Abstract: Disclosed are various examples for the dynamic construction of configuration profiles using settings common across different operating systems. A computing environment having a management service can determine variable names for inclusion in configuration profiles based on operating systems. The computing environment can dynamically generate configuration profiles using the appropriate variable names such that the value provided by an administrator is a value or parameter of the variable name for deployment to a client device having an operating system capable of interpreting the value using the variable name.

Abstract: Computer networks for secure demand-driven file distribution are described. In one example, a client device receives a notification to check in for updates. In response, the client device checks in with a device services computing device on a computer network. The device services computing device determines a path list to certain cache computing devices on the computer network for receipt of the files, builds a markup file including the path list to the files, and transmits the markup file to the client device. The markup file can also include unique identifiers of the files and an encryption key for secure distribution of the files. Using the markup file, the client device can request the files, and the computer network is physically and logically arranged to distribute the files among the cache computing devices and to the client device in a secure and demand-driven manner.

Abstract: Systems and methods herein provide for improved handling of oversized email attachments. An example system can identify an oversized email attachment before an email is sent, by comparing the size of the attachment to a maximum file size at an email server. The user can then be notified that the attachment is over the allowable file size before sending the email. The system can also un-attach the oversized file, compress it using a suitable compression method, and reattach a compressed file. The compression can be done at the sender's request or automatically.

Abstract: The disclosure relates to detecting vulnerabilities in managed client devices. A system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Abstract: Systems herein allow a student to share media with other students in a classroom with the permission of a teacher. The student can send a sharing request to a management server with a sender student device. The management server can identify a teacher device and send the sharing request to the teacher device for approval. When the request is granted, the student device can supply an address local to the sender device, from which the media will stream. The management server can send the address and an authentication token to other recipient student devices. The management server can further lock the recipient student devices into the sharing location to ensure that each student device will stream the media. At the request of the teacher device or the sender student device, the streaming can end.

Abstract: Disclosed are various examples for staging client devices. In one example, a computing device identifies a user profile logged in a client device based on receiving a profile identifier from a management component executed on the client device. The computing device determines that user profile is to be unmanaged by a management service based on a list of associated user profiles for the client device. A message is transmitted to the client device. The message causes the management component to refrain from enforcing a plurality of policies of the management service on the client device.

Abstract: Disclosed are various examples for multi-party authentication and authentication. In one example, a user can gain access to secured data stored by a managed device based on the presence of the minimum quantity of other users within a threshold proximity of the user who desires access.

Abstract: Disclosed are various approaches for dynamically integrating a client application with multiple third-party services. An integration service receives a request to perform an action relative to a particular third-party service from a client device. The request is received through a first application programming interface (API) generic to a plurality of third-party services. The integration service communicates with the particular third-party service to perform the action using a second API specific to the particular third-party service. The integration service sends a response to the client device through the first API. The response is based at least in part on a result of the action and includes an indication of one of a plurality of predefined user interfaces.

Abstract: Disclosed are various examples for client device migration. In one example, a migration application provides status update information for a migration of the client device from the first management service to a second management service that is performed by the migration application. Migration actions include an un-enrollment request transmitted to the first management service and an enrollment request transmitted to the second management service. The migration application updates the status update information as the migration progresses.

Abstract: The secure management of attachments is described. In one example, files are identified for attachment to a message through a secure content application extension. Rather than directly attaching the files to the message, a resource locator or link to the files is generated, and the resource locator is inserted into the message. The message is then forwarded for distribution to client devices based on an addressee list for the message. The distribution of and access to the files is managed separately by a management service. The management service can notify the client devices to retrieve the files based on a file access schedule. At each of the client devices, users can access the files through a secure content file application extension using the resource locator during the file access schedule. Thus, the files are distributed through secure content file applications and not as direct attachments to messages.

Abstract: Disclosed are various examples for client device migration. In one example, a migration service identifies migration data to migrate a client device from a first management service to a second management service. The migration service transmits a management data request to the first management service, and temporarily stores management data retrieved based on the request. The management data indicates an organizational group. The migration service creates the organizational group with the second management service to facilitate migration of the client device to the second management service.

Abstract: Disclosed are various examples for enrolling a client device and synchronizing user attributes for the client device across multiple directory services. A search request for user attributes can be sent to a first directory service with an identifier for a user account. The first directory service can query for the identifier and send back user attributes. If a global identifier is included in the attributes, another search request for user attributes can be sent to a second directory service with the global identifier. The second directory service can query for the global identifier and send back user attributes.

Abstract: Disclosed are various examples for configuring network security based on device management characteristics. In one example, a specification of a set of network resources on an internal network is received from an administrator client. The set of network resources are those network resources that a particular application executed in client devices on an external network should be authorized to access. A gateway from the external network to the internal network is then configured to permit the particular application to have access to the set of network resources.

Abstract: Disclosed are various embodiments for enforcing device compliance parameters by inhibiting access to devices, networks or resources. In one embodiment, among others, a computing device identifies a request to access a first resource and determines that a second resource is associated with accessing the first resource based on a resource group identifier. The computing device determines that a compliance rule is associated with the first resource and the second resource based on the resource group identifier. The client device can determine that the compliance rule has been violated. Then, the computing device determines that the compliance rule is associated with an alternative setting and changes the current setting to the alternative setting.

Abstract: Systems and methods are included for detecting driving based on user-specific models for driving detection, and restricting access to an application of the user device while a user is driving. A management agent installed on the user device can collect data from sensors in a user device and provide the data to a management server, which can build a user-specific model for driving detection for that user. The management agent can then use that user-specific model for detecting when the user is driving. When the agent determines that the user is driving, it can enforce a driving policy that limits access to applications and delay or modify notifications generated by applications.

Abstract: A server device obtains a search term from a client device that is managed by an enterprise. A user associated with the client device is identified. Search index data that specifies a location for a term and a contextual boundary for the term is obtained. A search result that is based on the search index data and the role of the user for the enterprise is generated.

Abstract: Location-based configuration profile toggling may be provided. Configuration profiles associated with user devices may be identified, determinations of whether the user devices are authorized to enable the configuration profiles on the user devices may be made based at least in part on location constraints, and the configuration profiles may be enabled an the user devices if the location constraints are satisfied.

Abstract: Systems herein include a managed content application that can place markers for conversations within secure documents. A separate social application can serve as the platform for the conversations, allowing for efficient conversations that can occur in real time. The markers can be stored with the documents and identify the conversation, allowing users to retrieve historical conversations that occurred on the social application from within the document. This can allow users to quickly come up to speed without having to rehash the conversations with the original participants. Document security can also be maintained without sacrificing conversation efficiency of the social application.

Abstract: Disclosed are various approaches for validating public keys pinned to services or servers on private networks. A client device can request a first certificate from a trust service. The client device can then validate that the first certificate from the trust service is signed by a preinstalled certificate stored on the client device. Subsequently, the client device can receive a uniform resource locator identifying a network location of a secure sockets layer (SSL) pinning service, wherein the SSL pinning service is configured to provide a hash value for a first public key issued to a computing device. Finally, the client device can receive a second public key from the trust service, wherein the second public key is configured to encrypt network traffic sent to the SSL pinning service.

Abstract: Systems herein allow a user to record a presentation with a slides file. The system can record action events generated by a viewer application that displays slides of the slides file. The system can also record an audio segment for each displayed slide. An action information file can be created that links action events and audio segments to slides, and provides timing information for the action events. This can allow for playback of a narrated presentation where actions are recreated in synchronization with the narration while reducing the reliance on large video files.