Abstract: Disclosed are various examples for prioritizing application traffic through network tunnels between a client device and a tunnel endpoint. Network traffic is received from each of a plurality of applications executed by the client device. It is determined that the network traffic of a first application of the plurality of applications is associated with a lower priority than the network traffic of a second application of the plurality of applications. A bandwidth allocation to the network traffic of the first application is limited in the encrypted tunnel as compared to a bandwidth al location to the network traffic of the second application in the encrypted tunnel according to the lower priority.

Abstract: Disclosed are various examples for establishing encrypted channels or tunnels within a TCP or other communication session between a tunnel endpoint and tunnel client on a client device. A tunnel client on the client device can determine an encryption level based upon a bundle identifier of the application originating the network traffic, the destination of the network traffic, the category of the application, or other factors.

Abstract: Disclosed are various examples for facilitating sharing of activity on a display of a client device. The client device can be enrolled as a managed device with a management service. A display sharing profile can be created that specifies a whitelist and/or a blacklist of applications. Whitelisted applications are permitted to have activity occurring on the display shared with a display sharing applications. Blacklisted applications are not permitted to share activity with the display sharing application. The display sharing profile can be enforced by a management component or a display sharing application.

Abstract: Systems herein allow a user to load a virtual work environment on a terminal, such as a workstation, based on authentication mechanisms built into a user device, such as a cell phone. The user device can authenticate with a management server using an SAML token. The management server can track which virtual machines and configurations make up the user's work environment, and can send that information to the user device for loading the virtual machines. When the user wishes to load the virtual machines at a terminal, the user device can send the SAML token to the terminal for use in authenticating with the management server. The management server can then provide the configurations for the virtual machines that the user selects to load at the terminal.

Abstract: Examples relate to the configuration of network connections for computing devices. In some examples, a computing device determines that a network is inaccessible through a first network connection provided by a network access node. The computing device determines that the network is accessible through a first computing device that provides a second connection to the network. The computing device generates gateway configuration data for a second computing device based on an address for the first computing device. The computing device transmits the gateway configuration data to the second computing device to cause the second computing device to use the first computing device as a gateway.

Abstract: Systems herein allow a student to share media with other students in a classroom with the permission of a teacher. The student can send a sharing request to a management server with a sender student device. The management server can identify a teacher device and send the sharing request to the teacher device for approval. When the request is granted, the student device can supply an address local to the sender device, from which the media will stream. The management server can send the address and an authentication token to other recipient student devices. The management server can further lock the recipient student devices into the sharing location to ensure that each student device will stream the media. At the request of the teacher device or the sender student device, the streaming can end.

Abstract: Disclosed are various approaches for providing on-demand virtual private network (VPN) connectivity on a per-application basis. First, an application is determined to have begun execution on a computing device. The application is then identified. A determination that the application is authorized to access a VPN connection is made. Subsequently, the VPN connection is initiated.

Abstract: Disclosed are examples of managing devices through secondary communication channels. In some examples, a management component detects an impediment with a data communication channel for a device. The data communication channel can be a primary communication channel through which the device communicates with a management service. The management component detects an event associated with the device to report to the management service. The management component generates a message specifying the event, and the management component transmits the message to the management service through the secondary communication channel.