Linking multiple enrollments on a client device
Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.
1. A non-transitory computer-readable medium embodying a program executed by a computing device for facilitating multiple enrollments of a client device as a managed device, wherein the program is configured to cause the computing device to at least:
initiate a first enrollment of the client device with a management service, wherein the first enrollment is associated with a first device identifier corresponding to the client device;
cause a management component to be installed on the client device through the management service;
transmit a management profile to the client device, the management profile causing the management component to generate a user prompt that initiates a second enrollment of the client device with the management service;
in response to a first user login at the user prompt, initiate the second enrollment of the client device with the management service, the second enrollment being initiated by the management component and being associated with a second device identifier;
in response to a second user login, remove the second enrollment of the client device by disassociating the second device identifier from the client device; and
in response to the second user login, initiate a third enrollment with the management service, the third enrollment being performed by the management component and being associated with a third device identifier.
2. The non-transitory computer-readable medium of claim 1 , wherein the first enrollment and the second enrollment are linked together in a device record stored in a data store accessible to the computing device.
3. The non-transitory computer-readable medium of claim 1 , wherein the program further causes the computing device to at least create a first managed workspace within the client device, the first managed workspace being associated with the second enrollment with the management service, wherein the first managed workspace is inaccessible by an application stored external to the first managed workspace on the client device.
4. The non-transitory computer-readable medium of claim 3 , wherein the program further causes the computing device to at least deploy at least one of an application, a configuration profile, or a policy to the client device through the management service, wherein the at least one of the application, the configuration profile, or the policy is stored within the first managed workspace.
5. The non-transitory computer-readable medium of claim 3 , wherein the program further causes the computing device to at least remove the second enrollment of the client device by deleting data stored within the first managed workspace.
6. The non-transitory computer-readable medium of claim 5 , wherein the program further causes the computing device to at least create a second managed workspace within the client device in response to the second user login, the second managed workspace being associated with the third enrollment with the management service, wherein the second managed workspace is inaccessible by an application stored external to the second managed workspace.
7. The non-transitory computer-readable medium of claim 1 , wherein the program further causes the computing device to at least deploy at least one of an application, a configuration profile, or a policy to the client device through the management service, wherein the at least one of the application, the configuration profile, or the policy remains on the client device in response to the second user login.
8. A method for providing multiple enrollments of a client device as a managed device, comprising:
initiating a first enrollment of the client device with a first management service, wherein the first enrollment is associated with a first device identifier corresponding to the client device;
causing a management component to be installed on the client device through the first management service;
transmitting a management profile to the client device, the management profile causing the management component to generate a user prompt that initiates enrollment of the client device with a second management service;
in response to a first user login at the user prompt, initiating a second enrollment of the client device with a second management service, the second enrollment being performed by the management component and being associated with a second device identifier;
in response to a second user login, removing the second enrollment of the client device by disassociating the second device identifier from the client device; and
in response to the second user login, initiating a third enrollment with the second management service, the third enrollment being performed by the management component and being associated with a third device identifier.
9. The method of claim 8 , further comprising linking together the first enrollment and the second enrollment in a device record stored in a data store.
10. The method of claim 8 , further comprising creating a first managed workspace within the client device, the first managed workspace being associated with the second enrollment with the second management service, wherein the first managed workspace is inaccessible by an application stored external to the first managed workspace on the client device.
11. The method of claim 10 , further comprising deploying at least one of an application, a configuration profile, or a device policy to the client device through the second management service, wherein the at least one of the application, the configuration profile, or the device policy is stored within the first managed workspace.
12. The method of claim 10 , further comprising removing the second enrollment of the client device by deleting data stored within the first managed workspace.
13. The method of claim 12 , further comprising creating a second managed workspace within the client device in response to the second user login, the second managed workspace being associated with the third enrollment with the second management service, wherein the second managed workspace is inaccessible by an application stored external to the second managed workspace.
14. The method of claim 8 , further comprising deploying at least one of an application, a configuration profile, or a device policy to the client device through the first management service, wherein the at least one of the application, the configuration profile, or the device policy remains on the client device in response to the second user login.
15. A system for providing multiple enrollments of a client device as a managed device, comprising:
at least one computing device; and
a management service executable by the at least one computing device, wherein the management service causes the at least one computing device to at least:
initiate a first enrollment of the client device with a first management service, wherein the first enrollment is associated with a first device identifier corresponding to the client device;
cause a management component to be installed on the client device through the first management service;
transmit a management profile to the client device, the management profile causing the management component to generate a user prompt that initiates enrollment of the client device with a second management service;
in response to a first user login at the user prompt, initiate a second enrollment of the client device with a second management service, the second enrollment being performed by the management component and being associated with a second device identifier;
in response to a second user login, remove the second enrollment of the client device by disassociating the second device identifier from the client device; and
in response to the second user login, initiate a third enrollment with the second management service, the third enrollment being performed by the management component and being associated with a third device identifier.
16. The system of claim 15 , wherein the management service links together the first enrollment and the second enrollment in a device record stored in a data store accessible to the at least one computing device.
17. The system of claim 15 , wherein the management service causes the at least one computing device to at least create a first managed workspace within the client device, the first managed workspace being associated with the second enrollment with the second management service, wherein the first managed workspace is inaccessible by an application stored external to the first managed workspace on the client device.
18. The system of claim 17 , wherein the management service causes the at least one computing device to at least deploy at least one of an application, a configuration profile, or a device policy to the client device through the second management service, wherein the at least one of the application, the configuration profile, or the device policy is stored within the first managed workspace.
19. The system of claim 17 , wherein the management service causes the at least one computing device to at least remove the second enrollment of the client device by deleting data stored within the first managed workspace.
20. The system of claim 19 , wherein the management service further causes the at least one computing device to at least create a second managed workspace within the client device in response to the second user login, the second managed workspace being associated with the third enrollment with the management service, wherein the second managed workspace is inaccessible by an application stored external to a third managed workspace.