Microsoft Technology Licensing, LLC

Benjamin Richard Vincent

Ariel Nicolas Gordon

Octavian Tony Ureche

Nelly L Porter

Alexander Thomas Weinert

Vijay G Bharadwaj

Anooshiravan Saboori

Tarek Bahaa El-Din Mahmoud Kamel

Sarat Chandra Subramaniam

Tarek B Kamel

James Shang Kai Chou

Jeffrey Thomas Sakowicz

Ankur Patel

Yordan Ivanov Rouskov

Steven J Ball

Adrian Frei

Konstantin E Ryvkin

Marc David McClure

Geir Olsen

Dejan Subotic

Ross Peter Adams

Venkatesh Gopalakrishnan

Daniel E Castro

Stuart Lup-Sing Kwan

Li Qing Xia

Sparky Toews

Jay Fluegel

Paul H J Garner

Lesia Nalepa

Arielle Dorothy Crowe

Peter E Zenzerovich

Ran Michaely

Narender Chauhan

Steven James Ball

A least-privilege permission or permissions is automatically assigned to a client application in order to ensure that the client application is able to perform the bare minimum actions on a resource. The client application accesses the protected resource using a web API. The determination of the least-privilege permission(s) is based on actions previously performed on the resource by the client application. The identity provider monitors the actions performed on a resource by the client application and determines the bare minimum permission needed for the client application.

Automatic reduction of permissions for client applications

Generally discussed herein are devices, systems, and methods for guiding a user through a cloud application creation or deployment process using a development platform, the method performed by a checklist engine, the method comprising receiving, from the development platform, application data indicating a state of the cloud application, determining, based on the application data, that an item of a checklist has been completed, the checklist indicating tasks to be performed for configuring and securing the cloud application for deployment, storing data indicating the completed item is completed in a checklist data database, and causing a view of the checklist to be provided on a display.

Dynamic integration checklist for development platform

A multi-factor user authentication framework using asymmetric key includes a host device, a user agent, a gesture system, and an authentication system. The multiple factors include a user credential as well as a user gesture that indicates that the user is present. The user interacts with the user agent via the host device in order to obtain access to something for which user authentication is needed. The authentication system maintains the user credentials, which are provided to authenticate the user in response to the authentication system determining that the user is present (which can be determined in different manners, such as using a personal identification number (PIN), biometric information regarding the user, geographic location of the gesture system, etc.). The user agent, gesture system, and authentication system can be implemented on the same device (e.g., the host device), or alternatively implemented across one or more different devices.

Multi-factor user authentication framework using asymmetric key

Performing late binding of a social network identification (ID) to a guest ID for use in an identity platform. A guest ID is created for a second user that gives access to a shared application of an identity platform that is associated with a first user. Subsequent to creating the guest ID, permission is requested from the second user to bind social network IDs of social networks of which the second user is a member to the guest ID. In response to receiving permission, binding the social network IDs to the guest ID is performed. The binding gives the identity platform access to profile attributes of the second user from the social networks, and allows it to write information such as a merit badge back on the second user's social network profile. A federation binding may also be created that allows the second user to sign into the shared application using their social network ID.

Late binding of social identity in invitation management systems

Authenticating an E-tournament identity using personal identity credentials. A method includes determining that a gaming device is configured for use in an E-tournament. The method further includes receiving from the device, user personal identity credentials. As a result, the method further includes, signing in to an E-tournament identity using the personal identity credentials.

Methods for provisioning and management of gamer accounts for E-tournaments

Described technologies enhance cybersecurity and facilitate computing system account usage by configuring a primary account and a supplementary account together in a security configuration lifecycle. The primary account user may be a parent or other adult, while the supplementary account user may be a child or other person with less capacity than the primary user. Over time, the accounts may transition together through security configurations to give more capabilities to the supplementary user, e.g., login separate from the primary user, and to reduce the control of the primary user over the supplementary account. Security configuration lifecycle stages are implemented, e.g., using capability-security pair data structures and account security configuration code. Despite the security configuration linkage of the accounts, each account may have its own personalized content and its own recommendation history. Lifecycle position identification supports automatic reasoning to select an age-appropriate consent obtention procedure, and facilitates documentary media timeline creation.

Security configuration lifecycle account protection for minors

The automatic selection of an identity provider to be used to authenticate users when requesting to access network resources for a tenant. The authentication is initiated by checking the username against the directory of the tenant. If that check results in finding an entry for the username in that directory, the entry is checked for an identity provider. If that check results in finding an identity provider, the user is directed to that found identity provider for authentication. Thus, in many, most, or all cases, an identity provider is found and selected for authentication of the user without the user having to manually select the identity provider. The username may be an internal user of an entity. The selection of the identity provider works in either case since there would still be an entry for that user in the directory of the tenant.

Resource-based selection of identity provider

A system for creating an account with an identity provider. The system receives a request to create an identity provider account with the identity provider for use in logging onto a third-party system. The system generates one or more display pages for providing an integrated-consent user experience. The integrated-consent user experience includes a display page for collecting both new-account information and scope-of-consent information whereby a user consents to share information with the third-party system. After the user provides the new-account information that includes user credentials for the identity provider account and consents to share account information of the identity provider account with the third-party system, the system creates the identity provider account for the user. When the user subsequently signs in to the third-party system using the user credentials for the identity provider account, the third-party system accesses account information of the identity provider account based on the scope-of-consent information.

Integrated consent system

A method and system for authenticating a user is provided. In some embodiments, a security system determines whether the time since the last authentication was successful is less than a recycle telephone number period (e.g., the minimum time before which a telephone number might be assigned to a new user). If the time is less than the recycle telephone number period, the security system performs a primary authentication of the user based on a telephone number received from the user. When the primary authentication is successful, the security system indicates that the user has been authenticated. When the time is not less than a recycle telephone number period, the security system performs a secondary authentication of the user. When the secondary authentication is successful, the security system indicates that the user has been authenticated.

Authentication based on telephone number recycling

Allowing an entity managed device to access a tenant associated with the e on a public cloud service while preventing the device from accessing one or more other tenants on the cloud service. A method includes, at the cloud service, obtaining policy from the entity with respect to tenant access. The method further includes, at the cloud service, receiving a request from the entity managed device to access a tenant at the cloud service. The method further includes granting or denying the access request based on the policy obtained from the entity.

Restricting access to public cloud SaaS applications to a single organization

A method and system for controlling casting to a media renderer is provided. A casting control system receives from a requesting device a request to cast media to the media renderer. In response to receiving the request, the casting control system identifies a gatekeeper for the media renderer and notifies the gatekeeper that a request has been received to cast media to the media renderer. After the casting control system receives from the gatekeeper an indication to grant or deny the request, the casting control system allows or denies the casting of the media to the media renderer.

Control of casting to a media renderer

Automated device discovery of pairing-eligible devices for authenticating an unidentified user of a computing device is provided. When the user initiates a login on the computing device on which the user's identity is not known, an automated pairing-eligible device discovery authentication system interrogates a resource (e.g., subnetwork router, calendaring server) for identifying pairing-eligible devices that may be used as a second factor for authentication. A list of the pairing-eligible devices is presented to the user on the computing device. Upon selection of a pairing-eligible device to use as a second factor to verify the user's identity, the user's identity is determined, and a notification is sent to the selected pairing-eligible device for enabling the user to verify his/her identity using a second factor. Upon completion of an authentication challenge on the selected pairing-eligible device, authentication of the user is completed, and a signed token is sent to the computing device.

Automated device discovery of pairing-eligible devices for authentication

Authenticating issues involving the re-authenticating of a first device that was previously authenticated are resolved by use of a second device which receives a notification of the failed authentication. The second device sends a response to the notification which is operable to facilitate re-authentication of the primary device and without requiring the user to provide credentials at the first device prior to obtaining the re-authentication at the primary device and/or without requiring the primary device to obtain a code to be entered into the secondary device and/or prior to the primary device being notified of a failure condition associated with the primary device.

Growing community of inventors

Kirkland, WA, United States of America

Benjamin Richard Vincent