# US 2021/0243085 A1 · Deploying data-loss-prevention policies to user devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243085 A1 - Document ID: US20210243085A1 - Status: Published application - Kind: A1 - Application number: 17/236,006 - Filed: 2021-04-21 - Published: 2021-08-05 - Earliest claimed: 2018-06-04 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Aditya Shrotri; Sagar Date - Web page: https://patentgrep.com/patent/US20210243085A1 ## CPC - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/60: Protecting data - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0894: Policy-based network configuration management - H04L 63/0263: {Rule management} - H04L 63/0815: {providing single-sign-on or federations} - H04W 4/50: Service provisioning or reconfiguring - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Examples described herein include systems and methods for deploying Data Loss Prevention (DLP) policies to user devices. An example method can include receiving a configuration specifying at least one DLP policy applicable to an application, along with an indication of an assignment group specifying users, or user devices, to which the DLP policy should apply. Information regarding the DLP policy and assignment group can be provided to an identity service and then synchronized with a second server that manages the application. The method can further include provisioning the application to a user device and instructing the user device to retrieve the DLP policy from the second server and implement it when executing the provisioned application. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A method for deploying a data loss prevention (DLP) policy to a user device, comprising: displaying a graphical user interface (GUI) at an administrator device; receiving, through the GUI, a plurality of selections corresponding to a plurality of DLP options presented on the GUI and applicable to an application; receiving, through the GUI, a selection of an assignment group specifying a plurality of user devices to which the DLP policy should be applied; generating a configuration that specifies the DLP policy based on the selected options and selected assignment group; sending the configuration to the management server, wherein the management server: updates a record of the assignment group; synchronizes the record of the assignment group with an identity service; and causes a second server to implement the DLP policy for the plurality of user device in the assignment group; and causing a user device in the assignment group to retrieve the DLP policy from the second server and implement the DLP policy at the application. ### Claim 22 (depends on 21) The method of claim 21, further comprising causing the application to be provisioned to a user device. ### Claim 23 (depends on 21) The method of claim 21, wherein the identity service synchronizes with the second server. ### Claim 24 (depends on 21) The method of claim 21, wherein the user device retrieves the DLP policy from the second server based on the second server identifying the retrieving user device as being associated with the assignment group. ### Claim 25 (depends on 21) The method of claim 21, wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy. ### Claim 26 (depends on 21) The method of claim 21, wherein the GUI provides a selectable icon for turning on or off each of the plurality of DLP options. ### Claim 27 (depends on 21) The method of claim 21, wherein the GUI provides a field for entering administrator credentials required to deploy the DLP policy. ### Claim 28 A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of an administrator device, perform stages for deploying a data loss prevention (DLP) policy to a user device, the stages comprising: displaying a graphical user interface (GUI) at the administrator device; receiving, through the GUI, a plurality of selections corresponding to a plurality of DLP options presented on the GUI and applicable to an application; receiving, through the GUI, a selection of an assignment group specifying a plurality of user devices to which the DLP policy should be applied; generating a configuration that specifies the DLP policy based on the selected options and selected assignment group; sending the configuration to the management server, wherein the management server: updates a record of the assignment group; synchronizes the record of the assignment group with an identity service; and causes a second server to implement the DLP policy for the plurality of user device in the assignment group; and causing a user device in the assignment group to retrieve the DLP policy from the second server and implement the DLP policy at the application. ### Claim 29 (depends on 28) The non-transitory, computer-readable medium of claim 28, the stages further comprising causing the application to be provisioned to a user device. ### Claim 30 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the identity service synchronizes with the second server. ### Claim 31 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the user device retrieves the DLP policy from the second server based on the second server identifying the retrieving user device as being associated with the assignment group. ### Claim 32 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy. ### Claim 33 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the GUI provides a selectable icon for turning on or off each of the plurality of DLP options. ### Claim 34 (depends on 28) The non-transitory, computer-readable medium of claim 28, wherein the GUI provides a field for entering administrator credentials required to deploy the DLP policy. ### Claim 35 An administrator device for deploying a data loss prevention (DLP) policy to a user device, comprising: a processor; and a memory storage containing a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising: displaying a graphical user interface (GUI) at the administrator device; receiving, through the GUI, a plurality of selections corresponding to a plurality of DLP options presented on the GUI and applicable to an application; receiving, through the GUI, a selection of an assignment group specifying a plurality of user devices to which the DLP policy should be applied; generating a configuration that specifies the DLP policy based on the selected options and selected assignment group; sending the configuration to the management server, wherein the management server: updates a record of the assignment group; synchronizes the record of the assignment group with an identity service; and causes a second server to implement the DLP policy for the plurality of user device in the assignment group; and causing a user device in the assignment group to retrieve the DLP policy from the second server and implement the DLP policy at the application. ### Claim 36 (depends on 35) The administrator device of claim 35, the stages further comprising causing the application to be provisioned to a user device. ### Claim 37 (depends on 35) The administrator device of claim 35, wherein the identity service synchronizes with the second server. ### Claim 38 (depends on 35) The administrator device of claim 35, wherein the user device retrieves and implements the DLP policy without requiring input from the user regarding the DLP policy. ### Claim 39 (depends on 35) The administrator device of claim 35, wherein the GUI provides a selectable icon for turning on or off each of the plurality of DLP options. ### Claim 40 (depends on 35) The administrator device of claim 35, wherein the GUI provides a field for entering administrator credentials required to deploy the DLP policy.