Microsoft Technology Licensing, LLC

Andrey Lukyanov

Rajmohan Rajagopalan

Shane Brady

Haruya Shida

Dmitry Dmitrievich Garaev

Colin Nash

Jaskaran Singh

Jon Barry Avner

Michael Allan Friedman

Vivek Sharma

Marc Andrew Power

Nicolae Voicu

Alexander MacLeod

Selim Yazicioglu

Wing Man Yim

James Nunn

Rage Hawley

Bryan Atwood

Brent Alinger

Carlos Gustavo Oseguera Guerrero

Jon Avner

A control plane in a computing system receives a request to perform a management task on a set of computing system resources. The control plane identifies a target scope on which the management task is to be performed and dynamically obtains permissions, for this specific request, to perform the management task on the resources in the identified target scope.

Dynamically acquiring scoped permissions to perform operations in compute capacity and resources

A payload is generated by a build computing system. The payload includes payload identifying metadata and deployment target identifier metadata, as well as an application container that includes a set of signed binaries. The payload can be approved for deployment, and a token can be generated for the payload. The token may include a set of claims that include payload identifying information. A payload validation system validates the payload for deployment to a target environment using the payload identifying information.

Validation of payload for deployment to a target environment

A cross-platform deployment computing system receives an application to be deployed to a cloud. The application is parsed to identify assignment criteria and is assigned to an application availability group the defines security that defines a topology in which the application will be deployed. The application is then provided to a control plane for deployment at a target remote server architecture. In order to deploy the application to a different remote server architecture, the control plane for the different remote server architecture accesses the deployment definitions in the AAG and deploys the application to the different remote server architecture using the deployment definitions in the AAG to which the application is assigned.

Cross-platform deployment of application

Large scale system operation may be provided. Upon receiving an action request from a user, a determination may be made as to whether the user requires elevated permissions to perform the action request. In response to determining that the user requires elevated permissions to perform the action request, the action request may be forwarded to a lockbox for evaluation and a permission response may be received from the lockbox.

Operating large scale systems and cloud services with zero-standing elevated permissions

A secret (e.g. a password, key, certificate) is automatically generated by a system. For example, at the time of deployment of a computing machine, a password may be generated and securely stored by the system with other secrets. The password may be used by the system to perform various operations (e.g. configuring the machine, . . . ). When a secret is requested by a user to access a resource, a secret is provided to the user. Once the secret has been utilized by the user, the secret is reset and replaced with a newly generated secret. All/portion of the secrets may also be automatically regenerated. For example, when a breach occurs and/or is suspected, each of the secrets may be replaced with newly generated secrets and securely stored. Auditing and reporting may also be provided (e.g. each request/access to a secret is logged).

Scalable and automated secret management

Command sequencing may be provided. Upon receiving a plurality of action requests, an ordered queue comprising at least some of the plurality of actions may be created. The actions may then be performed in the queue's order.

Superseding of recovery actions based on aggregation of requests for automated sequencing and cancellation

Alerts based on detected hardware and/or software problems in a complex distributed application environment are mapped to recovery actions for automatically resolving problems. Non-mapped alerts are escalated to designated individuals or teams through a cyclical escalation method that includes a confirmation hand-off notice from the designated individual or team. Information collected for each alert as well as solutions through the escalation process may be recorded for expanding the automated resolution knowledge base.

Automated recovery and escalation in complex distributed applications

Growing community of inventors

Redmond, WA, United States of America

Andrey Lukyanov