Microsoft Technology Licensing, LLC

Murli D Satagopan

Jeffrey Bruce Parham

Mark Robbin Brown

Kim Cameron

Anandhi Somasekaran

Richard Bruce Ward

Ariel Nicolas Gordon

Praerit Garg

Bhalchandra Pandit

Colin Harrison Brace

Clifford P Van Dyke

Girish Chander

Titus Constantin Miron

Seshadri Mani

Jonathan M Luk

Don Hacherl

Brendan W Dixon

Raman Nagaraj Chikkamagalur

Ziad Elmalki

Sergii Gubenko

Paul J Leach

William R Taylor

Caleb Geoffrey Baker

Donald J Hacherl

Donald E Schmidt

Andy Harjanto

Matthew S Rimer

Nitin Karmarkar

Haytham Abuel-Futuh

Cristian Marius Ilac

Yordan Ivanov Rouskov

Melissa Wood Dunn

Arun K Nanda

Hervey O Wilson

William Alexander Stevenson

Anthony Christopher Bloesch

James Charles Kleewein

Ziyi Wang

Walter R Smith

Jeroen Vanturennout

David Michael Sauntry

Kevin T Damour

Madan Mohan R Appiah

Vikrant Arora

Robert P Reichel

Dave D Straube

Oren Jordan Melzer

Naresh Kannan

Violet Anna Barhudarian

Michael Richard Yagley

Gregory C Johnson

Karthik Jaganathan

Robert McKee Howard

Anirban Basu

Erik R Ashby

Edward Wu

Daniel Kershaw

Vijayavani Nori

Peter Gregg Miller

Jiangfeng Lu

Chandra Sekhar Surapaneni

Stuart Kwan

Hongzhou Ma

Igor Sakhnov

Sriram Dhanasekaran

Dmitry Pugachev

Ananda Sinha

Robert Charles Ward

Yina Arenas

Jon Rosenberg

Maksym Kryatov

Tarek Bahna El-Din Mahmoud Kamel

Todd F Stecher

William David Taylor

Dave Detlef Staube

Chris L Mayhall

Nitika Gupta

Samantha Kwok

Vineeth Madhusudanan

Thane David Peterson

Richard William Meadows

Marek Rycharski

Vijaya Manohararaj

Raman N Chikkamagalur

Titus C Miron

Methods, systems, apparatuses, and computer-readable storage mediums are described for authorizing publishing of a message and/or a subscription from an Internet of Things (IoT) device. In an example system, a message broker receives a list of attributes from a claims provider. The message broker determines whether publishing of the message is authorized based at least on the list of attributes, and publishes the message if it is determined that the publishing is authorized. The message broker may also receive a subscription specifying a topic filter. The message broker determines whether the subscription is authorized for the IoT device based at least on the list of attributes, and transmits a subscription message to the IoT device if it is determined that the subscription is authorized.

Efficient attribute-based access control authorization for a message broker

Managing an authenticated user session. A method includes a resource provider computer system subscribing to a conditional access termination service for an entity configured to obtain resources from the resource provider computer system through a user session. The resource provider computer system receives an event, related to resource requests, for the entity from the conditional access termination service. The resource provider computer system receives a request for resources from the entity. The resource provider computer system evaluates the request with respect to the event. The resource provider computer system responds to the request based on evaluating the request with respect to the event.

Instant enforcement of centrally configured IT policies

Network services may include data associated with one or more entities. An aggregator service may host respective application programming interfaces (APIs) of the services at a single endpoint of the network such that the entities, including associations and relationships between entities, may be federated. For example, the services may register the entities of which the data of each of the services is associated with through a declarative entity model to establish an API schema for each of the services, which may be published at the aggregator service. In response to receipt of a request for entity related data from a client, the aggregator service may employ the declarative entity model to determine which of the services are associated with the entity related data such that a query may be submitted to the services, and how to aggregate responses to the query received from the services for transmission to the client.

Aggregation and federation of distributed service entities and associations

Directory information and content for two separate tenants are merged by identifying a first of tenants as a hub tenant and a second of the tenants as a satellite tenant. The hub tenant is modified to include two instances, or data containers, one instance for the hub tenant and another instance for the satellite tenant. Directory merger logic re-associates identity account items in the satellite instance, with the hub instance, by replacing a tenant identifier in the identity account items of the satellite instance with a tenant identifier corresponding to the hub instance. Unique identifiers for users of the satellite instance are maintained unchanged. Content merger logic re-associates content items of the satellite instance with the hub instance by setting a tenant identifier for all satellite content items to the tenant identifier corresponding to the hub instance. A tenant identifier corresponding to backend services that support the content items can be updated to the tenant identifier corresponding to the hub instance as well.

Single multi-instance tenant computing system

A computer-implemented method for a security endpoint of a non-isolated computing environment includes receiving a login request related to an application within that environment. The login request corresponds to a user of the application. The method includes sending a lookup query, including information related to an identity of the user, to a directory service. The method includes receiving a lookup response from the directory service. The method includes, in response to the lookup response indicating that the user belongs to the non-isolated computing environment, requesting an authentication credential from a client device of the user, validating the authentication credential, and in response to successful validation of the authentication credential, providing an identity token to the client device. The method includes, in response to the lookup response indicating that the user belongs to an isolated computing environment, redirecting the client device to a security endpoint of the isolated computing environment.

Cross cloud application access

A system includes a target directory service, a domain mesh with a plurality of domains, and a synchronization host coupled to the domain mesh. The synchronization host is configured to synchronize password changes received in the domain mesh with the target directory service. Synchronizing the password changes includes receiving at the synchronization host a hash value representative of a plaintext password from the domain mesh, performing at the synchronization host an additional hash on the hash value to generate protected password data, and exporting the protected password data from the synchronization host to the target directory service.

Synchronizing credential hashes between directory services

The subject disclosure is directed towards securely synchronizing passwords that are changed at a source location (e.g., an on-premises directory service) to a target location (e.g., a cloud directory service), so that the same credentials may be used to log into the source or target location, yet without necessarily having each domain controller handle the synchronization. The plaintext password is not revealed, instead using hash values computed therefrom to represent the password-related data. The target may receive a secondary hash of a primary hash, and thereby only receive and store a password blob. Authentication is accomplished by using the same hashing algorithms at the target service to compute a blob and compare against the synchronized blob. Also described are crypto agility and/or changing hashing algorithms without requiring a user password change.

A session token can be requested to be sent to a first computing service from a second computing service, and a first computing service can receive the requested session token from the second computing service. The first computing service can send a message that includes the session token through a passive client to the second computing service. The second computing service can receive the message that includes the session token from the passive client, and the second computing service can verify that the message is valid. This verification of the validity of the message can include verifying that the session token received back from the passive client matches the session token the second computing service sent to the first computing service.

Sending session tokens through passive clients

Embodiments described herein are directed to providing scalability to software applications. A computer system partitions a portion of data stored in a directory services system into multiple different data partitions. Each data partition includes a primary writable copy and at least one secondary read-only copy of the data. The computer system receives a client request for a portion of the data that is stored in the directory services system and accesses various stored partition mappings to determine which of the different data partitions includes the requested data. The computer system also accesses a dynamic copy locator to determine which of the read-only copies of the indicated partition to access and provide the accessed primary writeable copy of the indicated partition and the determined read-only copy to the client in a virtualized manner so that the client is not aware of the data partitions.

Cloud scale directory services

A computer-implemented method for authorizing access by a client application to a resource of a user maintained on a first server computing system, the client application being implemented on a second server computing system, includes receiving a delegation message from the first server computer system to initiate authorization of the access by the client application, issuing an authorization message to the first server computer system, the authorization message comprising an authorization data package for redemption by the client application, the authorization data package comprising first through fourth integral delegation data indicative of the user, the client application, the resource, and a timestamp, respectively, receiving a redemption message from the second server computing system comprising the authorization data package, conducting an analysis of the authorization data package, and sending an access token to the second server computing system based on the analysis.

Authorization messaging with integral delegation data

Coexistence tools are described for synchronizing properties between on-premises customer locations and remote hosting services. These tools may provide methods that send the tools for installation onto on-premises infrastructure located at customer sites, execute the tools to manage the customer infrastructure remotely via a hosted service, and synchronize properties at the customer site with the hosted service. Other methods may include receiving the tools from the hosted service, communicating configuration parameters related to operating the tools, and executing the tools in response to the configuration parameters. The tools may also provide systems that include on-premises servers associated with the customer infrastructure, with the on-premises servers including on-premises coexistence components for maintaining the property at the customer site. These systems may also include administrative servers associated with the hosted service. The administrative servers may include hosted-side coexistence components for maintaining and synchronizing counterparts of the on-premises properties.

Coexistence tools for synchronizing properties between on-premises customer locations and remote hosting services

Automatic allocation of data replicas

Growing community of inventors

Bellevue, WA, United States of America

Murli D Satagopan