Deploying data-loss-prevention policies to user devices

1. A method for deploying Data Loss Prevention (DLP) policies to a user device, comprising:

receiving, at a management server that exercises management control over the user device and with which the user device is enrolled, a configuration that specifies at least one DLP policy applicable to an application;

receiving, at the management server, an indication of an assignment group specifying a plurality of user devices to which the at least one DLP policy should be applied;

updating, by the management server, a record of the assignment group;

synchronizing the record of the assignment group with an identity service;

sending an instruction, from the management server to a second server that manages the application by providing policies and instructions to the application, causing the second server to implement the at least one DLP policy for the plurality of user devices in the assignment group, wherein the at least one DLP policy identifies and applies to a plurality of applications executing on the user device and managed by the second server; and

provisioning the application to a user device, wherein provisioning comprises the management server instructing the user device to retrieve the DLP policy from the second server and implement the DLP policy at the provisioned application.

2. The method of claim 1 , wherein the identity service synchronizes with the second server.

3. The method of claim 1 , wherein the user device retrieves the DLP policy from the second server based on the second server identifying the retrieving user device as being associated with the assignment group.

4. The method of claim 1 , wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy.

5. The method of claim 1 , wherein the configuration is received through a graphical user interface (“GUI”) associated with an administrator console that allows an administrator to associate a DLP policy to the application.

6. The method of claim 1 , wherein the indication of an assignment group is based on information entered through a graphical user interface (“GUI”) associated with an administrator console in communication with the management server.

7. The method of claim 1 , wherein provisioning comprises inserting a command into a command queue that is checked by the user device, the command instructing the user device to download and install the application.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a management server that exercises management control over a user device and with which the user device is enrolled, cause the management server to perform stages for deploying Data Loss Prevention (DLP) policies to the user device, the stages comprising:

receiving, at the management server, a configuration that specifies at least one DLP policy applicable to an application;

receiving, at the management server, an indication of an assignment group specifying a plurality of user devices to which the at least one DLP policy should be applied;

updating, by the management server, a record of the assignment group;

synchronizing the record of the assignment group with an identity service;

sending an instruction, from the management server to a second server that manages the application by providing policies and instructions to the application, causing the second server to implement the at least one DLP policy for the plurality of user devices in the assignment group, wherein the at least one DLP policy identifies and applies to a plurality of applications executing on the user device and managed by the second server; and

provisioning the application to a user device, wherein provisioning comprises the management server instructing the user device to retrieve the DLP policy from the second server and implement the DLP policy at the provisioned application.

9. The non-transitory, computer-readable medium of claim 8 , wherein the identity service synchronizes with the second server.

10. The non-transitory, computer-readable medium of claim 8 , wherein the user device retrieves the DLP policy from the second server based on the second server identifying the retrieving user device as being associated with the assignment group.

11. The non-transitory, computer-readable medium of claim 8 , wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy.

12. The non-transitory, computer-readable medium of claim 8 , wherein the configuration is received through a graphical user interface (“GUI”) associated with an administrator console that allows an administrator to associate a DLP policy to the application.

13. The non-transitory, computer-readable medium of claim 8 , wherein the indication of an assignment group is based on information entered through a graphical user interface (“GUI”) associated with an administrator console in communication with the management server.

14. The non-transitory, computer-readable medium of claim 8 , wherein provisioning comprises inserting a command into a command queue that is checked by the user device, the command instructing the user device to download and install the application.

15. A system for deploying Data Loss Prevention (DLP) policies to a user device, comprising:

a memory storage including a non-transitory, computer-readable medium comprising instructions; and

a computing device including a processor that executes the instructions to carry out stages comprising:

receiving, at a management server that exercises management control over the user device and with which the user device is enrolled, a configuration that specifies at least one DLP policy applicable to an application;

receiving, at the management server, an indication of an assignment group specifying a plurality of user devices to which the at least one DLP policy should be applied;

updating, by the management server, a record of the assignment group;

synchronizing the record of the assignment group with an identity service;

sending an instruction, from the management server to a second server that manages the application by providing policies and instructions to the application, causing the second server to implement the at least one DLP policy for the plurality of user devices in the assignment group, wherein the at least one DLP policy identifies and applies to a plurality of applications executing on the user device and managed by the second server; and

provisioning the application to a user device, wherein provisioning comprises the management server instructing the user device to retrieve the DLP policy from the second server and implement the DLP policy at the provisioned application.

16. The system of claim 15 , wherein the identity service synchronizes with the second server.

17. The system of claim 15 , wherein the user device retrieves the DLP policy from the second server based on the second server identifying the retrieving user device as being associated with the assignment group.

18. The system of claim 15 , wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy.

19. The system of claim 15 , wherein the configuration is received through a graphical user interface (“GUI”) associated with an administrator console that allows an administrator to associate a DLP policy to the application.

20. The system of claim 15 , wherein the indication of an assignment group is based on information entered through a graphical user interface (“GUI”) associated with an administrator console in communication with the management server.