IP Library › Granted Patent US 12694078
Granted Patent B2
US 12694078 · App. 18/645,155 · Granted Jul 28, 2026

Enterprise application management with enrollment tokens

Inventors: Clifford Paul Strom (Sammamish, WA); Daniel Kevin Mcbride (Redmond, WA); Arvind Ramakrishnan (Bellevue, WA); Yashraj Motilal Borse (Redmond, WA); Chittaranjan Pattekar (Bothell, WA)
Assignee: Microsoft Technology Licensing, LLC.
G06F21/12G06F21/6281G06F21/645G06F8/61G06F21/00G06F21/16
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12694078
App. No.
18/645,155
Granted
Jul 28, 2026
Kind
B2
Abstract

Embodiments of the disclosure provide application management capabilities to enterprises. A computing device of a user, associated with the enterprise, receives an enrollment token signed with a certificate. The enrollment token includes an enterprise identifier associated with the enterprise. The computing device receives a package containing one or more applications. The package also includes an enterprise identifier. Installation and execution of one or more applications from the received package is accepted or rejected based on a comparison of the enterprise identifier from the enrollment token with the enterprise identifier from the received package or application. A web service provides validation services by monitoring the installation and execution of applications on the computing devices associated with the enterprise.

Claims (66)

1 . A system for managing execution of applications associated with an enterprise, said system comprising:

a mobile computing device comprising:

a memory; and

one or more processors programmed to:

enroll the mobile computing device with the enterprise, the enrolling authorizing the enterprise to send the applications to the mobile computing device;

based at least on enrolling the mobile computing device with the enterprise, receive an enrollment token from the enterprise;

store the enrollment token in the memory;

receive an application from the enterprise;

based at least on a determination that the application is associated with the enrollment token, determine the application is associated with the enterprise that has authorization to send applications to the mobile computing device;

determine that a communication associated with an installation, usage, or validation of the application provided by the enterprise is not successful;

based at least on the determining, change a status of the enrollment token to disabled; and

disable access to applications associated with the enrollment token.

2 . The system of claim 1 , wherein the one or more processors are further programmed to:

based at least on determining that the enrollment token is no longer associated with the application, rejection installation of the application.

3 . The system of claim 1 , wherein based at least on an account state of the mobile computing device being re-enabled, determine the application is associated with the enterprise that has authorization to send applications to the mobile computing device; and

install the application.

4 . The system of claim 2 , wherein the one or more processors are further programmed to:

based at least on determining that the enrollment token is no longer associated with the application, uninstall the application.

5 . The system of claim 1 , wherein the processor is further programmed to:

based at least on the status of the enrollment token being changed to disabled, determine that the enrollment token is no longer associated with the application.

6 . The system of claim 5 , wherein the processor is further programmed to:

based at least on a threshold number of attempts to access the application, change the status of the enrollment token to revoked; and

uninstalled applications associated with the revoked enrollment token.

7 . The system of claim 5 wherein the processor is further programmed to:

based at least on determining that access to the applications provided by the enterprise has been changed to active, determine that the enrollment token is now associated with a second application and install the second application.

8 . A method for managing execution of applications associated with an enterprise, the method comprising:

enrolling a mobile computing device with the enterprise, the enrolling authorizing the enterprise to send the applications to the mobile computing device;

based at least on enrolling the mobile computing device with the enterprise, receiving an enrollment token from the enterprise;

storing the enrollment token in a memory;

receiving an application from the enterprise;

based at least on a determination that the application is associated with the enrollment token, determine the application is associated with the enterprise that has authorization to send applications to the mobile computing device;

determine a communication associated with an installation, usage, or validation of the application provided by the enterprise is not successful;

based at least on the determining, changing a status of the enrollment token to disabled; and

disable access to applications associated with the enrollment token.

9 . The method of claim 8 , further comprising:

based at least on determining that the enrollment token is no longer associated with the application, rejection installation of the application.

10 . The method of claim 8 , further comprising:

wherein based at least on an account state of the mobile computing device being re-enabled, determining the application is associated with the enterprise that has authorization to send applications to the mobile computing device; and

installing the application.

11 . The method of claim 10 , further comprising:

based at least on determining that the enrollment token is no longer associated with the application, uninstall the application.

12 . The method of claim 8 , further comprising

based at least on the status of the enrollment token being changed to disabled, determining that the enrollment token is no longer associated with the application.

13 . The method of claim 12 , further comprising:

based at least on a threshold number of attempts to access the application, change the status of the enrollment token to revoked; and

uninstalled applications associated with the revoked enrollment token.

14 . The method of claim 12 , further comprising based at least on determining that access to the applications provided by the enterprise has been changed to active, determine that the enrollment token is now associated with a second application and install the second application.

15 . One or more computer storage media having computer executable instructions that cause at least one processor to perform operations comprising:

enrolling a mobile computing device with an enterprise, the enrolling authorizing the enterprise to send applications to the mobile computing device;

based at least on enrolling the mobile computing device with the enterprise, receiving an enrollment token from the enterprise;

storing the enrollment token in a memory;

receiving an application from the enterprise;

determine that a communication associated with an installation, usage, or validation of the application provided by the enterprise is not successful;

based at least on the determining, changing a status of the enrollment token to disabled; and

disable access to applications associated with the enrollment token.

16 . The one or more computer storage media of claim 15 , wherein the computer executable instructions further cause the at least one processor to perform operations comprising:

based at least on determining that the enrollment token is no longer associated with the application, rejection installation of the application.

17 . The one or more computer storage media of claim 16 , wherein the computer executable instructions further cause the at least one processor to perform operations comprising:

based at least on an account state of the mobile computing device being re-enabled, determining the application is associated with the enterprise that has authorization to send the applications to the mobile computing device; and

installing the application.

18 . The one or more computer storage media of claim 15 , wherein the computer executable instructions further cause the at least one processor to perform operations comprising based at least on determining that the enrollment token is no longer associated with the application, uninstall the application.

19 . The one or more computer storage media of claim 15 , wherein the computer executable instructions further cause the at least one processor to perform operations comprising:

based at least on the status of the enrollment token being changed to disabled, determine that the enrollment token is no longer associated with the application.

20 . The one or more computer storage media of claim 19 , wherein the computer executable instructions further cause the at least one processor to perform operations comprising:

based at least on a threshold number of attempts to access the application, change the status of the enrollment token to revoked; and

uninstalled applications associated with the revoked enrollment token.