Access orchestration engine in a cloud access management system
Methods, systems, and computer storage media for providing cloud access management using an access orchestration engine in a cloud access management system. Cloud access management provides access to a remote client of a consumer-identity-supported tenant environment of an organization. In operation, a consumer identity of a user is accessed. The consumer identity is approved for access to the consumer-identity-supported tenant environment. Based on accessing the consumer identity, access orchestration operations are executed for the remote client using remote client access resources, organization resources, and consumer identity resources. Executing the access orchestration operations comprises provisioning the remote client with remote access services for consumer identities; provisioning the remote client with organization resources; and priming the remote client with the consumer identity resources upon determining that the consumer identity is associated with the consumer-identity-supported tenant environment. The remote client is deployed, and the remote client is accessible based on the consumer identity.
1 . A computerized system comprising:
one or more computer processors; and
computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations comprising:
accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities;
executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients;
communicating an indication that the organization is configured with the consumer-identity-supported tenant environment;
accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment;
based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and
deploying the remote client, wherein the remote client is accessible using the consumer identity.
2 . The system of claim 1 , wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment.
3 . The system of claim 1 , wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment.
4 . The system of claim 1 , wherein the organization is associated with the organization resources and the consumer identity is associated with the consumer identity resources, the organization resources and consumer identity resources are both accessible via the remote client associated with the consumer-identity-supported tenant environment.
5 . The system of claim 1 , wherein the remote client access resources comprise a plurality of remote access services that support accessing the remote client using the consumer identity.
6 . The system of claim 1 , wherein executing the first plurality of access orchestration operations further comprises:
generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment;
mapping a first consumer identity to the consumer-identity-supported tenant environment; and
assigning a license to the consumer identity in the consumer-identity-supported tenant environment.
7 . The system of claim 1 , wherein executing the second plurality of access orchestration operations further comprises:
provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity;
provisioning the remote client with the organization resources of the organization; and
priming the remote client with the consumer identity resources of the consumer identity.
8 . The system of claim 1 , the operations further comprising:
accessing the consumer identity of the user, wherein the consumer identity is licensed for access to the consumer-identity-supported tenant environment;
initiating a discovery operation to identify the consumer-identity-supported tenant environment associated with the consumer identity;
based on the consumer identity, providing access to the consumer-identity-supported tenant environment;
communicating an indication of the remote client that is accessible based on the consumer identity;
accessing credentials associated with the consumer identity; and
based on the credentials associated with the consumer identity, providing access to the remote client.
9 . The system of claim 8 , wherein the discovery operation further comprises communicating with a tenant directory to identify the consumer-identity-supported tenant environment that is mapped directly to the consumer identity of the user in the tenant directory.
10 . The system of claim 1 , the operations further comprising:
communicating the consumer identity from a client device to access the remote client;
based on communicating the consumer identity, receiving an identifier associated with the remote client;
accessing a user selection of the identifier that causes initialization of a user session on the remote client; and
signing into the user session on the remote client.
11 . One or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising:
accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities;
executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients;
communicating an indication that the organization is configured with the consumer-identity-supported tenant environment;
accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment;
based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and
deploying the remote client, wherein the remote client is accessible using the consumer identity.
12 . The media of claim 11 , wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment.
13 . The media of claim 12 , wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment.
14 . The media of claim 11 , wherein executing the first plurality of access orchestration operations further comprises:
generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment;
mapping a first consumer identity to the consumer-identity-supported tenant environment; and
assigning a license to the consumer identity in the consumer-identity-supported tenant environment.
15 . The media of claim 11 , wherein executing the second plurality of access orchestration operations further comprises:
provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity;
provisioning the remote client with the organization resources of the organization; and
priming the remote client with the consumer identity resources of the consumer identity.
16 . A computer-implemented method, the method comprising:
accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities;
executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients;
communicating an indication that the organization is configured with the consumer-identity-supported tenant environment;
accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment;
based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and
deploying the remote client, wherein the remote client is accessible using the consumer identity.
17 . The method of claim 16 , wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment.
18 . The method of claim 16 , wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment.
19 . The method of claim 16 , wherein executing the first plurality of access orchestration operations further comprises:
generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment;
mapping a first consumer identity to the consumer-identity-supported tenant environment; and
assigning a license to the consumer identity in the consumer-identity-supported tenant environment.
20 . The method of claim 16 , wherein executing the second plurality of access orchestration operations further comprises:
provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity;
provisioning the remote client with the organization resources of the organization; and
priming the remote client with the consumer identity resources of the consumer identity.