Granted Patent B2

US 12,739,236 · App. 18/905,977 · Granted Sep 15, 2026

Inventors: Ariel Nicolas Gordon (Brooklyn, NY); Muhammad Ali Malik (Sammamish, WA); Kundan Bharti (Redmond, WA)

Assignee: Microsoft Technology Licensing, LLC

H04L63/0807H04L63/102

Abstract

Claims (79)

1 . A method for access management in a network-based service, the method comprising:

identifying, at a server of the network-based service, an action involving a first account used by a user to access resources;

determining, at the server of the network-based service, that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response:

identifying, at the server of the network-based service, an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account;

determining, at the server of the network-based service, according to the account policy, that the second account referenced in the identity data structure allows for taking the action;

sending, at the server of the network-based service, a transmission to a device of the user via the first account of the user, the transmission identifying the second account;

receiving, at the device of the user, the transmission;

selecting, at the device of the user, an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account;

transmitting, at the device of the user, the access token to the server of the network-based service;

receiving, at the server of the network-based service, the access token from the device of the user; and

responsive to the server of the network-based service validating that the access token received from the device of the user is valid and allows the action, the server causing performance of the action involving the user.

2 . The method of claim 1 , wherein the identity data structure includes different account types that are required to access different actions within a first tenant.

3 . The method of claim 1 , further comprising, at the server of the network-based service:

responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and

responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention.

4 . The method of claim 1 , further comprising, at the server of the network-based service:

creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account.

5 . The method of claim 4 , wherein the attribute is one of: an email address, a phone number, or an internet protocol address.

6 . The method of claim 1 , further comprising, at the server of the network-based service:

identifying that the second account was created based upon the first account, and in response, creating the identity data structure associating the first and second accounts.

7 . The method of claim 1 , wherein the action is sharing content.

8 . The method of claim 1 , further comprising:

identifying, in the network-based service, a first action and a second action associated with a first tenant, the first action requiring a first privilege level and the second action requiring a second privilege level;

determining that the first account does not have the first privilege level to perform the first action;

identifying that the second account has the second privilege level to perform the first action;

sending a transmission to the first account of the user, the transmission causing a computing device of the user to utilize an associated token of the second account to perform the first action;

determining that the first and second accounts do not have the required privilege level to perform the second action;

identifying, in the identity data structure, a third account that has the required privilege level to perform the second action;

sending a transmission to the first account of the user, the transmission causing the computing device of the user to utilize an associated token of the third account to perform the second action; and

determining that if the third account is not included in the identity data structure, the user cannot perform the second action.

9 . A computing device for access management in a network-based service, the computing device comprising:

a hardware processor;

a memory, the memory storing instructions, which when executed by the hardware processor cause the computing device to perform operations comprising:

identifying an action involving a first account used by a user to access resources;

determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response:

identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account;

determining, according to the account policy, that the second account referenced in the identity data structure allows for taking the action;

sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account;

receiving the transmission at the device of the user;

selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account;

transmitting the access token to the server of the network-based service;

receiving the access token from the device of the user; and

responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user.

10 . The computing device of claim 9 , wherein the identity data structure includes different account types that are required to access different actions within a first tenant.

11 . The computing device of claim 9 , wherein the operations further comprise:

responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and

responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention.

12 . The computing device of claim 9 , wherein the operations further comprise:

creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account.

13 . The computing device of claim 12 , wherein the attribute is one of: an email address, a phone number, or an internet protocol address.

14 . The computing device of claim 9 , wherein the operations further comprise:

identifying that the second account was created based upon the first account, and in response, creating the identity data structure associating the first and second accounts.

15 . The computing device of claim 9 , wherein the action is sharing content.

16 . The computing device of claim 9 , wherein the operations further comprise:

identifying a first action and a second action associated with a first tenant, the first action requiring a first privilege level and the second action requiring a second privilege level;

determining that the first account does not have the first privilege level to perform the first action;

identifying that the second account has the second privilege level to perform the first action;

sending a transmission to the first account of the user, the transmission causing a computing device of the user to utilize an associated token of the second account to perform the first action;

determining that the first and second accounts do not have the required privilege level to perform the second action;

identifying, in the identity data structure, a third account that has the required privilege level to perform the second action;

sending a transmission to the first account of the user, the transmission causing the computing device of the user to utilize an associated token of the third account to perform the second action; and

determining that if the third account is not included in the identity data structure, the user cannot perform the second action.

17 . A non-transitory machine-readable medium, storing instructions for access management in a network-based service, the instructions, which when executed, cause the machine to perform operations comprising:

identifying an action involving a first account used by a user to access resources;

determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response:

identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account;

determining, according to the account policy, that the second account referenced in the identity data structure allows for taking the action;

sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account;

receiving the transmission at the device of the user;

selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account;

transmitting the access token to the server of the network-based service;

receiving the access token from the device of the user; and

responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user.

18 . The non-transitory machine-readable medium of claim 17 , wherein the identity data structure includes different account types that are required to access different actions within a first tenant.

19 . The non-transitory machine-readable medium of claim 17 , wherein the operations further comprise:

responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and

responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention.

20 . The non-transitory machine-readable medium of claim 17 , wherein the operations further comprise:

creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account.

Assignments (1)

Continuity (1)

References Cited (18)