A mobile device, comprising: at least one processor circuit (810,902); and at least one memory (820, 910) that stores program code (814, 934) configured to be executed by the at least one processor circuit, (810, 902) the program code comprising: a configuration manager configured to: when a user first logs into the mobile device, receive, from a server, configuration information describing compliance settings for implementing by the mobile device to bring the mobile device into compliance with a configuration scenario, wherein a designation of a user-device pairing is maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the mobile device; and store the configuration information; a configuration information error checker configured to: determine an error in the received configuration information, transmit a request for correction of the error to the server, and receive updated configuration information from the server; and an orchestrator engine configured to: receive a trigger from the configuration manager to implement the compliance settings in the mobile device; identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings, and execute the state machine to configure the mobile device with the compliance settings. at least one processor circuit (810,902); and at least one memory (820, 910) that stores program code (814, 934) configured to be executed by the at least one processor circuit, (810, 902) the program code comprising: a configuration manager configured to: when a user first logs into the mobile device, receive, from a server, configuration information describing compliance settings for implementing by the mobile device to bring the mobile device into compliance with a configuration scenario, wherein a designation of a user-device pairing is maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the mobile device; and store the configuration information; a configuration information error checker configured to: determine an error in the received configuration information, transmit a request for correction of the error to the server, and receive updated configuration information from the server; and an orchestrator engine configured to: receive a trigger from the configuration manager to implement the compliance settings in the mobile device; identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings, and execute the state machine to configure the mobile device with the compliance settings. a configuration manager configured to: when a user first logs into the mobile device, receive, from a server, configuration information describing compliance settings for implementing by the mobile device to bring the mobile device into compliance with a configuration scenario, wherein a designation of a user-device pairing is maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the mobile device; and store the configuration information; when a user first logs into the mobile device, receive, from a server, configuration information describing compliance settings for implementing by the mobile device to bring the mobile device into compliance with a configuration scenario, wherein a designation of a user-device pairing is maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the mobile device; and store the configuration information; a configuration information error checker configured to: determine an error in the received configuration information, transmit a request for correction of the error to the server, and receive updated configuration information from the server; and determine an error in the received configuration information, transmit a request for correction of the error to the server, and receive updated configuration information from the server; and an orchestrator engine configured to: receive a trigger from the configuration manager to implement the compliance settings in the mobile device; identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings, and execute the state machine to configure the mobile device with the compliance settings. receive a trigger from the configuration manager to implement the compliance settings in the mobile device; identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings, and execute the state machine to configure the mobile device with the compliance settings.