Adaptive device enrollment

• US 10,798,103 B2
• Filed: 11/21/2017
• Issued: 10/06/2020
• Est. Priority Date: 11/21/2017
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Vwware Incorporated
• Inventors: Brouillette, Nicholas, Patel, Harit, Naik, Ujwal, Jain, Vinay, Ravuri, Sridevi, Jain, Adarsh, Shetty, Nischit
• Primary Examiner(s): Nguyen, Thu Ha T
• Application Number:
  US15/818,797
• Publication Number:
  US 20190158506A1
• Time in Patent Office: 1,050 Days
• Field of Search: 709220, 709221, 709223, 709224
• CPC Class Codes: G06Q 10/0639 Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Examples described herein include systems and methods for dynamically determining enrollment requirements and enrolling a user device into a management system. The systems and methods can differ based on the type and version of operating system executing on the user device. With some operating systems, enrollment can be completed through a single application that performs other functionality, such providing single-sign-on access to enterprise resources. With other operating systems, enrollment can be completed by pausing the first application and requiring installation of an agent application to complete enrollment. The determination of how and when to enroll a user device can be done automatically and can be based on an organizational group to which the user belongs.

Claims

1. A method for dynamically determining enrollment requirements and enrolling a user device into a management system, comprising:

receiving user credentials at an application installed on the user device, the application not being an agent application dedicated to perform device enrollment;

receiving, at the application, an access token based on the user credentials;

receiving, at the application, an identification of an organizational group to which the user belongs;

receiving a determination that the user device is not able to directly enroll with the management system through the application based, at least in part, on one or more attributes associated with the user or the user device;

pausing a UI of the application and redirecting the user to download the agent application;

installing the agent application;

passing the user credentials from the application to the agent application;

enrolling, by the agent application, the user device with the management server;

unpausing the UI of the application;

displaying, at the user device, a prompt for the user to select one or more managed applications to install on the user device; and

downloading the managed applications selected by the user.

2. The method of claim 1, wherein receiving the determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the operating system of the user device requires an enterprise feature to be enabled in order to perform direct enrollment, and that the enterprise feature has not been enabled for the user device.

3. The method of claim 1, wherein receiving the determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the identified organizational group does not enable the user device to directly enroll.

4. The method of claim 1, wherein receiving an identification of an organizational group to which the user belongs further comprises:

requesting a list of child organizational groups available for the identified organizational group; and

receiving an indication of at least one of the child organizational groups to which the user belongs.

5. The method of claim 4, wherein receiving a determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the at least one indicated child organizational group does not enable the user device to directly enroll.

6. The method of claim 5, wherein receiving a determination that the at least one indicated child organizational group does not enable the user device to directly enroll comprises receiving a determination from the management server that the indicated child organizational group does not enable the user device to directly enroll.

7. The method of claim 1, further comprising prompting the user, at a UI of the agent application, to provide a selection indicating whether the user device is corporate owned, and presenting a terms-of-use agreement to the user, on the agent application UI, based on the selection.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a user device, perform stages for dynamically determining enrollment requirements and enrolling the user device into a management system, the stages comprising:

receiving user credentials at an application installed on the user device, the application not being an agent application dedicated to perform device enrollment;

receiving, at the application, an access token based on the user credentials;

receiving, at the application, an identification of an organizational group to which the user belongs;

receiving a determination that the user device is not able to directly enroll with the management system through the application based, at least in part, on one or more attributes associated with the user or the user device;

pausing a UI of the application and redirecting the user to download an agent application;

installing the agent application;

passing the user credentials from the application to the agent application;

enrolling, by the agent application, the user device with the management server;

unpausing the UI of the application;

displaying, at the user device, a prompt for the user to select one or more managed applications to install on the user device; and

downloading the managed applications selected by the user.

9. The non-transitory, computer-readable medium of claim 8, wherein receiving a determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the operating system of the user device requires an enterprise feature to be enabled in order to perform direct enrollment, and that the enterprise feature has not been enabled for the user device.

10. The non-transitory, computer-readable medium of claim 8, wherein receiving the determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the identified organizational group does not enable the user device to directly enroll.

11. The non-transitory, computer-readable medium of claim 8, wherein receiving an identification of an organizational group to which the user belongs further comprises:

requesting a list of child organizational groups available for the identified organizational group; and

receiving an indication of at least one of the child organizational groups to which the user belongs.

12. The non-transitory, computer-readable medium of claim 11, wherein receiving a determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the at least one indicated child organizational group does not enable the user device to directly enroll.

13. The non-transitory, computer-readable medium of claim 12, wherein receiving a determination that the at least one indicated child organizational group does not enable the user device to directly enroll comprises receiving a determination from the management server that the indicated child organizational group does not enable the user device to directly enroll.

14. The non-transitory, computer-readable medium of claim 8, the stages further comprising prompting the user, at the agent application, to provide a selection indicating whether the user device is corporate owned, and presenting a terms-of-use agreement to the user, at the agent application, based on the selection.

15. A system for dynamically determining enrollment requirements and enrolling a user device into a management system, comprising:

a user device having a processor, display, and memory storage;

wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising;

receiving user credentials at an application installed on the user device, the application not being an agent application dedicated to perform device enrollment;

receiving, at the application, an access token based on the user credentials;

receiving, at the application, an identification of an organizational group to which the user belongs;

receiving a determination that the user device is not able to directly enroll with the management system through the application based, at least in part, on one or more attributes associated with the user or the user device;

pausing a UI of the application and redirecting the user to download an agent application;

installing the agent application;

passing the user credentials from the application to the agent application;

enrolling, by the agent application, the user device with the management server;

unpausing the UI of the application;

displaying, at the user device, a prompt for the user to select one or more managed applications to install on the user device; and

downloading the managed applications selected by the user.

16. The system of claim 15, wherein receiving the determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the operating system of the user device requires an enterprise feature to be enabled in order to perform direct enrollment, and that the enterprise feature has not been enabled for the user device.

17. The system of claim 15, wherein receiving the determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the identified organizational group does not enable the user device to directly enroll.

18. The system of claim 15, wherein receiving an identification of an organizational group to which the user belongs further comprises:

requesting a list of child organizational groups available for the identified organizational group; and

receiving an indication of at least one of the child organizational groups to which the user belongs.

19. The system of claim 18, wherein receiving a determination that the user device is not able to directly enroll with the management system through the application further comprises receiving a determination that the at least one indicated child organizational group does not enable the user device to directly enroll.

20. The system of claim 15, further comprising prompting the user, at a UI of the agent application, to provide a selection indicating whether the user device is corporate owned, and presenting a terms-of-use agreement to the user, on the agent application UI, based on the selection.