Microsoft Technology Licensing, LLC

Peter J Kaufman

Shayak Lahiri

Sean Anderson Bowles

Yuhang Zhu

Richard Ivan June

Janani Vasudevan

John Chadwell Spaith

Justin Alexander Hou

Yi Zhao

Go Komatsu

Brian Stuart Perlman

Gaurav Raghu Dhawan

Haipeng Li

Venkata Raghuram Pampana

Manoj Jain

Peter John Richards

Dhruma Kishan Parikh

Moiz Z Rassiwala

Daniel S Dudugjian

Adeep Singh Cheema

Rama Krishna Samudrala

Jitendrakumar G Koshti

Randall Richards Cook

Dennis Edward Flanagan

Tanvir Ahmed

Pieter Willem Wigleven

Javier Novales

Scott Randall Shell

Peter David Waxman

Feng Yue

Vladimir Holostov

Giridhar Viswanathan

Kinshuman Kinshumann

Adrian Francisco Teran Guajardo

Sonia Prabhu

Erhan J Kartaltepe

Tarun Kumar Jain

Prakash Ajay Kumar Suri

Justin Hou

This document relates to a process for supporting the management of a variety of types of deployed devices. Administrators utilizing enterprise services can provide generic configuration data using configuration templates, which can be provided to a management server. The management server can then precompute device-specific configuration settings and resolve any conflicts that may arise based on the configuration templates. The configuration templates can also include placeholders for secret values, and once a managed device checks in to the management server, the secret values can be retrieved from an applicable enterprise service and provided to the managed device at the time of applying the configuration template.

Secure management of devices

Embodiments described herein are directed to implementing compliance settings by a computing device for bringing the computing device into compliance with a configuration scenario. For instance, a computing device may receive, from a server, configuration information describing compliance settings for implementing by the computing device to bring the computing device into compliance with a configuration scenario. Moreover, the computing device may identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings and execute the state machine to configure the computing device with the compliance settings.

Implementation of compliance settings by a mobile device for compliance with a configuration scenario

Embodiments described herein are directed to managing device compliance for devices that are connected to an enterprise network. For example, a mobile device manager may provide configuration settings to a computing device, which implements the settings in order to be compliant with an enterprise's data and/or security policy. The mobile device manager also maintains a local reference of each device's configuration settings implemented thereby. When the mobile device manager subsequently performs a determination as to whether the computing device is still in compliance, the mobile device manager simply needs to refer to the local reference to determine the computing device's settings instead of explicitly querying the computing device for its settings. The foregoing techniques may be extended for security baseline compliance determinations, IoT device compliance determinations and compliance determinations for other types of devices, such as devices utilized by business partners of the enterprise that utilize the enterprise's network.

Queryless device configuration determination-based techniques for mobile device management

Embodiments described herein are directed to configuring managed computing devices utilizing containerized applications. For instance, a mobile device manager may provide configuration settings to a computing device via, for example, an enterprise network. A host operating system (OS) executing on the computing device determines and applies the settings that are applicable to the host OS. The configuration settings are stored for configuring containerized applications executing on the computing device. For instance, as new containerized applications are launched by the host OS, the containerized applications retrieve the configuration settings and determine and apply the settings that are applicable to the containerized applications. Results of applying the configuration settings to the host OS and the containerized applications are merged and sent to the mobile device manager. The host OS and the containerized application may, for example, implement the settings in order to be compliant with an enterprise's policy.

Configuration techniques for managed host operating systems and containerized applications instantiated thereby

Embodiments described herein are directed to configuring managed virtual machines. For instance, a management service (e.g., a mobile device manager) may provide configuration settings to a parent virtual machine. Upon successful application of the configuration settings, the parent virtual machine notifies a configuration service that it is in a steady state and provides the configuration settings to the configuration service. The configuration service notifies a cloud-based service (e.g., a virtual desktop service) that it is configured to instantiate virtual machines. The notification informs the cloud-based service that it is permitted to instantiate child virtual machines. Responsive to receiving the notification, the cloud-based service instantiates child virtual machine(s) as needed. To configure the child virtual machine(s), the configuration service provides the configuration settings received from the parent virtual machine to the child virtual machine(s), and the child virtual machine(s) configure themselves accordingly.

Configuration techniques for managed virtual machines

A configuration control transfer ('CCT') system controls the transferring of control of configuration information of a device from a current configuration source to a target configuration source. A CCT server of the CCT system may send a request for the configuration information of the device where the configuration information of the device currently under control of the at least one first configuration source. The CCT server may also receive the requested configuration information, determine whether the second configuration source is able to support the configuration information of the first configuration source, and based at least on a determination that the second configuration source is able to support the configuration information, request that the device transfer control of the configuration information from the first configuration source to the second configuration source to unenroll the device with the first configuration source and enroll the device with the second configuration source.

Transfer of control of configuration sources

Various technologies described herein pertain to controlling configuration of a computing device. A configuration request can be received, at the computing device, from a configuration source external to the computing device. The configuration request can include configuration data for a dependent feature. An evaluation can be performed at the computing device to determine whether a dependency graph for the dependent feature is satisfied. The dependency graph for the dependent feature can specify interdependencies between configurations of a set of features such that remaining features in the set of features are to be configured prior to enabling the dependent feature to be configured. Moreover, the dependent feature can be configured based on the configuration data when the dependency graph for the dependent feature is satisfied. The configuring of the dependent feature based on the configuration data can be prohibited prior to the dependency graph for the dependent feature being satisfied.

Dependency graph for coordination of device configuration

A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.

Device attestation through security hardened management agent

Growing community of inventors

Sammamish, WA, United States of America

Peter J Kaufman