Abstract: Disclosed are various embodiments of a multiuser unified endpoint management (UEM) system. A device check-in can be received from a client device. The device check-in can include a device identifier that uniquely identifies the client device with respect to other client devices and a user identifier that uniquely identifies the user of the client device with respect to other users of the client device. In response, a device channel identifier associated with the device identifier and a user channel identifier associated with both the user identifier and the device identifier can be obtained. Then a first set of entitlements associated with the device channel identifier and a second set of entitlements associated with the user channel identifier can be selected. Both sets of entitlements can be provided to the client device in response to the device check-in.

Abstract: Disclosed are examples related to data driven interfaces for decoupling management system components from a manufacturer or a platform of client devices managed by the management system. In some examples, among others, a system can generate a data driven interface template that can be used to cause rendering of a data driven user interface for configuring a profile payload of a device profile for the client device. The system can generate, based on values associated with the data driven user interface, a profile document in an instance in which values are obtained from the data driven user interface. In some aspects, the profile document is a generic representation of the profile payloads for the platform, the manufacturer or the type of the client device.

Abstract: The disclosure relates to detecting vulnerabilities in managed client devices. A system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Abstract: Examples described herein include systems and methods for dynamically displaying features in a GUI of a portal application that facilitates access to other applications. An example method can include receiving a push notification, from a notification service, at a user device upon which the portal application is installed. The push notification can indicate that a new feature is available for the portal application executing on the user device. The example method can include requesting, from the management server, at least one command for modifying the GUI of the portal application. The management server can provide the command or provide instructions for the user device to retrieve the command. The method can include receiving at least one command. The method can also include modifying the GUI of the portal application based on the received command and displaying the modified GUI.

Abstract: Examples of multi-persona account management in client devices are described. A client device can host a personal workspace, such as for personal data and applications of a user, along with a separate alternate persona workspace for work-related data and applications of the user. The client device interfaces with a management computing environment to enroll in device management services and establish the alternate persona workspace on the client device. In one example, the client device queries a management computing environment to establish an alternate persona workspace in the client device. The client device then creates the alternate persona workspace in the client device based on a response from the management computing environment, associates an alternate persona account with the alternate persona workspace, and receives a notification to install at least one application in the alternate persona workspace from an account administration environment of the alternate persona account.

Abstract: Systems and methods presented herein provide examples for distributing resources in a UEM system. In one example, the UEM system can receive a request to check out a user device enrolled in the UEM system. The request can include a profile identifier (“ID”) of a user profile making the request and attributes of the user device. The UEM system can create a hash of group IDs associated with the profile ID. The UEM system can create a device context that includes the device attributes and the hash. The UEM system can then determine if the device context matches to a resource context. Resource contexts can identify a set of UEM resources associated with a device context. Where a match is found, the UEM system can provide the corresponding resources to the user device.

Abstract: Various examples relate to detecting vulnerabilities in managed client devices. In some examples, a system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Abstract: The disclosure relates to detecting vulnerabilities in managed client devices. A system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Abstract: Disclosed are examples related to data driven interfaces for decoupling management system components from a manufacturer or a platform of client devices managed by the management system. In some examples, among others, a system can generate a data driven interface template that can be used to cause rendering of a data driven user interface for configuring a profile payload of a device profile for the client device. The system can generate, based on values associated with the data driven user interface, a profile document in an instance in which values are obtained from the data driven user interface. In some aspects, the profile document is a generic representation of the profile payloads for the platform, the manufacturer or the type of the client device.

Abstract: Examples described herein include systems and methods for dynamically displaying features in a GUI of a portal application that facilitates access to other applications. An example method can include receiving a push notification, from a notification service, at a user device upon which the portal application is installed. The push notification can indicate that a new feature is available for the portal application executing on the user device. The example method can include requesting, from the management server, at least one command for modifying the GUI of the portal application. The management server can provide the command or provide instructions for the user device to retrieve the command. The method can include receiving at least one command. The method can also include modifying the GUI of the portal application based on the received command and displaying the modified GUI.

Abstract: Examples described herein include systems and methods for dynamically displaying features in a GUI of a portal application that facilitates access to other applications. An example method can include receiving a push notification, from a notification service, at a user device upon which the portal application is installed. The push notification can indicate that a new feature is available for the portal application executing on the user device. The example method can include requesting, from the management server, at least one command for modifying the GUI of the portal application. The management server can provide the command or provide instructions for the user device to retrieve the command. The method can include receiving at least one command. The method can also include modifying the GUI of the portal application based on the received command and displaying the modified GUI.

Abstract: Examples described herein include systems and methods for dynamically determining a server for enrollment with a management system. An example method can include receiving user input at an application executing on a user device, such as a portal application that provides access to and authentication for other applications through a catalogue of application icons. If the user input includes a first URL but that URL produces an error when used in conjunction with extensions associated with a management server, the application can automatically use extensions associated with an application-support server. The application can then retrieve a second URL from the application-support server and use it for performing enrollment steps at the management server. The enrollment steps can include authenticating the user at an identity service and determining the user's group ID for enrollment, for example.

Abstract: Various examples relate to the configuration of enterprise workspaces that can be provided in computing devices. In some examples, a computing device is enrolled with a management service that controls operation of at least a portion of the computing device. A management component creates a user account with a distributor of the operating system based on an email address. The management component requests an authentication service to authenticate a user. The user account is associated with an enterprise workspace of the computing device.

Abstract: Disclosed are various embodiments that related to rendering a data driven user interface used to configure device profiles in an enterprise device management environment. In some examples, the enterprise device management environment can include a platform messaging service and a platform specific adapter. In one example, a system can receive a request to generate a device profile for a platform. The system can render a data driven user interface for configuring the device profile based on a definition file. The system can also receive input of a value for a user interface element and retrieve the values from the other user interface elements. The system can generate the device profile based on a translation of the values and transmit a command to a platform messaging service to facilitate an installation of the device profile in a mobile device. Various delivery methods for installing the device profile are disclosed.

Abstract: Examples of multi-persona account management in client devices are described. A client device can host a personal workspace, such as for personal data and applications of a user, along with a separate alternate persona workspace for work-related data and applications of the user. The client device interfaces with a management computing environment to enroll in device management services and establish the alternate persona workspace on the client device. In one example, the client device queries a management computing environment to establish an alternate persona workspace in the client device. The client device then creates the alternate persona workspace in the client device based on a response from the management computing environment, associates an alternate persona account with the alternate persona workspace, and receives a notification to install at least one application in the alternate persona workspace from an account administration environment of the alternate persona account.

Abstract: Examples of multi-persona account management in client devices are described. In one example, a client device can host a personal workspace, such as for personal data and applications of a user of the client device, along with a separate alternate persona workspace for work-related data and applications of the user. The client device interfaces with a management computing environment to enroll in device management services and establish an alternate persona workspace on the client device. The client device receives a token for the alternate persona workspace from the management computing environment, creates the alternate persona workspace, and installs an interface service in the alternate persona workspace. The client device also associates an alternate persona account with the alternate persona workspace using the token and returns a service identifier to the management computing environment.

Abstract: Examples described herein include systems and methods for dynamically determining a server for enrollment with a management system. An example method can include receiving user input at an application executing on a user device, such as a portal application that provides access to and authentication for other applications through a catalogue of application icons. If the user input includes a first URL but that URL produces an error when used in conjunction with extensions associated with a management server, the application can automatically use extensions associated with an application-support server. The application can then retrieve a second URL from the application-support server and use it for performing enrollment steps at the management server. The enrollment steps can include authenticating the user at an identity service and determining the user's group ID for enrollment, for example.

Abstract: Systems and methods are provided for an improved GUI workflow that supports complex bundle arrays for configuring devices. The method can also include displaying, on a GUI, a first top-level array of configuration fields described in a schema file having configuration options for a user device. A top-level array can include at least one group of nested (or “lower-level”) configuration options, where the grouping is represented by a graphical element in the top-level array. In response to a selection of a second-level array, the example method can include extracting lower-level configuration information from the schema file, generating a lower-level array based on the extracted information, and displaying, within the first top-level array, the first lower-level array of configuration fields. The method can also include various options for copying stored settings into a new array. The settings can be implemented on a device through a management server.

Abstract: Various examples relate to the configuration of enterprise workspaces that can be provided in computing devices. In some examples, a computing device is enrolled with a management service that controls operating of at least a portion of the computing device. A management component creates a user account with a distributor of the operating system based on an email address and a password. The user account is associated with an enterprise workspace of the computing device.

Abstract: Various examples relate to detecting vulnerabilities in managed client devices. In some examples, a system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.