Microsoft Technology Licensing, LLC

Venkata Adusumilli

Maya Neelakandhan

Parag Bajaria

Balaji Parimi

Naveen Teja Jangalapalli

Carl Alan Waldspurger

Naga Venkata Naveen Teja Jangalapalli

Nicholas James Barretta

Shaun Applegate-Swanson

Guruprasad Ramprakash

Shaun Robert Applegate-swanson

Shaun Robert Applegate-Swanson

Parag Mahendrakumar Bajaria

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to automatically detect inadvertent, unauthorized account access. For example, a user account may be analyzed to identify roles thereof that permit identities of other accounts to assume the roles of the user account. The analysis is performed for each identified account, including any accounts having roles that permit identities of further accounts to assume the roles of the identified accounts. Accordingly, a chain of roles may be determined that indicates how one account may have access to another account via one or more intervening role assignments. This circuitous path of account access may be represented and displayed to a user, e.g., via a tree structure. Upon identifying an unauthorized account, an appropriate action may be performed to adjust permissions.

Methods and systems for detecting inadvertent unauthorized account access

Methods, systems, apparatuses, and computer-readable storage mediums are described for assigning a security risk score to a resource. In one example, resource access data is collected for a resource. Based at least on the resource access data, a data risk index (DRI) score is generated for the resource. The DRI score comprises a value that is indicative of a level of risk that the resource will be compromised. At least one of the DRI score, an alert based at least on the DRI score, or a policy change for the resource based at least on the generated DRI score is reported to an administrator.

Determining data risk and managing permissions in computing environments

Access privileges of at least one identity to resources are adjusted within an authorization system of a computing environment. Over a detection period, accesses by the identity to the resources are detected and a usage score is computed as a usage function of a measure of use by the identity of access privilege(s) it has been granted to at least one of the resources relative to a measure of a set of possible grantable privileges. In accordance with a least privilege security policy, and according to the usage score, the set of access privileges granted to the identity may then be adjusted.

Method and system for quantifying and improving conformance to least privilege security policies

A security server provides dynamic permissions for an enterprise data source. The security server establishes permissions rules for a data source of the enterprise. For example, the permissions rules describe permissions policies applicable to users of the enterprise in given contexts. The security server evaluates the permissions rules in view of a context to produce a dynamic permissions policy for the data source. The context describes the environment of the data source at a point in time (e.g., a current time). The dynamic permissions policy describes permissions of users of the enterprise with respect to the data source and the context. The security server transmits the dynamic permissions policy to the enterprise such that the enterprise is able to implement the dynamic permissions policy at the data source.

Activity based authorization for accessing and operating enterprise infrastructure

Growing community of inventors

Cupertino, CA, United States of America

Venkata Adusumilli