Microsoft Technology Licensing, LLC

Daniel Edward Lee Wood

Dilesh Dhokia

Sarat Chandra Subramaniam

Caleb Geoffrey Baker

Carlos Adrian Lopez Castro

Etan Micah Basseri

Pui Yin Winfred Wong

Sandra Jiang

Jessica Tian-Hueih Lin

Caleb Geffrey Baker

Robyn Nicole Hicock

Techniques are described herein that are capable of evaluating a result of enforcement of access control policies instead of enforcing the access control policies. For instance, a result of enforcement of an access control policy with regard to sign-in processes is evaluated instead of enforcing the access control policy with regard to the sign-in processes. The evaluation includes monitoring access requests that are received during the sign-in processes. Each access request requests access to a resource. The evaluation further includes comparing attributes of each access request against the access control policy that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the respective access request. Metadata associated with the sign-in processes is generated instead of enforcing the access control policy with regard to the sign-in processes.

Evaluating a result of enforcement of access control policies instead of enforcing the access control policies

Disclosed in some examples, are methods, systems, and machine-readable mediums for identifying security vulnerabilities across a plurality of access control policies. An administrator of the computing resource may be alerted to these vulnerabilities to allow the administrator to craft a policy, or modify an existing policy, to close these security gaps. In other examples, the system may automatically suggest and/or apply a modification to an existing policy or a new access control policy that closes the security gaps. The vulnerabilities may be determined based upon a comparison of the access control policy criteria in the previously set access control policies and a set of possible values of access control signals to determine access scenarios that are not covered by the access control policies.

Method and systems for analyzing security coverage of a set of enterprise access management policies

Growing community of inventors

Seattle, WA, United States of America

Daniel Edward Lee Wood