Enterprise firmware management
Examples described herein include systems and methods managing firmware versions of user devices that are enrolled in an enterprise mobility management system. The system can include a management server that sends profiles to enrolled devices, causing those devices to restrict further firmware updates and register with a firmware server. The management server can retrieve available firmware versions and display those in a console. An administrator can select target firmware versions in the console. The management server can the cause the enrolled devices to update to the target firmware versions. This can include sending a call from the management server to the firmware server, causing an automatic update. It can also include sending a command from the management server to an enrolled device, causing the enrolled device to prompt a user prior to requesting a firmware update. This can allow an administrator to prevent user devices from installing firmware updates that could expose the enterprise to security risks or negatively impact operation of enterprise applications.
1. A method for managing firmware versions, the method comprising:
processing a profile received by a user device from a management server, the profile including a restriction payload that comprises a corporate identifier and a flag that enables or disables a firmware update function for the user device;
identifying a current firmware version of the user device;
comparing the current firmware version to a profile-specified firmware version;
performing, in an instance where the current firmware version is the same as the profile-specified firmware version, a series of processes including:
transmitting an identity of the current firmware version to the management server,
disabling the firmware update function of the user device by making an Application Programming Interface (API) call to a firmware server in response to determining that the flag in the profile's restriction payload specifies disabling the firmware update function,
the API call including the corporate identifier and setting the current firmware version as a target firmware version, and causing the user device to register with the firmware server; and
causing, in an instance where the firmware update function is re-enabled, the user device to communicate with one of the management server and the firmware server to obtain a target firmware version for updating the current firmware version based on the profile.
2. The method of claim 1 , further comprising causing the user device to:
display a user prompt seeking user permission to install the target firmware version; and
request the target firmware version from the firmware server by implementing an application programming interface call specified in the profile.
3. The method of claim 1 , further comprising receiving the target firmware version at the user device from the firmware server in an instance where the user device is registered with the firmware server.
4. The method of claim 1 , further comprising causing the user device to impose a restriction on re-enabling the firmware update function that includes requiring an administrative approval.
5. The method of claim 1 , wherein registering with the firmware server includes an application programming interface (“API”) call from the user device to the firmware server, the API call including a credential specified in the profile.
6. The method of claim 1 , further comprising:
installing the target firmware version in place of the current firmware version; and
reporting the installation of the target firmware version to the management server.
7. The method of claim 1 , wherein disabling the firmware update function of the user device includes disabling the firmware update function until a target date.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, perform stages for managing firmware versions, the stages comprising:
processing a profile received by a user device from a management server, the profile including a restriction payload that comprises a corporate identifier and a flag that enables or disables a firmware update function for the user device;
identifying a current firmware version of the user device;
comparing the current firmware version to a profile-specified firmware version;
performing, in an instance where the current firmware version is the same as the profile-specified firmware version, a series of processes including;
transmitting an identity of the current firmware version to the management server,
disabling the firmware update function of the user device by making an Application Programming Interface (API) call to a firmware server in response to determining that the flag in the profile's restriction payload specifies disabling the firmware update function, the API call including the corporate identifier and setting the current firmware version as a target firmware version,
and causing the user device to register with the firmware server; and
causing, in an instance where the firmware update function is re-enabled, the user device to communicate with one of the management server and the firmware server to obtain a target firmware version for updating the current firmware version based on the profile.
9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising causing the first user device to:
display a user prompt seeking user permission to install the target firmware version; and
request the target firmware version from the firmware server by implementing an application programming interface call specified in the profile.
10. The non-transitory, computer-readable medium of claim 8 , the stages further comprising the user device receiving the target firmware version at the user device from the firmware server in an instance where the user device is registered with the firmware server.
11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising causing the user device to impose a restriction on re-enabling the firmware update function that includes requiring an administrative approval.
12. The non-transitory, computer-readable medium of claim 8 , wherein registering with the firmware server includes an application programming interface (“API”) call from the user device to the firmware server, the API call including a credential specified in the profile.
13. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
installing the target firmware version in place of the current firmware version; and
reporting the installation of the target firmware version to the management server.
14. The non-transitory, computer-readable medium of claim 8 , wherein disabling the firmware update function of the user device includes disabling the firmware update function until a target date.
15. A system for managing firmware versions for a group of user devices, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions; and
a user device including a processor that executes the instructions to carry out stages comprising:
processing a profile received by a user device from a management server, the profile including a restriction payload that comprises a corporate identifier and a flag that enables or disables a firmware update function for the user device;
identifying a current firmware version of the user device;
comparing the current firmware version to a profile-specified firmware version;
performing, in an instance where the current firmware version is the same as the profile-specified firmware version, a series of processes including:
transmitting an identity of the current firmware version to the management server, disabling the firmware update function of the user device by making an Application Programming Interface (API) call to a firmware server in response to determining that the flag in the profile's restriction payload specifies disabling the firmware update function, the API call including the corporate identifier and setting the current firmware version as a target firmware version, and causing the user device to register with the firmware server; and
causing, in an instance where the firmware update function is re-enabled, the user device to communicate with one of the management server and the firmware server to obtain a target firmware version for updating the current firmware version based on the profile.
16. The system of claim 15 , the stages further comprising causing the first user device to:
display a user prompt seeking user permission to install the target firmware version; and
request the target firmware version from the firmware server by implementing an application programming interface call specified in the profile.
17. The system of claim 15 , the stages further comprising receiving the target firmware version at the user device from the firmware server in an instance where the user device is registered with the firmware server.
18. The system of claim 15 , further comprising causing the user device to impose a restriction on re-enabling the firmware update function that includes requiring an administrative approval.
19. The system of claim 15 , wherein registering with the firmware server includes an application programming interface (“API”) call from the user device to the firmware server, the API call including a credential specified in the profile.
20. The system of claim 15 , that stages further comprising:
installing the target firmware version in place of the current firmware version; and
reporting the installation of the target firmware version to the management server.