Adaptive device enrollment

Patent metadata

Field	Value
Publication number	US-10972468-B2
Application number	US-201715818795-A
Country	US
Kind code	B2
Filing date	Nov 21, 2017
Priority date	Nov 21, 2017
Publication date	Apr 6, 2021
Grant date	Apr 6, 2021

Abstract

Examples described herein include systems and methods for dynamically determining enrollment requirements and enrolling a user device into a management system. The systems and methods can differ based on the type and version of operating system executing on the user device. With some operating systems, enrollment can be completed through a single application that performs other functionality, such providing single-sign-on access to enterprise resources. With other operating systems, enrollment can be completed by pausing the first application and requiring installation of an agent application to complete enrollment. The determination of how and when to enroll a user device can be done automatically and can be based on an organizational group to which the user belongs.

First claim

What is claimed is:

1. A method for dynamically determining enrollment requirements and enrolling a user device into a management system, comprising:
receiving user credentials at an application installed on the user device, the application not being an agent application dedicated to performing device enrollment;
receiving, at the application, an access token based on the user credentials;
receiving, at the application, an identification of an organizational group to which the user belongs;
receiving a determination as to whether the identified organizational group enables the user device to directly enroll with the management system or requires a dedicated agent application be downloaded to the device to enroll with the management system without using the application for enrollment;
if the identified organizational group enables the user device to directly enroll with the management system, requesting an assessment by a management server that the user device is allowed to enroll at the management server, wherein the assessment is based, at least in part, on restrictions stored at the management server;
receiving the assessment that the user device is allowed to enroll directly with the management server without the use of the dedicated agent application;
displaying, at the user device, a prompt for the user to proceed with enrollment;
enrolling, by the application, the user device with the management server, including sending policies from the management server to the application for enforcement at the user device by the application;
displaying, at the user device, a prompt for the user to select one or more managed applications to install on the user device; and
downloading the managed applications selected by the user.

2. The method of claim 1 , further comprising receiving a determination as to whether the operating system of the user device requires an enterprise feature to be enabled in order to perform direct enrollment, and if so, confirming that the enterprise feature has been enabled for the user device.

3. The method of claim 1 , wherein receiving an identification of an organizational group to which the user device belongs comprises requesting a lookup of the organizational group, based on the user's email address, and receiving a result of the lookup.

4. The method of claim 1 , wherein if the identified organizational group does not enable the user device to directly enroll with the management system, performing stages comprising:
requesting a list of child organizational groups available for the identified organizational group;
receiving, from the user, an indication of at least one of the child organizational groups to which the user belongs;
receiving a determination as to whether the at least one indicated child organizational group enables the user device to directly enroll with the management system; and
if the at least one indicated child organizational group enables the user device to directly enroll with the management system, requesting the assessment by the management server that the user device is allowed to enroll at the management server.

5. The method of claim 4 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises receiving a manual selection, from the user at the UI of the application, of the child organizational group to which the user belongs.

6. The method of claim 4 , wherein receiving a determination as to whether the indicated child organizational group enables the user device to directly enroll with the management system comprises requesting the management server to determine whether the indicated child organizational group enables the user device to directly enroll with the management system.

7. The method of claim 1 , further comprising prompting the user, by the application, to provide a selection indicating whether the user device is corporate owned, and presenting a terms-of-use agreement to the user based on the selection.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a user device, perform stages for dynamically determining enrollment requirements and enrolling the user device into a management system, the stages comprising:
receiving user credentials at an application installed on the user device, the application not being an agent application dedicated to performing device enrollment;
receiving, at the application, an access token based on the user credentials;
receiving, at the application, an identification of an organizational group to which the user belongs;
receiving a determination as to whether the identified organizational group enables the user device to directly enroll with the management system or requires a dedicated agent application be downloaded to the device to enroll with the management system without using the application for enrollment;
if the identified organizational group enables the user device to directly enroll with the management system, requesting an assessment by a management server that the user device is allowed to enroll at the management server, wherein the assessment is based, at least in part, on restrictions stored at the management server;
receiving the assessment that the user device is allowed to enroll directly with the management server without the use of the dedicated agent application;
displaying, at the user device, a prompt for the user to proceed with enrollment;
enrolling, by the application, the user device with the management server, including sending policies from the management server to the application for enforcement at the user device by the application;
displaying, at the user device, a prompt for the user to select one or more managed applications to install on the user device; and
downloading the managed applications selected by the user.

9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising receiving a determination as to whether the operating system of the user device requires an enterprise feature to be enabled in order to perform direct enrollment, and if so, confirming that the enterprise feature has been enabled for the user device.

10. The non-transitory, computer-readable medium of claim 8 , wherein receiving an identification of an organizational group to which the user device belongs comprises requesting a lookup of the organizational group, based on the user's email address, and receiving a result of the lookup.

11. The non-transitory, computer-readable medium of claim 8 , wherein if the identified organizational group does not enable the user device to directly enroll with the management system, performing stages comprising:
requesting a list of child organizational groups available for the identified organizational group;
receiving an indication of at least one of the child organizational groups to which the user belongs;
receiving a determination as to whether the at least one indicated child organizational group enables the user device to directly enroll with the management system; and
if the at least one indicated child organizational group enables the user device to directly enroll with the management system, requesting the assessment by the management server that the user device is allowed to enroll at the management server.

12. The non-transitory, computer-readable medium of claim 11 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises receiving a manual selection from the user, through the application, of the child organizational group to which the user belongs.

13. The n

Assignees

• Vmware Inc

Inventors

• Brouillette Nicholas
• Patel Harit
• Naik Ujwal
• Jain Vinay
• Ravuri Sridevi
• Jain Adarsh
• Shetty Nischit

Classifications

• G06Q50/18 Primary

  Legal services · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• H04L63/102

  Entity profiles · CPC title