Microsoft Technology Licensing, LLC

Ariel Nicolas Gordon

Sarat Chandra Subramaniam

Benjamin Richard Vincent

Yordan Ivanov Rouskov

Murli D Satagopan

Girish Chander

Titus Constantin Miron

Mansoor Jafry

Jonathan M Luk

Anandhi Somasekaran

Arvind Muthukrishnan

Samuel Devasahayam

Venkatesh Gopalakrishnan

Raman Nagaraj Chikkamagalur

Lu Zhao

Ziad Elmalki

Sergii Gubenko

Ramakrishna Juluri

Timothy Colin Larson

Richard Allen Lundeen

David J Nicholson

Paul Garner

Parmeshwar Miguel Sequeira Arewar

Sakshi Tiwari

Aaron Kyle Damashek

Ankur Patel

David Steeves

Michael B Jones

Krishna C Vitaldevara

Arun K Nanda

Jason D Walter

Steven J Ball

Pui-Yin Winfred Wong

Sam Franklin Williams, Iii

Manish Kumar Shukla

Luke Abrams

Oren Jordan Melzer

Andrew Smith

Hanan Shteingart

Konstantin E Ryvkin

Eric Wayne Doerr

Charles Ronald Reeves, Jr

Ross Peter Adams

Michael Robert Van Waardhuizen

Jonathan Gazit

William Thomas

Stuart Lup-Sing Kwan

John Araya

Rachel Anne Brown Teller

Kristina Karen Hotz

Sadie Elise Henry

Vittorio Luigi Bertocci

Balagopal Chenicheri

Jonathan Yoder Brenner

Ben Vincent

Jesus Ferrer Labayen

Megan M Rawley

Tia Bianca Caldwell

Amy Caryl Nathanson

Parmeshwar Arewar

John H Forrest

Angus P D Logan

Mark Ryland

Ibrahim A Damlaj

Paul H J Garner

Somak Bhattacharyya

Brandon Werner

John Erik Araya

Steven James Ball

Raman N Chikkamagalur

Luke T Abrams

David J Steeves

Pui-Yin Wong

Disclosed in some examples, are methods, systems, devices, and machine-readable mediums that use one or more images (e.g., Quick-Response (QR) codes) displayed by a first application to both provide the location to obtain a second application and to copy a session from the first application to the second application once downloaded. In some examples, a session comprises an authentication session such that, when the session is copied, the user is logged into a network-based service within the second application with a same account as the user is already logged into with first application.

Intelligent download and session copy

A device including a processor and a memory, in which the memory includes executable instructions for detecting that a first user has invited a second user to a communication session, wherein the first user is associated with a first user account registered to a first domain platform and the second user is not associated with any of user accounts registered to the first domain platform, the first domain platform defining a first user privilege granted to the user accounts registered to the first domain platform; causing a second user account associated with the second user to be created and registered to a second domain platform, the second domain platform being different from the first domain platform and defining a second user privilege granted to user accounts registered to the second domain platform; and granting the second user account the second user privilege.

Extended domain platform for nonmember user account management

Methods, systems, apparatuses, and computer program products are provided for automatically determining a home realm. An authentication request receiver interface may receive a request to access a resource and a device identifier from a client device. An authenticator may be enacted in response to receiving the request to access the resource that includes a home realm discoverer and an authentication user interface (UI) provider. The home realm discoverer may determine, based at least on the device identifier, the home realm from a plurality of realms. The authentication UI provider may provide, to the client device, an authentication UI via which a flat-name username can be submitted. Based at least on a flat-name user name and the determined home realm, access to the resource may be granted. In this manner, a user may input a flat-name username during sign-in, rather than inputting a realm or an entire e-mail address.

Home realm discovery with flat-name usernames

Techniques for managing access to content are provided that include receiving a first signal requesting an indication whether a user has an access privilege to access to a resource associated with a first tenant of an access management service or perform an operation by a data processing system using the resource, determining that a first user account associated with the user does not have an access privilege to access the resource; performing a nested access privilege check to determine whether the user is associated with a second user account that has the access privilege to access the resource; and granting via the communication network access to the resource responsive to the nested access privilege check determining that the user is associated with the second user account and the second user account is associated with the access privilege to access the resource.

Nested access privilege check for multi-tenant organizations

Methods for authentication session transfer using application download links are performed by systems and devices. A user or administrator at a first device enables the user to use an application at the user's mobile device. The user or administrator provides a request for the mobile application from the first device to an identity service. The identity service generates a uniform resource locator (URL) that encodes an authentication object generated by the identity service that is specific to the user's identity, and provides the URL to the mobile device. The identity service receives the authentication object back from a browser session of the URL at the user device, and establishes an authenticated browser session of the URL using the authentication object. The identity services authenticates the user's identity for the mobile application responsive to the mobile application invoking the authenticated browser session at the user device.

System and method for authentication session transfer using application download links

Suspicious credential changes are automatically detected and mitigated. A comparison of data surrounding user-account credential changes with suspicious change patterns forms a basis for detecting suspicious credential changes. More particularly, if a credential change substantially matches a known suspicious change pattern, the credential change can be flagged as suspicious. After a credential change is determined to be suspicious, one or more mitigation activities can be triggered to allay adverse effects associated with a suspicious credential change.

Suspicious credential change detection and mitigation

A limited purpose account can be provided to a legitimate user to avoid some types of anti-abuse mechanisms from being triggered when the user connects to an identity verifier using a username known to belong to a limited purpose account. A limited purpose account is an account in which certain privileges of ordinary use are disabled or curtailed. A limited purpose account may be an account that can only be used with a limited number of applications or for a limited amount of time, thus reducing the ability of the limited purpose user to gain unauthorized access to resources. The operating system can reset itself to a previous state when the account is disconnected or when the device is turned off.

Altering device behavior with limited purpose accounts

The techniques disclosed herein enable systems to utilize the network effect of end-user viral adoption of collaborative services and applications hosted by multi-tenant computing systems. A system can achieve this by automatically clustering users who independently send requests to generate new tenants. A number of factors can enable a system to cluster users into a single tenant including characteristics of requests to generate new tenants and/or member identities received in association with requests to generate new tenants. Examples of request characteristics can include network addresses indicating a source of each request, a domain name or entity names received in association with a request, a rate in which requests are received, and/or heuristic techniques that utilize various combinations of these and other factors. The automatic selection of users for specific tenants allows a system to allow viral user adoption without a centralized IT manager.

Automatic clustering of users for enabling viral adoption of applications hosted by multi-tenant systems

Performing late binding of a social network identification (ID) to a guest ID for use in an identity platform. A guest ID is created for a second user that gives access to a shared application of an identity platform that is associated with a first user. Subsequent to creating the guest ID, permission is requested from the second user to bind social network IDs of social networks of which the second user is a member to the guest ID. In response to receiving permission, binding the social network IDs to the guest ID is performed. The binding gives the identity platform access to profile attributes of the second user from the social networks, and allows it to write information such as a merit badge back on the second user's social network profile. A federation binding may also be created that allows the second user to sign into the shared application using their social network ID.

Late binding of social identity in invitation management systems

Authenticating an E-tournament identity using personal identity credentials. A method includes determining that a gaming device is configured for use in an E-tournament. The method further includes receiving from the device, user personal identity credentials. As a result, the method further includes, signing in to an E-tournament identity using the personal identity credentials.

Methods for provisioning and management of gamer accounts for E-tournaments

An identity provider IP service provides an optimized sign out experience for a user accessing a single account service. The IP service designates a first account of a service as signed in based on first credentials provided by a user. The IP service provides a first security token for the first account to the service. Upon receiving a first sign out notification, the IP service determines whether the user wants to switch to a second account of the service. Upon determining that the user wants to switch to the second account, the IP service designates the second account as signed in based on second credentials provided by the user, provides a second security token for the second account to the service, and designates the first account as soft signed out so that the user can switch to the first account without re-providing the first credentials.

Optimized sign out for single account services

Described technologies enhance cybersecurity and facilitate computing system account usage by configuring a primary account and a supplementary account together in a security configuration lifecycle. The primary account user may be a parent or other adult, while the supplementary account user may be a child or other person with less capacity than the primary user. Over time, the accounts may transition together through security configurations to give more capabilities to the supplementary user, e.g., login separate from the primary user, and to reduce the control of the primary user over the supplementary account. Security configuration lifecycle stages are implemented, e.g., using capability-security pair data structures and account security configuration code. Despite the security configuration linkage of the accounts, each account may have its own personalized content and its own recommendation history. Lifecycle position identification supports automatic reasoning to select an age-appropriate consent obtention procedure, and facilitates documentary media timeline creation.

Security configuration lifecycle account protection for minors

Growing community of inventors

Kirkland, WA, United States of America

Ariel Nicolas Gordon