Computing system providing SaaS application access with different capabilities based upon user personas
A computing system may include at least one client computing device and a server configured to authenticate the at least one client computing device based upon a user account, with the user account having an enterprise persona and a private persona associated therewith. The server may be further configured to determine whether the enterprise persona or the private persona is active based upon a context associated with the at least one client computing device. When the enterprise persona is active, the server may provide access to a Software as a Service (SaaS) application with a first set of capabilities enabled, and when the private persona is active, the server may provide access to the SaaS application with a second set of capabilities enabled that is different than the first set of capabilities.
1. A computing system comprising:
at least one client computing device; and
a server configured to
log the at least one client computing device into a user account, the user account having an enterprise persona and a private persona associated therewith, and
while the at least one client computing device is logged into the user account,
determine whether the enterprise persona or the private persona is active based upon a context associated with the at least one client computing device,
when the enterprise persona is active, provide the at least one client computing device with access to a Software as a Service (SaaS) application with a first set of capabilities enabled, and
when the private persona is active, provide the at least one client computing device with access to the SaaS application with a second set of capabilities enabled that is different than the first set of capabilities;
wherein the first set of capabilities includes access to data from other user accounts, and the second set of capabilities includes access only to data from the user's respective account.
2. The computing system of claim 1 wherein the server determines whether the enterprise persona or the private persona is active based upon a location of the client computing device.
3. The computing system of claim 1 wherein the server determines whether the enterprise persona or the private persona is active based upon a type of data to be accessed by the at least one client computing device.
4. The computing system of claim 1 wherein the first and second sets of capabilities are associated with different respective data loss prevention (DLP) access levels.
5. The computing system of claim 1 wherein the server provides access to a first instance of the SaaS application with a first set of capabilities enabled for the enterprise persona, and provides access to a second instance of the SaaS application with the second set of capabilities enabled for the private persona.
6. The computing system of claim 5 wherein the server is further configured to migrate between the first and second instances of the SaaS application while the at least one client computing device remains authenticated based upon a change in the context.
7. The computing system of claim 1 wherein the first set of capabilities includes data recording, and the second set of capabilities does not include data recording.
8. A method for using a server comprising:
logging at least one client computing device into a user account, the user account having an enterprise persona and a private persona associated therewith; and
while the at least one client computing device is logged into the user account,
determining whether the enterprise persona or the private persona is active based upon a context associated with the at least one client computing device,
when the enterprise persona is active, providing the at least one client computing device with access to a Software as a Service (SaaS) application with a first set of capabilities enabled, and
when the private persona is active, providing the at least one client computing device with access to the SaaS application with a second set of capabilities enabled that is different than the first set of capabilities;
wherein the first set of capabilities includes access to data from other user accounts, and the second set of capabilities includes access only to data from the user's respective account.
9. The method of claim 8 wherein the first and second sets of capabilities are associated with different respective data loss prevention (DLP) access levels.
10. The method of claim 8 wherein determining comprises determining whether the enterprise persona or the private persona is active based upon a location of the client computing device.
11. The method of claim 8 wherein determining comprises determining whether the enterprise persona or the private persona is active based upon a type of data to be accessed by the at least one client computing device.
12. The method of claim 8 wherein the first set of capabilities includes data recording, and the second set of capabilities does not include data recording.
13. The method of claim 8 wherein providing access to the SaaS application further comprises providing access to a first instance of the SaaS application with a first set of capabilities enabled for the enterprise persona, and providing access to a second instance of the SaaS application with the second set of capabilities enabled for the private persona.
14. The method of claim 13 further comprising migrating between the first and second instances of the SaaS application while the at least one client computing device remains authenticated based upon a change in the context.
15. A non-transitory computer-readable medium having computer-executable instructions for causing a server to perform steps comprising:
logging at least one client computing device into a user account, the user account having an enterprise persona and a private persona associated therewith; and
while the at least one client computing device is logged into the user account,
determining whether the enterprise persona or the private persona is active based upon a context associated with the at least one client computing device,
when the enterprise persona is active, providing the at least one client computing device with access to a Software as a Service (SaaS) application with a first set of capabilities enabled, and
when the private persona is active, providing the at least one client computing device with access to the SaaS application with a second set of capabilities enabled that is different than the first set of capabilities;
wherein the first set of capabilities includes access to data from other user accounts, and the second set of capabilities includes access only to data from the user's respective account.
16. The non-transitory computer-readable medium of claim 15 wherein the first and second set of capabilities are associated with different respective data loss prevention (DLP) access levels.
17. The non-transitory computer-readable medium of claim 15 wherein determining comprises determining whether the enterprise persona or the private persona is active based upon a location of the client computing device.