Processing policy variance requests in an enterprise computing environment

A method comprising:

• at a computing platform comprising at least one processor, memory, and a communication interface:
• receiving, by the at least one processor, via the communication interface, from a first endpoint computing device, a request for a first policy variance, wherein the request for the first policy variance comprises a request for an exception from an existing policy, and wherein the request for the first policy variance was generated by the first endpoint computing device based on input received at the first endpoint computing device;
• based on receiving the request for the first policy variance:
• authenticating, by the at least one processor, the first endpoint computing device based on enrollment information associated with the first endpoint computing device;
• and
• validating, by the at least one processor, contents of the request for the first policy variance;
• generating, by the at least one processor, a policy variance result message based on approval or rejection of the request for the first policy variance, wherein the approval or rejection of the request for the first policy variance is indicated in a response message from an administrator computing device;
• sending, by the at least one processor, via the communication interface, to the first endpoint computing device, the policy variance result message, wherein sending the policy variance result message to the first endpoint computing device causes the first endpoint computing device to execute a policy action corresponding to the approval or rejection of the request for the first policy variance;
• after sending the policy variance result message to the first endpoint computing device, logging, by the at least one processor, policy variance information identifying the requested exception from the existing policy and the first endpoint computing device;
• assign the logged policy variance information to a subset of existing logged policy variance information associated a geographic location of the first endpoint computing device;
• detect whether a majority of the existing logged policy variance information in the subset of existing logged policy variance information comprises requests the requested exception from the existing policy;
• based on detecting that the majority of the existing logged policy variance information in the subset of existing logged policy variance information comprises requests for the requested exception from the existing policy:
• generating, by the at least one processor, at least one suggested policy action comprising removing a restriction, included in the existing policy and for the geographic location of the first endpoint computing device, corresponding to the requested exception;
• generating, by the at least one processor, new baseline provisioning data based on the at least one suggested policy action and the approval or the rejection of the request for the first policy variance by the administrator computing device;
• and
• sending, by the at least one processor, via the communication interface, to the first endpoint computing device, the new baseline provisioning data, wherein sending the new baseline provisioning data to the first endpoint computing device causes the first endpoint computing device to implement one or more policy updates associated with the at least one suggested policy action.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:

• receive, via the communication interface, from a first endpoint computing device, a request for a first policy variance, wherein the request for the first policy variance comprises a request for an exception from an existing policy, and wherein the request for the first policy variance was generated by the first endpoint computing device based on input received at the first endpoint computing device;
• based on receiving the request for the first policy variance:
• authenticate the first endpoint computing device based on enrollment information associated with the first endpoint computing device;
• and
• validate contents of the request for the first policy variance;
• generate a policy variance result message based on approval or rejection of the request for the first policy variance, wherein the approval or rejection of the request for the first policy variance is indicated in a response message from an administrator computing device;
• send, via the communication interface, to the first endpoint computing device, the policy variance result message, wherein sending the policy variance result message to the first endpoint computing device causes the first endpoint computing device to execute a policy action corresponding to the approval or rejection of the request for the first policy variance;
• after sending the policy variance result message to the first endpoint computing device, log policy variance information identifying the requested exception from the existing policy and the first endpoint computing device;
• assign the logged policy variance information to a subset of existing logged policy variance information associated with a geographic location of the first endpoint computing device;
• detect whether a majority of the existing logged policy variance information in the subset of existing logged policy variance information comprises requests for the requested exception form the existing policy;
• based on detecting that the majority of the existing logged policy variance information in the subset of existing logged policy variance information comprises requests for the requested exception from the existing policy:
• generate at least one suggested policy action comprising removing a restriction, included in the existing policy and for the geographic location of the first endpoint computing device, corresponding to the requested exception;
• send an alert prompting an administrative user associated with an administrator computing device to approve or reject the at least one suggested policy action;
• receive a response to the alert prompting the administrative user associated with the administrator computing device to approve or reject the at least one suggested policy action;
• generate new baseline provisioning data based on the response to the alert prompting the administrative user associated with the administrator computing device to approve or reject the at least one suggested policy action;
• and
• send, via the communication interface, to the first endpoint computing device, the new baseline provisioning data, wherein sending the new baseline provisioning data to the first endpoint computing device causes the first endpoint computing device to implement one or more policy updates associated with the at least one suggested policy action.

A method comprising:

• receiving a plurality of requests to adjust a rule that governs operation of an endpoint computing device, the rule being configured to prevent performance of an action on the endpoint computing device, the requested adjustment being to allow the action, the plurality of requests being associated with a common geographic region, wherein the plurality of requests were generated by the endpoint computing device based on input received at the endpoint computing device;
• modifying a score in response to receipt of the plurality of requests, the modified score indicative of behavior of a user of the endpoint computing device as being high-risk;
• in response to modification of the score, blocking the endpoint computing device from access to at least one resource;
• based on identifying that the plurality of requests to adjust the rule comprises a majority of total requests received from the common geographic region, adjusting the rule to allow the action;
• generating new baseline provisioning data based on:
• the rule adjustment, and
• approval or the rejection of the request for the rule adjustment by an administrator computing device;
• and
• sending, via a communication interface, to the endpoint computing device, the new baseline provisioning data, wherein sending the new baseline provisioning data to the endpoint computing device causes the endpoint computing device to implement one or more policy updates associated with at least one suggested policy action.