Vmware, Inc.

Omnissa, LLC

Karthikeyan Palanisamy

Suchit Shivashankar

Gaurav Verma

Manjunath Subramani

Amit Kumar Singh

Arvind Maan

Ashok Kumar

Ramanandan Nambannor Kunnath

Sruthi Surendran

Abhijeet Padole

Amogha Varsha Annegowda

Disclosed are various approaches for management and monitoring of delegated scope on devices. In some examples, A management agent on a client device receives a scope delegation profile that specifies a scope to delegate from the management agent to a particular application. A scope delegation software development kit (SDK) consumed by the management agent invokes a function of an operating system (OS)-based policy manager to delegate the scope to the particular application. The management agent receives delegated scope data specifying that the particular application utilized the scope and provides it to the management service.

Management and monitoring of delegated scope on devices

Systems and methods are described for accessing a first user device using a digital badge from a second user device. The digital badge can include information that can be used to identify and authenticate a user profile. In an example, the first and second user devices can be enrolled in a system for managing user devices. A user can select to login to the first user device using a digital badge. The first user device can enable a wireless communication protocol and broadcast a digital badge request that is recognizable by other enrolled devices. The second user device can detect the broadcast and send its digital badge to the first user device. The first user device can send an access request and the digital badge to a server. The server can verify the digital badge, authenticate the user, and notify the first user device. The first user device can then grant the user access without the user inputting any credentials.

Using a digital badge to access managed devices

Systems and methods are described for enrolling a user device in a Unified Endpoint Management ('UEM') system over a closed network. After an initial boot or factory reset of a user device, a user can scan a Quick Response code, or other scannable code, that is embedded with enrollment configuration data that includes configuration settings for communicating with a UEM server in the UEM system. Using the enrollment configuration data, the user device can retrieve an installation file for a management application. The user device can install the management application and give the management application access to the enrollment configuration data. The management application can disable hardcoded open network endpoints on the user device and configure the user device for UEM communications on the closed network. The user device can connect to the UEM server over the closed network and request enrollment in the UEM system.

Device enrollment in a unified endpoint management system over a closed network

Examples described herein include systems and methods for contextually providing automated device enrollment into a management system. A management application on a user device can receive network settings for connecting to a local server. The network settings can be preconfigured by an administrator. The management application can cause the user device to send an enrollment request and a device identifier to the local server. The device identifier can be used to validate the device and provide a security token to the management application. The management application can use the security token to complete enrollment of the user device.

Contextual automated device onboarding

Disclosed are various embodiments for managing deployment model migrations for enrolled devices. A client application can transmit a capability status to a management service in an instance in which a plurality of device conditions of the client device are validated. The client application can obtain and execute instructions that cause the client application to manage a migration of the client device from a first configuration to a second configuration. A user interface can be pinned on a display of the client device in an instance in which an enterprise environment endpoint is identified and a migration interface on the client device executed. The client application can transmit samples of device conditions of the second configuration of the client device to the management service.

Managing deployment model migrations for enrolled devices

Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground.

Dynamic application-level compliance enforcement

Examples described herein include systems and methods for improved application rollback or application migration on a user device. A portal application can store state information for multiple applications installed on a user device. The portal application can send the state information to a management server that exerts management control over aspects of the user device. The management server can send a rollback command to the portal application, instructing the portal application to rollback a target application that is already installed on the device. The portal application can cause the application to be uninstalled and can install a new instance of the target application as specified by the rollback command. The example method can further include the portal application providing at least some state information to the new instance of the application. The new instance of the application can use that state information to implement a configuration in the application.

Guided application rollback and migration

Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Linking multiple enrollments on a client device

Examples described herein include systems and methods for providing on-demand access to a restricted resource of a user device. An example method can include generating a profile that specifies a restricted resource and one or more conditions for that resource to be de-restricted. The profile can be sent to, and utilized by, an agent application executing on the user device. The agent application can determine that a user is requesting de-restriction of a resource and determine whether all applicable conditions are met. If the conditions are met, the agent application can de-restrict the resource. After the resource is used, the agent application can report details of the use to an administrator or management server.

Growing community of inventors

Bengaluru, India

Karthikeyan Palanisamy