Adaptive device enrollment
Examples described herein include systems and methods for dynamically determining enrollment requirements and enrolling a user device into a management system. The systems and methods can differ based on the type and version of operating system executing on the user device. With some operating systems, enrollment can be completed through a single application that performs other functionality, such providing single-sign-on access to enterprise resources. With other operating systems, enrollment can be completed by pausing the first application and requiring installation of an agent application to complete enrollment. The determination of how and when to enroll a user device can be done automatically and can be based on an organizational group to which the user belongs.
1. A method for determining enrollment requirements for enrolling a user into a management system, comprising:
receiving, at a portal application installed on the user device, an identification of an organizational group to which the user belongs, the portal application not being an agent application dedicated to performing device enrollment, wherein the portal application stores a user's credentials and displays icons corresponding to a plurality of applications available to the user, and wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
receiving a determination as to whether the identified organizational group enables the portal application to enroll with the management system or, instead of enrolling the device using the portal application, requires a dedicated agent application be downloaded to the user device to enroll with the management system; and
if the identified organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application and receiving policies from the management server at the portal application for enforcement at the user device by the portal application.
2. The method of claim 1 , further comprising if the identified organizational group does not enable the portal application to enroll with the management system:
requesting, by the portal application, a list of child organizational groups available for the identified organizational group;
receiving an indication of at least one of the child organizational groups to which the user belongs;
receiving a determination as to whether the at least one indicated child organizational group enables the portal application to enroll with the management system; and
if the at least one indicated child organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application.
3. The method of claim 2 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises receiving a manual selection from the user at a UI of the portal application.
4. The method of claim 2 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises requesting a lookup of the child organizational group, based on information associated with the user, and receiving a result of the lookup.
5. The method of claim 1 , wherein receiving an identification of an organizational group to which the user device belongs comprises requesting a lookup of the organizational group, based on the user's email address, and receiving a result of the lookup.
6. The method of claim 1 , wherein requesting enrollment by the portal application includes prompting the user, by the portal application, to provide a selection indicating whether the user device is corporate owned.
7. The method of claim 6 , wherein requesting enrollment by the portal application further includes presenting a terms-of-use agreement to the user based on the selection indicating whether the user device is corporate owned.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, perform stages for enrolling a user device with a management system using a portal application, the stages comprising:
receiving, at the portal application installed on the user device, an identification of an organizational group to which the user belongs, the portal application not being an agent application dedicated to performing device enrollment, wherein the portal application stores a user's credentials and displays icons corresponding to a plurality of applications available to the user, and wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
receiving a determination as to whether the identified organizational group enables the portal application to enroll with the management system or, instead of enrolling the device using the portal application, requires a dedicated agent application be downloaded to the user device to enroll with the management system; and
if the identified organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application and receiving policies from the management server at the portal application for enforcement at the user device by the portal application.
9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising, if the identified organizational group does not enable the portal application to enroll with the management system:
requesting, by the portal application, a list of child organizational groups available for the identified organizational group;
receiving an indication of at least one of the child organizational groups to which the user belongs;
receiving a determination as to whether the at least one indicated child organizational group enables the portal application to enroll with the management system; and
if the at least one indicated child organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application.
10. The non-transitory, computer-readable medium of claim 9 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises receiving a manual selection from the user at a UI of the portal application.
11. The non-transitory, computer-readable medium of claim 9 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises requesting a lookup of the child organizational group, based on information associated with the user, and receiving a result of the lookup.
12. The non-transitory, computer-readable medium of claim 8 , wherein receiving an identification of an organizational group to which the user device belongs comprises requesting a lookup of the organizational group, based on the user's email address, and receiving a result of the lookup.
13. The non-transitory, computer-readable medium of claim 8 , wherein requesting enrollment by the portal application includes prompting the user, by the portal application, to provide a selection indicating whether the user device is corporate owned.
14. The non-transitory, computer-readable medium of claim 13 , wherein requesting enrollment by the portal application further includes presenting a terms-of-use agreement to the user based on the selection indicating whether the user device is corporate owned.
15. A system for enrolling a user device with a management system using a portal application, comprising:
a management server having a processor, display, and memory storage;
wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising:
receiving, at the portal application installed on the user device, an identification of an organizational group to which the user belongs, the portal application not being an agent application dedicated to performing device enrollment, wherein the portal application stores a user's credentials and displays icons corresponding to a plurality of applications available to the user, and wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;
receiving a determination as to whether the identified organizational group enables the portal application to enroll with the management system or, instead of enrolling the device using the portal application, requires a dedicated agent application be downloaded to the user device to enroll with the management system; and
if the identified organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application and receiving policies from the management server at the portal application for enforcement at the user device by the portal application.
16. The system of claim 15 , the stages further comprising, if the identified organizational group does not enable the portal application to enroll with the management system:
requesting, by the portal application, a list of child organizational groups available for the identified organizational group;
receiving an indication of at least one of the child organizational groups to which the user belongs;
receiving a determination as to whether the at least one indicated child organizational group enables the portal application to enroll with the management system; and
if the at least one indicated child organizational group enables the portal application to enroll with the management system, requesting enrollment by the portal application.
17. The system of claim 16 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises receiving a manual selection from the user at a UI of the portal application.
18. The system of claim 16 , wherein receiving the indication of the at least one of the child organizational groups to which the user belongs comprises requesting a lookup of the child organizational group, based on information associated with the user, and receiving a result of the lookup.
19. The system of claim 15 , wherein requesting enrollment by the portal application includes prompting the user, by the portal application, to provide a selection indicating whether the user device is corporate owned.
20. The system of claim 19 , wherein requesting enrollment by the portal application further includes presenting a terms-of-use agreement to the user based on the selection indicating whether the user device is corporate owned.