Native enrollment of mobile devices

1. A system for native enrollment of mobile devices, comprising:

a computing device comprising a processor and a memory;

a management service comprising machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:

receive a first message from a management agent executing on a client device, wherein the first message comprises an enrollment request for the client device;

send a protection agent to the client device in response to receipt of the enrollment request, wherein the protection agent is to be installed on the client device and the protection agent monitors for and prevents attempts to remove or modify the management agent;

receive a second message from the protection agent executing on the client device, wherein the second message comprises an authentication request;

provide authentication credentials to the protection agent executing on the client device in response to the second message;

receive a third message from the protection agent executing on the client device, wherein the third message comprises an enrollment confirmation for the client device;

change an enrollment status of the client device; and

send to the protection agent executing on the client device a policy assigned to the client device, the policy specifying a configuration option of the client device to be enforced during operation of the client device.

2. The system of claim 1 , wherein the management service further causes the computing device to at least send a one-time authentication (OTA) token to the client device along with the third application.

3. The system of claim 1 , wherein the management service further causes the computing device to at least:

identify a user account included in the enrollment request from the client device;

send a request for a phone number to the client device;

receive the phone number from the client device; and

identify whether the client device has been previously enrolled based on the phone number.

4. The system of claim 1 , wherein the management service further causes the computing device to at least add a device record for the client device to a list of linked devices in a user account associated with a user of the client device.

5. The system of claim 1 , wherein the enrollment status is changed from a pending status to an enrolled status.

6. The system of claim 1 , wherein the first message complies with a version of the Open Mobile Alliance Device Management (OMA-DM) protocol.

7. The system of claim 1 , wherein the authentication credentials comprise a hash-based message authentication code (HMAC) token.

8. A method, comprising:

receiving a first message from a management agent executing on a client device, wherein the first message comprises an enrollment request for the client device;

sending a protection agent to the client device in response to receipt of the enrollment request, wherein the protection agent is to be installed on the client device and the protection agent monitors for and prevents attempts to remove or modify the management agent;

receiving a second message from the protection agent executing on the client device, wherein the second message comprises an authentication request;

providing authentication credentials to the protection agent executing on the client device in response to receiving the second message;

receiving a third message from the protection agent executing on the client device, wherein the third message comprises an enrollment confirmation for the client device;

changing an enrollment status of the client device; and

sending to the protection agent executing on the client device a policy assigned to the client device, the policy specifying a configuration option of the client device to be enforced during operation of the client device.

9. The method of claim 8 , further comprising sending a one-time authentication (OTA) token to the client device along with the protection agent.

10. The method of claim 8 , further comprising:

identifying a user account included in the enrollment request from the client device;

sending a request for a phone number to the client device;

receiving the phone number from the client device; and

identifying whether the client device has been previously enrolled based on the phone number.

11. The method of claim 8 , further comprising adding a device record for the client device to a list of linked devices in a user account associated with a user of the client device.

12. The method of claim 8 , wherein the enrollment status is changed from a pending status to an enrolled status.

13. The method of claim 8 , wherein the first message complies with a version of the Open Mobile Alliance Device Management (OMA-DM) protocol.

14. The method of claim 8 , wherein the authentication credentials comprise a hash-based message authentication code (HMAC) token.

15. A non-transitory computer readable medium comprising machine readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:

receive a first message from a management agent executing on a client device, wherein the first message comprises an enrollment request for the client device;

send a protection agent to the client device in response to receipt of the enrollment request, wherein the protection agent is to be installed on the client device and the protection agent monitors for and prevents attempts to remove or modify the management agent;

receive a second message from the protection agent executing on the client device, wherein the second message comprises an authentication request;

provide authentication credentials to the protection agent executing on the client device in response to receipt of the second message;

receive a third message from the protection agent executing on the client device, wherein the third message comprises an enrollment confirmation for the client device;

change an enrollment status of the client device; and

send to the protection agent executing on the client device a policy assigned to the client device, the policy specifying a configuration option of the client device to be enforced during operation of the client device.

16. The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least send a one-time authentication (OTA) token to the client device along with the protection agent.

17. The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least:

identify a user account included in the enrollment request from the client device;

send a request for a phone number to the client device;

receive the phone number from the client device; and

identify whether the client device has been previously enrolled based on the phone number.

18. The non-transitory computer readable medium of claim 15 , wherein the enrollment status is changed from a pending status to an enrolled status.

19. The non-transitory computer readable medium of claim 15 , wherein the first message complies with a version of the Open Mobile Alliance Device Management (OMA-DM) protocol.

20. The non-transitory computer readable medium of claim 15 , wherein the authentication credentials comprise a hash-based message authentication code (HMAC) token.