Adaptive device enrollment
Examples described herein include systems and methods for dynamically determining enrollment requirements and enrolling a user device into a management system. The systems and methods can differ based on the type and version of operating system executing on the user device. With some operating systems, enrollment can be completed through a single application that performs other functionality, such providing single-sign-on access to enterprise resources. With other operating systems, enrollment can be completed by pausing the first application and requiring installation of an agent application to complete enrollment. The determination of how and when to enroll a user device can be done automatically and can be based on an organizational group to which the user belongs.
1. A method for enrolling a user device with a management system using a portal application, comprising:
receiving, at a management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user's credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
in response to selection of the selected application, establishing management control over the user device by:
requesting, by the portal application, enrollment of the user device with the management server;
receiving, at the portal application, policies from the management server and
enforcing, at the portal application, the policies with respect to the selected application.
2. The method of claim 1 , further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.
3. The method of claim 1 , wherein the policies include compliance rules for the user device to comply with.
4. The method of claim 1 , wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.
5. The method of claim 1 , wherein enrolling comprises sending an access token from the management server to the portal application.
6. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, perform stages for enrolling a user device with a management system using a portal application, the stages comprising:
receiving, at a management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user's credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
in response to selection of the selected application, establishing management control over the user device by:
requesting, by the portal application, enrollment of the user device with the management server;
receiving, at the portal application, policies from the management server and
enforcing, at the portal application, the policies with respect to the selected application.
7. The non-transitory, computer-readable medium of claim 6 , the stages further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.
8. The non-transitory, computer-readable medium of claim 6 , wherein the policies include compliance rules for the user device to comply with.
9. The non-transitory, computer-readable medium of claim 6 , wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.
10. The non-transitory, computer-readable medium of claim 6 , wherein enrolling comprises sending an access token from the management server to the portal application.
11. A system for enrolling a user device with a management system using a portal application, comprising:
a management server having a processor, display, and memory storage;
wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising:
receiving, at the management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user's credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
in response to selection of the selected application, establishing management control over the user device by:
requesting, by the portal application, enrollment of the user device with the management server;
receiving, at the portal application, policies from the management server and
enforcing, at the portal application, the policies with respect to the selected application.
12. The system of claim 11 , the stages further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.
13. The system of claim 11 , wherein the policies include compliance rules for the user device to comply with.
14. The system of claim 11 , wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.
15. The system of claim 11 , wherein enrolling comprises sending an access token from the management server to the portal application.