Microsoft Technology Licensing, LLC

Anshul Dube

Shankaranand Arunachalam

Andrew Burke Ryan

Parul Manek

Ganesh Pandey

Robert Allen Lowe

Brian Alan Day

Jason Craig Nelson

Dmitri Gavrilov

Steven Mark Silverberg

Gokay Hurmali

Xiaoqin Zhu

Kamil Krzywicki

Md Mainul Mizan

Matthias Adam Leibmann

Vipul Agarwal

Vikas Ahuja

Billy Goethetaro Norcilien

Virat Satyam Mishra

Kimberly Gail Del Rosario Cabamalan

Jeff Todd Kizner

Connor David Copus

Ankita Mishra

Seyed Mohammad Kiaei

Chun Hung Lin

A cross-tenant authentication system is described. The system receives a user token from a client device that is registered with a first tenant of a service application of a server. The system receives a request, from the client device, to access a second feature of a second tenant of the service application. The second feature of the second tenant of the service application is separate from a first feature of the first tenant of the service application. The second feature is only accessible to devices registered with the second tenant of the service application. The system authenticates the request by validating the user token from the client device and determines a cross-tenant policy of the second tenant of the service application based on the user token. The system forms an identity object based on the cross-tenant policy.

User permission in a multi-tenant environment

A batching system accesses user interaction data to identify relationships between users and between users and resources. The relationships are weighted and users are grouped for migration based upon the weighted relationships. The groups are displayed for administrator interaction and are provided to a migration system for migration of the users between two tenants. This enhances migration efficiency and accuracy and makes migration much less disruptive to the end users.

Extracting user interactions to generate batches for migration between tenants

Examples of the present disclosure describe systems and methods for migrating mailbox identities. In aspects, a system may receive one or more requests to perform tasks for migrating identities of a plurality of mailboxes included in a security group created at a source tenant to a plurality of mail users created at a target tenant that correspond to the plurality of mailboxes. Based on the one or more requests, the system may copy the identities to a data store associated with the target tenant, upload mapping data to the data store, and use that mapping data to map the identities copied to the data store to the corresponding plurality of mail users in the target tenant. For each of the identities mapped, the system may copy at least one or more attributes of the respective identity from the data store to the respective corresponding mail user in the target tenant.

Distributed deduplication of incoming cloud computing requests

Cloud computing system for mailbox identity migration

A client application is specified by a target tenant and represented in an OAuth provider, along with a corresponding secret. A source tenant consents to permissions to be executed by the client application on a resource of the source tenant. A target service uses the secret to obtain an access token from an authorization server coupled to the source tenant and uses the access token to obtain access, specified by the permissions, to the resource served by a source service acting on behalf of the source tenant.

Authentication framework for resource access across organizations

A service computing system receives an API call in which an authorization token, that contains an identifier in the content of the authorization token, is included in a header of the API call. The identifier is also included as a parameter passed in with the API call. The service computing system parses the API call to obtain the authorization token, and the identifier included in the authorization token. It also obtains the identifier passed in as a parameter of the API call. The service computing system compares the identifier obtained from the authorization token to the identifier passed in as a parameter of the API call to determine whether they match. If they do not match, the API call is processed as an unauthorized API call. A security system in the service computing system authorizes the API call based on the comparison.

Client-server security enhancement using information accessed from access tokens

Growing community of inventors

Brooklyn, NY, United States of America

Anshul Dube