# US 11,310,213 B2 · Directory service user synchronization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,213 B2 - Document ID: US11310213B2 - Status: Granted - Kind: B2 - Application number: 15/057,490 - Filed: 2016-03-01 - Published: 2017-03-16 - Granted: 2022-04-19 - Earliest claimed: 2015-09-11 - Assignees: AirWatch LLC - Applicants: AirWatch LLC - Inventors: Kalyan Regula; Shravan Shantharam; Nishita Manjunath; Varun Murthy; Jason Roszak - Web page: https://patentgrep.com/patent/US11310213B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/102: {Entity profiles} - H04L 67/1044: {Group management mechanisms (management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425)} - H04L 67/306: User profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are various examples for enrolling a client device and synchronizing user attributes for the client device across multiple directory services. A search request for user attributes can be sent to a first directory service with an identifier for a user account. The first directory service can query for the identifier and send back user attributes. If a global identifier is included in the attributes, another search request for user attributes can be sent to a second directory service with the global identifier. The second directory service can query for the global identifier and send back user attributes. ## Claims ### Claim 1 A method, comprising: in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, searching a first directory service for a plurality of first user attributes based at least in part on the identifier; receiving the plurality of first user attributes from the first directory service; determining that the plurality of first user attributes includes a global identifier; searching a second directory service for a plurality of second user attributes based at least in part on the global identifier; receiving the plurality of second user attributes from the second directory service; and enrolling a client device in the management service, the management service configured to enforce at least one compliance rule based on the user account being assigned to a group based on one of the plurality of second user attributes. ### Claim 2 (depends on 1) The method of claim 1, further comprising receiving an authentication confirmation comprising the identifier from the client device, the client device being associated with the user account. ### Claim 3 (depends on 2) The method of claim 2, further comprising updating a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes. ### Claim 4 (depends on 3) The method of claim 3, further comprising scheduling a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response to the periodic query. ### Claim 5 (depends on 1) The method of claim 1, wherein the global identifier is an immutable identifier. ### Claim 6 (depends on 1) The method of claim 1, further comprising: detecting a conflict between the plurality of first user attributes and the plurality of second user attributes; and resolving the conflict based at least in part on a last modified timestamp associated with a conflicting set of user attributes. ### Claim 7 A non-transitory computer-readable medium embodying a program that, when executed by at least one computing device, causes the at least one computing device to at least: in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, search a first directory service for a plurality of first user attributes based at least in part on the identifier; receive the plurality of first user attributes from the first directory service; determine that the plurality of first user attributes includes a global identifier; searching a second directory service for a plurality of second user attributes based at least in part on the global identifier; receive the plurality of second user attributes from the second directory service; and enroll a client device in the management service, the management service configured to enforce at least one compliance rule based on the user account being assigned to a group based on one of the plurality of second user attributes. ### Claim 8 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the program further causes the at least one computing device to at least receive an authentication confirmation comprising the identifier from the client device, the client device being associated with the user account. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the program further causes the at least one computing device to at least update a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the program further causes the at least one computing device to at least schedule a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response to the periodic query. ### Claim 11 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the global identifier is an immutable identifier. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the program further causes the at least one computing device to at least: detect a conflict between the plurality of first user attributes and the plurality of second user attributes; and resolve the conflict based at least in part on a last modified timestamp associated with a conflicting set of user attributes. ### Claim 13 A system, comprising: a data store; at least one computing device in communication with the data store, the at least one computing device being configured to at least: in an instance in which a user account comprising an identifier is detected as omitted from a list of managed users managed by a management service, search a first directory service for a plurality of first user attributes based at least in part on the identifier; receive the plurality of first user attributes from the first directory service; determine that the plurality of first user attributes includes a global identifier; search a second directory service for a plurality of second user attributes based at least in part on the global identifier; receive the plurality of second user attributes from the second directory service; and enroll a client device in the management service, the management service configured to enforce at least one compliance rule based on the user account being assigned to a group based on one of the plurality of second user attributes. ### Claim 14 (depends on 13) The system of claim 13, wherein the at least one computing device is further configured to at least receive an authentication confirmation comprising the identifier from the client device, the client device being associated with the user account. ### Claim 15 (depends on 14) The system of claim 14, wherein the at least one computing device is further configured to at least update a plurality of user properties corresponding to the user account based at least in part on at least one of: the plurality of first user attributes or the plurality of second user attributes. ### Claim 16 (depends on 15) The system of claim 15, wherein the at least one computing device is further configured to at least schedule a periodic query of the first directory service and the second directory service for changes to the user account, wherein updating the plurality of user properties corresponding to the user account occurs in response to the periodic query. ### Claim 17 (depends on 13) The system of claim 13, wherein the global identifier is an immutable identifier. ### Claim 18 (depends on 1) The method of claim 1, wherein the identifier comprises at least one of: an object ID and a User Principal Name. ### Claim 19 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the identifier comprises at least one of: an object ID and a User Principal Name. ### Claim 20 (depends on 13) The system of claim 13, wherein the identifier comprises at least one of: an object ID and a User Principal Name.