

Seattle, WA, United States of America

Justin Alexander Hou