Abstract: Methods and an apparatus are provided for securely authorizing access to remote resources. For example, a method is provided that includes receiving a request to determine whether a user device communicatively coupled to a resource server is authorized to access at least one resource hosted by the resource server and determining whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server based at least in part on whether the user device communicatively coupled to the resource server has been issued a management identifier. The method further includes providing a response indicating that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server in response to a determination that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server.

Abstract: Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules.

Abstract: On-demand activation of a security policy may be provided. Upon receiving a selection of a link, a profile identified by a security policy associated with the link may be activated and the link may be opened according to the security policy. In some embodiments, opening the link according to the security policy may comprise redirecting the opening of the link from a first application to a second application.

Abstract: Examples relate to devices being managed based on their locations relative to a facility. In some examples, the location of a client device can be determined relative to a facility. An organizational group can be associated with the location. The client device can be associated with the organizational group. Whether the client device complies with a compliance policy associated with the organizational group can be determined.

Abstract: Disclosed are various examples for dynamically generating configuration profiles based on an operating system of a device. A computing environment can determine that a configuration profile configured for a type of the client device has not been created. If so, the computing environment can identify an operating system of the client device, determine a format for the configuration profile based on the operating system, and generating a configuration profile in accordance with the format and the operating system. The configuration profile can include a value for a setting previously defined that is common to a plurality of different operating systems.

Abstract: Disclosed are various embodiments for fast and accurate identification of message-based application programming interface (API) calls in applications. A set of compliance rules is obtained from a compliance rule store. A request to analyze an application is received. An application analysis is performed by scanning the application to identify one or more public APIs invoked by the application. The set of compliance rules are enforced on the application based at least in part on the application analysis.

Abstract: Time-based functionality restrictions may be provided. Periodic scans may be performed to identify requests to perform functions on user devices, to determine whether the functions are compliant with compliance rules associated with the user devices that specify time periods during which the user devices are authorized to perform the functions, and to perform remedial actions if the functions are not compliant with the compliance rules.

Abstract: An agent application executing on a client device retrieves an execute command from a command queue managed by a server and retrieves certificates and configuration settings for establishing a virtual private network (VPN) connection. An enrollment application resident on the client device executes in response to the execute command to modify a network setting of a network interface card (NIC) of the client device and establish a VPN connection with a domain controller located within the corporate domain using the certificate and configuration settings. The enrollment application further transmits a request over the VPN connection to the domain controller to join the corporate domain, wherein a corporate account in a directory service is established for the client device; reverts back to the prior network setting of the NIC and terminates the VPN connection and reboots the client device.

Abstract: Systems herein can recommend files to users based on meeting information. The system can include a secure email gateway that forwards meeting invitations to an email server and a content server. The system can extract invitee information, meeting timing information, and an attachment from the meeting invitation. During a time period based on the meeting timing information, the content server can cause a managed content application on an invitee's user device to visually identify the attachment as a recommended file. This can allow the user to locate and access relevant files for a meeting, including files that are not attached to the meeting invite, at one location.

Abstract: Systems and methods are provided for analyzing application usage on a user device and optimizing application and license distribution for user devices in an enterprise. An example system includes a management server and a data server. The management server can provide instructions to the user device to install a tracking application that gathers application-usage data using built-in functionality of the user device. The data server can receive and compile the application-usage data, creating compiled usage data. Using this compiled usage data, the management server can execute a rules engine to determine an action to take associated with at least one application on the user device, such as redistributing application licenses.

Abstract: Disclosed are various embodiments for managing voice-driven application. In one embodiment, among others, a system includes a computing device and program instructions. The program instructions can cause the computing device to receive a request to initiate an application proxy service. The program instructions can cause the computing device to authenticate the request based on an access token. The program instructions can cause the computing device to initiate an application proxy service session with a second computing device, where the second computing device provides input data to the application proxy service. The computing device can also initiate an application session associated with an application service, where the application proxy service provides the input data to the application service. The computing device also can apply a compliance policy as data is communicated between the second computing device and the application service.

Abstract: Disclosed are various examples of systems and methods for transferring data between applications executing in sandboxed environments. In one example, a first application is in a first sandbox. A request for access to data is transmitted from the first application to a second application in a second sandbox. The data is stored in the second sandbox. The request is transmitted using a sandbox communications framework. The data is received using the sandbox communications framework. The data is encrypted. An encryption key is retrieved from an access-restricted data store.

Abstract: Systems herein allow a student to share media with other students in a classroom with the permission of a teacher. The student can send a sharing request to a management server with a sender student device. The management server can identify a teacher device and send the sharing request to the teacher device for approval. When the request is granted, the student device can supply an address local to the sender device, from which the media will stream. The management server can send the address and an authentication token to other recipient student devices. The management server can further lock the recipient student devices into the sharing location to ensure that each student device will stream the media. At the request of the teacher device or the sender student device, the streaming can end.

Abstract: Disclosed are various embodiments for a remotely-hosted auto-discovery service. An auto-discovery request received from a client device over a network can be accessed to identify a domain associated with the auto-discovery request. A digital certificate corresponding to the domain can be identified and a configuration file can be generated for a web server application that creates at least one virtual host for a uniform resource locator (URL) identified in the auto-discovery request. The digital certificate can be bound to the at least one virtual host to operate a secure connection with the client device. An enrollment response can be generated for communication to the client device over the network.

Abstract: Disclosed are various examples for remote virtual private network (VPN) configuration using dynamically generated configuration profiles. A computing environment having a management service can determine variable names for inclusion in configuration profiles that are capable of configuring VPN settings on various managed device operating systems. The computing environment can dynamically generate configuration profiles using the appropriate variable names such that a client device having a particular operating system installed thereon is capable of interpreting the value and the variable name to configure the VPN setting.

Abstract: Embodiments of the disclosure relate to proxying one or more email resources in transit to the client devices from the email services, removing one or more email attachments from the email resources, and encoding the stripped email attachments based at least in part on one or more cryptographic keys.

Abstract: Embodiments of the disclosure relate to proxying at least one email resource from at least one email service to at least one client device, determining whether the email resources are accessible to the client devices via at least one unauthorized application on the client devices, and modifying the email resources to be inaccessible via the unauthorized applications on the client devices in response to a determination that the email resources are accessible via the unauthorized applications on the client devices.

Abstract: Disclosed are various examples for network printer detection and authentication for managed device deployment. In one example, a computing environment can receive an identifier from a client device over a network, where the client device detects the identifier based on a wireless transmission performed by a transmitter in association with a print operation assigned to a network printer. The computing environment can determine whether an authentication is required at the network printer in association with the print operation and cause an agent application executable on the client device to obtain authentication data. An authentication can be performed based on the authentication data received from the client device and, in response to a successful authentication, causes the print operation to be performed by the network printer.

Abstract: Systems herein allow an administrator to efficiently set up user devices for use in a classroom environment. A management server can display a graphical user interface that includes selection options for defining and using carts of user devices. The carts can be selected and assigned to classes. The GUI also allows the administrator to specify which applications a class will use. Based on these selections, the management server can then manage which user devices install which applications, and allocate licenses accordingly.

Abstract: Disclosed are various examples for provisioning a client device through near-field communication (NFC). An administrator device can provide configuration parameters to a client device in a factory-reset condition through an NFC bump. A second NFC bump can be performed that provides enrollment parameters to the client device, after which the client device can complete enrollment with an enterprise mobility management (EMM) service.