Microsoft Technology Licensing, LLC

Titus Constantin Miron

Jason Matthew Cahill

William R Taylor

Sarat Chandra Subramaniam

Yordan Ivanov Rouskov

Zachary D Rosenfield

Ariel Nicolas Gordon

Murli D Satagopan

Samuel Devasahayam

Umesh Unnikrishnan

Venkatesh Gopalakrishnan

Lu Zhao

Venkatesh Veeraraghavan

Seshadri Mani

Mark John Walker

Robert McKee Howard

Harshal Ingole

Parmeshwar Miguel Sequeira Arewar

Haytham Abuel-Futuh

Anthony Christopher Bloesch

Lauren Nicole Antonoff

James Charles Kleewein

Adrian Fanaru

Pui-Yin Winfred Wong

Caleb Geoffrey Baker

Vikrant Arora

Violet Anna Barhudarian

Kavita K Kamani

Willard Bruce Jones

Radhika Kashyap

Daniel Kershaw

Shaofeng Zhu

Christian Roy

Eray Aydin

Sean L Livingston

Dmitry Pugachev

Brian P Robbins

George Adrian Drumea

Sriram Dhanasekaran

Yina Arenas

Matthew Taylor Cohen

Jon Rosenberg

Nicholas Carl Sturm

Marek Rycharski

Vijaya Manohararaj

Umesh Unnikrishman

William David Taylor

Sameer Yadav

Matthew R Wallace

Alexandru Munteanu

Parmeshwar Arewar

Robert Mckee Howard

Technologies are provided for prevention of organizational data leakage across platforms based on device status. A device management service may include status information for a client device and/or a connection in a token provided to the client device and update the status in response to changes. An applicable data protection policy may be determined based on the detected status and optionally based on data being accessed. An instruction may be transmitted to a client application executed on the client device based on the applicable data protection policy thereby enforcing the data protection policy at the server. The instruction may cause a script executed at the client application to disable one or more user interface controls associated with functionality such as downloading, synchronizing, printing, etc. of the organizational data to prevent leakage of organizational data.

Prevention of organizational data leakage across platforms based on device status

Session lifetime can be adapted based on session reputation. Session reputation can be computed based on sign-in risk and device risk, among other things. Session lifetime corresponds to a length of time a session is valid and can be determined automatically based on the session reputation. Subsequently, a token can be generated and returned in response to successful authentication that identifies a session and is valid for the determined lifetime.

Adaptive session lifetime

Network services may include data associated with one or more entities. An aggregator service may host respective application programming interfaces (APIs) of the services at a single endpoint of the network such that the entities, including associations and relationships between entities, may be federated. For example, the services may register the entities of which the data of each of the services is associated with through a declarative entity model to establish an API schema for each of the services, which may be published at the aggregator service. In response to receipt of a request for entity related data from a client, the aggregator service may employ the declarative entity model to determine which of the services are associated with the entity related data such that a query may be submitted to the services, and how to aggregate responses to the query received from the services for transmission to the client.

Aggregation and federation of distributed service entities and associations

Embodiments are directed to revoking user sessions using signaling. In one scenario, an identity platform operating on a computer system receives an indication indicating that a user's login account has been compromised, where the user's login account has an associated login session and corresponding session artifact that is valid for a specified amount of time. The identity platform generates a signal indicating that the login session is no longer trusted and that the user is to be re-directed to the identity platform to re-authenticate and renew the session artifact and provides the generated signal to various relying parties including at least one relying party that is hosting the login session for the user.

Revoking sessions using signaling

A session token can be requested to be sent to a first computing service from a second computing service, and a first computing service can receive the requested session token from the second computing service. The first computing service can send a message that includes the session token through a passive client to the second computing service. The second computing service can receive the message that includes the session token from the passive client, and the second computing service can verify that the message is valid. This verification of the validity of the message can include verifying that the session token received back from the passive client matches the session token the second computing service sent to the first computing service.

Sending session tokens through passive clients

A method for sign-on and sign-out for a computer system. The method includes receiving a first sign-on request for the computer system and obtaining, from the first sign-on request, a first user identifier where the first user identifier corresponds to a first user for the computer system. The method then includes obtaining, from the first sign-on request, a first uniform resource locator (URL) and determining whether the first URL includes a first root name for the computer system. When a determination is made that the first URL includes the first root name for the computer system a first cookie associated with the first user is issued and a first sub-domain name is obtained from the first URL. Also, a second cookie may be issued associated with the first sub-domain name and, when the first cookie and the second cookie are issued, the first user may sign-on to the computer system. In one or more embodiments, the method may include receiving a sign-out request.

Gate keeper cookie

An application submits a permission request to a resource server. In response to receiving the request, the resource server generates a user interface that asks the user to grant or deny the requested permissions. If the permissions are granted, data is stored indicating that the application has the requested permissions. When a runtime request for a resource is received, the resource server determines whether the request has been made by a user, by an application, or by an application on behalf of a user. If the request is made by an application only, the request is granted only if the application has permission to access the resource by way of a direct call not on behalf of a user. If the request is made by an application on behalf of a user, the request is granted only if both the user and the application have sufficient permission.

Authorizing application access to secure resources

This disclosure describes techniques that enable a subscriber of a data center to manage a site collection group hosted by the data center. A site collection group is a set of site collections that belong to a single subscriber. A site collection is a collection of websites. A website is a collection of related resources. Each of the site collections is associated with an 'owner'. As described herein, the data center presents management interfaces that enable owners of site collections to manage the site collections. In addition, the data center presents management interfaces that enable subscribers to manage architectural aspects of their site collection groups.

Management of collections of websites

A computing system hosts a plurality of websites, a plurality of external data sources, and a search service. External resources in each of the external data sources are partitioned among a plurality of external partitions. The search service automatically generates an index comprising index entries. The index entries are partitioned among a plurality of index partitions, each associated with one or more of the websites. For each given index partition, the index entries in the given index partition map terms to resources in the given set of resources that contain the terms. The given set of resources includes web pages in a given set of websites associated with the given index partition and external resources in external partitions used by the given set of websites. The search service uses the index entries in given index partition to identify resources in the given set of resources containing query terms.

Indexing of partitioned external data sources

Embodiments are provided to automatically managing system downtime in a computer network. In one embodiment, an event is created in an application server to schedule a system downtime period for a web server. When the scheduled downtime occurs, the web server is automatically removed from the network and a downtime notification message is automatically communicated indicating that the web server is offline. In another embodiment, events may be created to schedule downtime for web-based applications, including websites. Prior to the scheduled downtime, requests to a web-based application may be automatically stopped and redirected to a specified location. In another embodiment, the operation of web servers is automatically monitored to detect the presence of a fault condition and, if a fault condition is present, then a determination may be made that the affected web servers are down and requests to the down web servers are automatically redirected to an alternate server.

Automatically managing system downtime in a computer network

Embodiments are provided to manage external hardware appliances from a distributed operating system interface in a computer network using a driver model to communicate with device drivers associated with the external hardware appliances. In one embodiment, a request to manage an external hardware appliance in the computer network may be received in a distributed web-based operating system interface. A driver model may be selected which is configured to interface with a device driver for managing configuration settings for the external hardware appliance. The driver model may be utilized to manage the external hardware appliance configuration settings from the interface. The settings may include managing domain name changes, firewall settings, proxy settings, and the like. In another embodiment, the driver model may be utilized to manage external hardware appliance settings during a network configuration operation initiated from the distributed operating system interface.

Management of external hardware appliances in a distributed operating system

Growing community of inventors

Seattle, WA, United States of America

Titus Constantin Miron