Abstract: Systems and methods are described for accessing a first user device using a digital badge from a second user device. The digital badge can include information that can be used to identify and authenticate a user profile. In an example, the first and second user devices can be enrolled in a system for managing user devices. A user can select to login to the first user device using a digital badge. The first user device can enable a wireless communication protocol and broadcast a digital badge request that is recognizable by other enrolled devices. The second user device can detect the broadcast and send its digital badge to the first user device. The first user device can send an access request and the digital badge to a server. The server can verify the digital badge, authenticate the user, and notify the first user device. The first user device can then grant the user access without the user inputting any credentials.

Abstract: Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground.

Abstract: Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.

Abstract: Disclosed are various examples for client device migration to utilize management platform features. In some examples, the client device is identified as compatible with a management platform. A migration of the client device to utilize a management platform feature is accepted through a user interface. A management platform account is created with a management platform service. A management profile is installed on the client device. The profile is compatible with the management platform. The management platform feature is enabled on the client device.

Abstract: Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Abstract: Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground.

Abstract: Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Abstract: Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground.

Abstract: Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Abstract: Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.

Abstract: Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.

Abstract: Examples described herein include systems and methods for providing on-demand access to a restricted resource of a user device. An example method can include generating a profile that specifies a restricted resource and one or more conditions for that resource to be de-restricted. The profile can be sent to, and utilized by, an agent application executing on the user device. The agent application can determine that a user is requesting de-restriction of a resource and determine whether all applicable conditions are met. If the conditions are met, the agent application can de-restrict the resource. After the resource is used, the agent application can report details of the use to an administrator or management server.

Abstract: Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Abstract: Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground.

Abstract: Examples described herein include systems and methods for migrating a group of user devices associated with an enterprise from a first device-management service to a second device-management service. An example method can include receiving a request to migrate the group of user devices from the first device-management service to the second device-management service. The second device-management service can associate the enterprise support service with the second, rather than the first, device-management service. It can also cause the enterprise support service to install an agent application the user devices in the group. Finally, the second device-management service can remove one or more applications, associated with the first device-management service, from the user devices in the group.

Abstract: Disclosed are various examples for facilitating enrollment of a client device into more than one management framework. A client device can be enrolled with a management service as a fully managed device. The client device can also be enrolled with the management service as a personal or bring-your-own-device (BYOD), which causes a workspace to be created on the device that is segregated from the rest of the client device. Both enrollments can be managed by a remotely executed management service.

Abstract: Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.

Abstract: Disclosed are various examples for client device migration to utilize management platform features. In some examples, the client device is identified as compatible with a management platform. A migration of the client device to utilize a management platform feature is accepted through a user interface. A management platform account is created with a management platform service. A management profile is installed on the client device. The profile is compatible with the management platform. The management platform feature is enabled on the client device.

Abstract: Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.

Abstract: Examples described herein include systems and methods for providing on-demand access to a restricted resource of a user device. An example method can include generating a profile that specifies a restricted resource and one or more conditions for that resource to be de-restricted. The profile can be sent to, and utilized by, an agent application executing on the user device. The agent application can determine that a user is requesting de-restriction of a resource and determine whether all applicable conditions are met. If the conditions are met, the agent application can de-restrict the resource. After the resource is used, the agent application can report details of the use to an administrator or management server.