Microsoft Technology Licensing, LLC

Sarat Chandra Subramaniam

Ariel Nicolas Gordon

Titus Constantin Miron

Yordan Ivanov Rouskov

Samuel Devasahayam

Venkatesh Gopalakrishnan

Lu Zhao

Amit Gupta

James Charles Kleewein

Benjamin Richard Vincent

Venkatesh Veeraraghavan

Rafael Lopez-Uricoechea

Ladislau Conceicao

Christian Roy

Shashi R Singaravel

Parmeshwar Miguel Sequeira Arewar

Alfons A Staerk

Daniel John Wigdor

Robert J Levy

Paul Armistead Hoover

Omar H Shahine

Eugene Seichi Lin

Sundaram Ramani

Caleb Geoffrey Baker

Bryant Fong

Greg S Friedman

Sam Franklin Williams, Iii

Benoit Schmitlin

Dilesh Dhokia

Sangeeta Ranjit

Kavita K Kamani

Muhammad Omer Iqbal

Sean Lamont Grant Livingston

Javier Dalzell

Hui Huang

Willard Bruce Jones

Eric Wayne Doerr

Carlos Pessoa

Stephen Lincoln Rice

Gaurav R Doshi

Joyce Wu

Etan Micah Basseri

Michael Robert Van Waardhuizen

Ghania A Moussa

William Thomas

Carlos Adrian Lopez Castro

Michael Vincent McLaughlin

Rachel Anne Brown Teller

Paul Garner

Sadie Elise Henry

Jonathan Yoder Brenner

Matthew Taylor Cohen

Pui Yin Winfred Wong

Ben Vincent

Daniel Edward Lee Wood

Steve Ball

Justin Anthony Niles

Sandra Jiang

Jessica Tian-Hueih Lin

Robyn Nicole Hicock

Gang Zhai

Michael Scott Pierce

Tia Bianca Caldwell

Amy Caryl Nathanson

Parmeshwar Arewar

Nicholas Carl Sturm

Sadia Sharmin

Luis Eduardo Cabrera Cordon

Paul H J Garner

Ian Middleton

Sameer Yadav

Matthew R Wallace

Alexandru Munteanu

An account provisioning manager is disclosed. A placeholder account is generated with a primary work set attribute and a plurality of enhanced work set attributes. Initially, the primary work set attribute is populated with data to convert the placeholder account into an onboarded operating account. Subsequently, the plurality of enhanced work set attributes are populated via data propagation into the onboarded operating account, wherein an enhanced work set attribute of the plurality of enhanced work set attributes is selectively populated in response to a trigger for the onboarded operating account.

Account provisioning manager

Techniques are described herein that are capable of evaluating a result of enforcement of access control policies instead of enforcing the access control policies. For instance, a result of enforcement of an access control policy with regard to sign-in processes is evaluated instead of enforcing the access control policy with regard to the sign-in processes. The evaluation includes monitoring access requests that are received during the sign-in processes. Each access request requests access to a resource. The evaluation further includes comparing attributes of each access request against the access control policy that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the respective access request. Metadata associated with the sign-in processes is generated instead of enforcing the access control policy with regard to the sign-in processes.

Evaluating a result of enforcement of access control policies instead of enforcing the access control policies

Technologies are provided for prevention of organizational data leakage across platforms based on device status. A device management service may include status information for a client device and/or a connection in a token provided to the client device and update the status in response to changes. An applicable data protection policy may be determined based on the detected status and optionally based on data being accessed. An instruction may be transmitted to a client application executed on the client device based on the applicable data protection policy thereby enforcing the data protection policy at the server. The instruction may cause a script executed at the client application to disable one or more user interface controls associated with functionality such as downloading, synchronizing, printing, etc. of the organizational data to prevent leakage of organizational data.

Prevention of organizational data leakage across platforms based on device status

A method performed by a computing system comprises accessing group subscription data that is associated with a user and identifies a plurality of different groups, each group being hosted by a corresponding client system. The group subscription data indicates that the user is subscribed to receive resource updates from the plurality of different groups. An aggregated set of resource updates is generated by aggregating resource updates associated with resources in the plurality of different groups. An integrated view renders the aggregated set of resource updates and includes an action user input mechanism representing a computing action to be performed in a corresponding one of the groups associated with at least one resource update. Based on user actuation of the action user input mechanism, a machine instruction instructs the client system, that hosts the corresponding group, to perform the computing action.

Integration of client system groups

A computing system includes a processor and memory storing instructions executable by the at least one processor. The instructions, when executed, provide a user interface component that receives an indication of an external user with which to share an item of electronic content, a link generation component that generates a link to share the item of electronic content and identifies a communication endpoint associated with the external user, and an access control component that receives a request to access the item of electronic content using the link and, in response to the request, generates an access code that is communicated to the communication endpoint associated with the external user. The user interface component receives an access input, and the access control component grants access to the item of electronic content based on a determination that the access input includes the access code communicated to the communication endpoint associated with the external user.

External sharing with improved security

Authenticating an E-tournament identity using personal identity credentials. A method includes determining that a gaming device is configured for use in an E-tournament. The method further includes receiving from the device, user personal identity credentials. As a result, the method further includes, signing in to an E-tournament identity using the personal identity credentials.

Methods for provisioning and management of gamer accounts for E-tournaments

A computing system providing access to electronic files is provided. The computing system includes a processor and a data store coupled to the processor and configured to store the electronic files. A user interface component is coupled to the processor and is configured to generate a user interface that allows a first user to select an electronic file to be re-shared with second user. The processor is configured to detect re-sharing of the selected electronic file by the first user and automatically generate a notification to a third user. The notification is configured to allow the third user to cancel the re-sharing of the electronic file.

Electronic data storage re-sharing notification

The automatic selection of an identity provider to be used to authenticate users when requesting to access network resources for a tenant. The authentication is initiated by checking the username against the directory of the tenant. If that check results in finding an entry for the username in that directory, the entry is checked for an identity provider. If that check results in finding an identity provider, the user is directed to that found identity provider for authentication. Thus, in many, most, or all cases, an identity provider is found and selected for authentication of the user without the user having to manually select the identity provider. The username may be an internal user of an entity. The selection of the identity provider works in either case since there would still be an entry for that user in the directory of the tenant.

Resource-based selection of identity provider

A method and system performed by a computing system for signing in using personal identifiers input via a sign-in portal that supports multiple tenants is provided. The system receives a sign-in request for a user that includes a personal identifier. The personal identifier uniquely identifies a person but does not include an identification of a tenant. The system performs a verification based on the personal identifier to authenticate the user. The system identifies, from a mapping, a tenant to which the personal identifier is mapped. The mapping maps personal identifiers of users to tenants. The system retrieves, from a user store for the tenant, user information relating to the user. The system then creates a security token based on the user information. If verification of the user was successful, the system sends the security token to the sign-in portal as evidence that the user has been authenticated.

Personal identifier sign-in for organizational users

A user interface provides mechanisms for a user to select resources from a plurality of different groups, across clients. Updates from all of the selected resources are aggregated and displayed to the user, across clients, in an integrated view.

Cross-client integration of groups

A computing system that provides access to electronic content includes a processor, a data store, and a user interface component. The data store is coupled to the processor and configured to store the electronic content. The user interface component is coupled to the processor and configured to generate a user interface allowing an internal user to generate a sharing request to share electronic content with an external user. The processor is configured to determine whether the internal user is a member of a group that is allowed to externally share content and to inhibit external sharing of the electronic content if the internal user is not a member of the group that is allowed to externally share the electronic content.

Group-based external sharing of electronic data

Embodiments are directed to revoking user sessions using signaling. In one scenario, an identity platform operating on a computer system receives an indication indicating that a user's login account has been compromised, where the user's login account has an associated login session and corresponding session artifact that is valid for a specified amount of time. The identity platform generates a signal indicating that the login session is no longer trusted and that the user is to be re-directed to the identity platform to re-authenticate and renew the session artifact and provides the generated signal to various relying parties including at least one relying party that is hosting the login session for the user.

Revoking sessions using signaling

Systems, methods, and computer-readable storage media are provided for discovering and disambiguating identity providers such that user knowledge of appropriate identity providers is minimized. Users are presented with options for selecting appropriate providers only when multiple providers have user profiles matching a user identifier. When users are presented with options for selecting appropriate providers, providers that have user profiles matching the identifier are identified utilizing identity information for the application that utilizes the identity provider for its users rather than information identifying the identity provider itself. Where it is determined that no identity provider has a user profile associated with the user identifier (or where it is determined that a particular identity provider would generally be appropriate to be utilized with the user identifier), the opportunity for users to create an authentication account with one or more identity providers or to retry with a different user identifier is provided.

Discovering and disambiguating identity providers

Growing community of inventors

Bellevue, WA, United States of America

Sarat Chandra Subramaniam