Microsoft Technology Licensing, LLC

Vikas Ahuja

Yi Zeng

Joel T Hendrickson

Brian Charles Blomquist

Xiaoting Zhang

Liqiang Zhu

Siddhartha Mathur

Rajalakshmi Dani

Paul Howard Rich

Naveen Madan

Matthias Adam Leibmann

Shankaranand Arunachalam

Reeves Hoppe Briggs

Anshul Dube

Grigory V Kaplin

David Hetherington

Anand Madhava Menon

Roderick Carlos Paulino

Jodene L Eikenberry

Luke Schoen

Dawn Marie Kister

Alexander Semko

Qinxiao Zhou

Kapil Kumar Jain

Ran Cheng

Chun Hung Lin

Paul H Rich

A cross-tenant authentication system is described. The system receives a user token from a client device that is registered with a first tenant of a service application of a server. The system receives a request, from the client device, to access a second feature of a second tenant of the service application. The second feature of the second tenant of the service application is separate from a first feature of the first tenant of the service application. The second feature is only accessible to devices registered with the second tenant of the service application. The system authenticates the request by validating the user token from the client device and determines a cross-tenant policy of the second tenant of the service application based on the user token. The system forms an identity object based on the cross-tenant policy.

User permission in a multi-tenant environment

Disclosed in various examples are methods, systems, and machine-readable media for exposing a Representational State Transfer (RESTful) interface to users whereby management commands on a datacenter may be issued remotely from the users' workstations for secure, remote management of the datacenter. An application task automation command (e.g., a POWERSHELL® command) is executed remotely by creating a proxy command (e.g., based on a POWERSHELL® cmdlet code) to cause the application task automation command to be executed when the proxy command is remotely invoked and deploying the proxy command to a remote computer, such as the user's workstation. The remote computer issues a request including a user identifier and any parameters for the application task automation command when the corresponding proxy command has been invoked by the remote computer. The datacenter determines whether the user is authorized to execute the application task automation command invoked by the proxy command, and upon authorization of the user, the datacenter computer runs the application task automation command with any parameters provided in the request to control configuration of, or data stored on, at least one computer in the datacenter.

System and method to securely execute datacenter management operations remotely

Disclosed in various examples are methods, systems, and machine-readable media for exposing a Representational State Transfer (RESTful) interface to users whereby management commands on a datacenter may be issued remotely from the users' workstations for secure, remote management of the datacenter. An application task automation command (e.g., a POWERSHELL&#xae; command) is executed remotely by creating a proxy command (e.g., based on a POWERSHELL&#xae; cmdlet code) to cause the application task automation command to be executed when the proxy command is remotely invoked and deploying the proxy command to a remote computer, such as the user's workstation. The remote computer issues a request including a user identifier and any parameters for the application task automation command when the corresponding proxy command has been invoked by the remote computer. The datacenter determines whether the user is authorized to execute the application task automation command invoked by the proxy command, and upon authorization of the user, the datacenter computer runs the application task automation command with any parameters provided in the request to control configuration of, or data stored on, at least one computer in the datacenter.

An authorization policy defines permissions that are exposed by a microservice. When a call is made to the microservice, it includes an access token. An application identifier uniquely identifying the calling application is extracted from the token. An access pattern, used by the calling application to obtain the access token and make the call to the microservice, is identified. Permissions that may be granted to the calling application are identified in the authorization policy based upon the application identifier and the access pattern that is identified. An authorization decision is made as to whether to authorize the call, based upon the granted permissions.

Authentication and authorization across microservices

Tenant approval for operator access to tenant data is provided. In order to grant service personnel operators access to a tenant's data for performing a requested action, a lockbox determines a security group role to which an operator needs to be elevated to perform a requested action, computes a set of internal administrators and tenant administrators authorized to grant a temporary role elevation, and sends an access control request to the administrators. Upon receiving approval of the access control request from an internal administrator and a tenant administrator, the lockbox elevates the operator to the security group role, granting the operator a set of permissions needed in order to allow the operator to perform the requested action. Accordingly, tenants are enabled to control access to their data and scrutinize access requests per their company procedures and compliance needs.

Tenant lockbox

The exposing of a server function to a browser. From the browser's perspective, the browser submits a request for a web page to a web server, the web page being one of multiple web pages in a web application offered by the web server. The web server responds to the request by, for at least one of the server functions, formulating a corresponding script language function that defines a matching name and parameter set of the server side function. The script language function has a body that, when executed, serializes at least the name and parameter set of the server side function. The web server then provides the web page code and the corresponding script language function to the browser. The browser may then calls the server side function via the script language function.

Exposing server functions to browser code

Gathering performance information with respect to delivering web resources as perceived by a user at the web client. A method includes receiving a request for a web page. As a result of receiving the request, a first set of executable instructions are sent. The first set of executable instructions are configured to indicate a plurality of resources required to be at least one of downloaded to or rendered at the client for the web page to be considered loaded at the client. The first set of executable instructions are also configured to determine when each individual resource in the required resources have been be at least one of downloaded to or rendered at the client. The first set of executable instructions are also configured to determine a length of time associated with at least one of downloading to or rendering at the client the resources in the plurality of resources.

Extensible dynamic performance instrumentation of pages

A user interface that allows for efficient resolution of license conflicts. The user interface includes a license conflict discovery mechanism that automatically discovers whether a license conflict exists for a license. Upon determining a subset of available resolution methods that are suitable for the administrator right corresponding to the user of the user interface, the user interface provides a resolution prompt. The resolution prompt prompts the user of the user interface to resolve the license conflict using any one of the available subset of resolution methods. The types of the offered resolution methods offered by the user interface differ according to the administration rights of the user.

License reconciliation for online services

Growing community of inventors

Sammamish, WA, United States of America

Vikas Ahuja