# US 10,873,511 B2 · Management service migration for managed devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,511 B2 - Document ID: US10873511B2 - Status: Granted - Kind: B2 - Application number: 15/598,321 - Filed: 2017-05-18 - Published: 2018-05-24 - Granted: 2020-12-22 - Earliest claimed: 2016-11-22 - Assignees: AirWatch LLC - Applicants: Airwatch LLC - Inventors: Roger Deane; Jeff Harris; Urvashi Goverdhan - Web page: https://patentgrep.com/patent/US10873511B2 ## CPC - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/042: comprising distributed management centres cooperatively managing the network - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/082: using revocation of authorisation - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are various examples for client device migration. In one example, a client device is enrolled with a first management service. A user interface is generated that identifies a user request to enroll the client device with a second management service. An un-enrollment from the first management service is initiated. The un-enrollment from the first management service is initiated using identifier of the client device. An enrollment with the second management service is initiated. The enrollment with the second management is initiated using a the identifier of the client device. ## Claims ### Claim 1 A system, comprising: at least one computing device; and program instructions executable in the at least one computing device that, when executed, cause the at least one computing device to at least: identify, by a migration service, a request to migrate a client device from a first management service to a second management service, the request comprising a device identifier associated with the client device, wherein an enterprise managing the client device utilizes the migration service to change management services from the first management service to the second management service; transmit, from the migration service to the first management service, an un-enrollment request that invokes an un-enrollment Application Programming Interface (API) of the first management service to un-enroll the client device from the first management service, the un-enrollment request comprising the device identifier, an identity of the enterprise managing the client device, and administrator credentials for the enterprise, wherein the administrator credentials authenticate with the un-enrollment API of the first management service; obtain, by the migration service, enrollment data from the second management service, the enrollment data comprising an enrollment token that authenticates the client device for enrollment with the second management service; and transmit, from the migration service to a migration application executed on the client device, instructions that cause the client device to authenticate the client device for enrollment with the second management service using the enrollment token. ### Claim 2 (depends on 1) The system of claim 1, further comprising program instructions executable in the at least one computing device that, when executed, further cause the at least one computing device to at least: cause the client device to download and install the migration application that identifies the device identifier. ### Claim 3 (depends on 2) The system of claim 2, wherein the migration application enables a network adapter of the client device to identify the device identifier. ### Claim 4 (depends on 1) The system of claim 1, further comprising program instructions executable in the at least one computing device that, when executed, further cause the at least one computing device to at least: cause the client device to download and install the migration application that generates a user interface that identifies the request to migrate the client device from the first management service to the second management service. ### Claim 5 (depends on 4) The system of claim 4, wherein the user interface includes a visualization aid that provides status information regarding a migration of the client device from the first management service to the second management service. ### Claim 6 (depends on 1) The system of claim 1, wherein the at least one computing device invokes another Application Program Interface (API) of the first management service to determine that the client device is un-enrolled from the first management service. ### Claim 7 (depends on 1) The system of claim 1, wherein the enrollment data comprises an enrollment link that includes the enrollment token. ### Claim 8 (depends on 1) The system of claim 1, wherein the enrollment data comprises an enrollment link associated with the second management service. ### Claim 9 A computer-implemented method, comprising: identifying, by a migration service, a request to migrate a client device from a first management service to a second management service, the request comprising a device identifier associated with the client device, wherein an enterprise managing the client device utilizes the migration service to change management services from the first management service to the second management service; transmitting, from the migration service to the first management service, an un-enrollment request that invokes an un-enrollment Application Programming Interface (API) of the first management service to un-enroll the client device from the first management service, the un-enrollment request comprising the device identifier, an identity of the enterprise managing the client device, and administrator credentials for the enterprise, wherein the administrator credentials authenticate with the un-enrollment API of the first management service; obtaining, by the migration service, enrollment data from the second management service, the enrollment data comprising an enrollment token that authenticates the client device for enrollment with the second management service; and transmitting, from the migration service to a migration application installed on the client device, instructions that cause the client device to authenticate the client device for enrollment with the second management service using the enrollment token. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising: causing the client device to install the migration application; and causing the client device to apply a configuration file to the migration application that includes a first server address associated with first management service and a second server address associated with second management service. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, further comprising: determining that the client device is enrolled with the second management service; and rendering a user interface on the client device that indicates that the client device is migrated from the first management service to the second management service. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, further comprising: querying the first management service for management data associated with the client device; storing the management data in a temporary device record of the migration service, the management data comprising: a group associated with the client device, and at least one compliance rule associated with the client device; and transmitting the management data to the second management service. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, further comprising: causing the client device to identify a profile based at least in part on the management data and install the profile on the client device. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, wherein the enrollment data comprises an enrollment link that includes the enrollment token. ### Claim 15 (depends on 12) The computer-implemented method of claim 12, wherein causing the client device to be un-enrolled from the first management service further comprises redirecting, to an emulated management service executed separately from the first management service, a request to un-enroll the client device from the first management service, wherein the emulated management service emulates the first management service and provides an un-enrollment command to the client device. ### Claim 16 A non-transitory computer-readable medium embodying program instructions executable in at least one computing device that, when executed, cause the at least one computing device to at least: identify, by a migration service, a request to migrate a client device from a first management service to a second management service, the request comprising a device identifier associated with the client device, wherein an enterprise managing the client device utilizes the migration service to change management services from the first management service to the second management service; transmit, from the migration service to the first management service, an un-enrollment request that invokes an un-enrollment Application Programming Interface (API) of the first management service to un-enroll the client device from the first management service, the un-enrollment request comprising the device identifier, an identity of the enterprise managing the client device, and administrator credentials for the enterprise, wherein the administrator credentials authenticate with the un-enrollment API of the first management service; obtain, by the migration service, enrollment data from the second management service, the enrollment data comprising an enrollment token that authenticates the client device for enrollment with the second management service; and transmit, from the migration service to a migration application installed on the client device, instructions that cause the client device to authenticate the client device for enrollment with the second management service using the enrollment token. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, further comprising program instructions executable in the at least one computing device that, when executed, further cause the at least one computing device to at least: send a link to the client device to download the migration application that generates a user interface that identifies the request to migrate the client device from the first management service to the second management service. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the user interface includes a visualization aid that provides status information regarding a migration of the client device from the first management service to the second management service. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the enrollment data comprises an enrollment link that includes the enrollment token. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, further comprising program instructions executable in the at least one computing device that, when executed, further cause the at least one computing device to at least: determine, by the migration service, that the client device is un-enrolled from the first management service; and transmit, from the migration service to the client device, a confirmation that the client device is un-enrolled from the first management service.