Microsoft Technology Licensing, LLC

Pretish Abraham

Vladimir V Grebenik

Jason Todd Henderson

Oleg Ouliankine

Andrew Salamatov

Sudhakar Pasupuleti

Philip Yue-Leung Chan

Angela So

Kee Hyuk Park

Chia-Wei Chang

Shivani Chaturvedi

Paul Virag

Victor Boctor

Lei Yu

Chowdhury Sucharit Barua

Raju Nagalinga S

A message is received, that represents an action to be performed in a service. The message includes a natural language portion and an endpoint to interact with. The natural language portion is parsed to identify the action and the endpoint is interacted with to perform the action.

Natural language service interaction through an inbox

Activating an extension includes opening a first compose application by a first computing device. A composed document is received, and an extension is activated in response to the document. The extension may be activated as the document is being composed.

Compose application extension activation

Role-based security architecture that facilitates delegated role assignments where role functionality is monotonically decreasing. In furtherance thereof decreasing monotonicity roles are arranged in a hierarchy. Moreover, delegated roles can be obtained by creating a derived role (from a parent role) and removing entries from the derived role to decrease the permissions for the derived role. Delegated role assignments are scoped (bounded), which automatically applies a given scope to the assignment created by the user receiving the delegation.

Delegation model for role-based access control administration

Architecture that provides centrally located role-based administration where role assignments that are used to calculate scopes for each operation and create a filtered request that only returns objects that the user is allowed to manage. No access checks are needed. The architecture addresses the proliferation of scope definitions by at least creating a set of relative scopes such as that can generically apply to multiple users at once. More specifically, self-relative scopes and absolute scopes are provided.

Scope model for role-based access control administration

Architecture removes the limitation of a fixed set of roles and scopes, allows more effective permission auditing, and provides a convenient delegation model. Administrators can create roles fine-tuned to business needs without changing permissions on the resources. The new roles can be easily examined and delegated to other administrators. Moreover, scoping and delegation is simplified. This is possible because permissions are granted as a role (a unit of permission assignment is a role), which can include multiple entries. The entries correspond to end-user actions and are not related to implementation-dependent resource rights. The actions can include web services or API calls, script or executable file names, specialized commands that implement particular operation, and associated parameters, etc., essentially any action that the end-user performs.

Extensible role-based access control model for services

Architecture that creates a class of role-based scopes that can be declared 'exclusive', which automatically means that no user can access the scope unless the user is granted that exact scope. The exclusive scope excludes an object from the new scopes and existing scopes. In other words, the exclusive scope is a write restriction from a domain scope. The exclusive scope denies user access unless the user is granted the exclusive scope. The exclusive scope can be applied to a group of user objects. The exclusive scope is explicitly assigned to the object to grant access to an exclusive group. Moreover, the exclusive scope is immediately write-protected upon creation.

Growing community of inventors

Sammamish, WA, United States of America

Pretish Abraham