Restricting access to public cloud SaaS applications to a single organization

In a computing environment, a method of allowing an enterprise device managed by an enterprise to access content of a tenant that is associated with the enterprise and that is a part of a cloud service while preventing the enterprise device from accessing content of one or more other tenants that are also parts of the cloud service, the method comprising:

• at the cloud service, receiving an access request that originated from the enterprise device, the access request including both (1) a request from the enterprise device to access the enterprise's associated tenant and (2) policy that, when implemented by the cloud service, controls how the cloud service is to subsequently issue an authentication token such that the request and the policy are included in the access request prior to issuance of the authentication token, wherein the policy includes one or more uniform resource locators (URLs) that collectively identifies at least one or more allowed tenant that the enterprise device is permitted to navigate to or one or more tenant that the enterprise device is not permitted to navigate to;
• at the cloud service, determining that the policy corresponds to access permissions for the enterprise's associated tenant, the policy being received from the enterprise for enforcement by the cloud service, wherein the policy included in the access request provides an indication to the cloud service whether the access request is to be granted by issuing the authentication token or denied by refraining from issuing the authentication token;
• and
• at the cloud service, granting or denying the access request based on the policy which was obtained from the enterprise and which was included in the access request, wherein any URL in the policy that identifies an allowed tenant causes issuance of the authorization token for the allowed tenant and any URL in the policy that identifies a tenant that the enterprise device is not permitted to navigate to is used to prevent the issuance of the authentication token for the tenant that the enterprise device is not permitted to navigate to.

In a computing environment, a system comprising:

• a cloud service, wherein the cloud service comprises:
• a plurality of application instances including at least one application instance for a plurality of tenants;
• and
• an identity platform, wherein the identity platform is configured to:
• receive an access request that originated from an enterprise device managed by an enterprise, the access request including both (1) a request from the enterprise device to access a tenant of the enterprise and (2) policy that, when implemented by the identify platform, controls how the identity platform is to subsequently issue an authentication token such that the request and the policy are included in the access request prior to issuance of the authentication token, wherein the policy includes one or more uniform resource locators (URLs) that collectively identifies at least one or more allowed tenant that the enterprise device is permitted to navigate to or one or more tenant that the enterprise device is not permitted to navigate to;
• determine that the policy corresponds to access permissions for the enterprise's associated tenant, the policy being received from the enterprise for enforcement by the identity platform, wherein the policy included in the access request provides an indication to the cloud service whether the access request is to be granted by issuing the authentication token or denied by refraining from issuing the authentication token;
• and
• at the cloud service, grant or deny the access request based on the policy which was obtained from the enterprise and which was included in the access request, wherein any URL in the policy that identifies an allowed tenant causes issuance of the authorization token for the allowed tenant and any URL in the policy that identifies a tenant that the enterprise device is not permitted to navigate to is used to prevent the issuance of the authentication token for the tenant that the enterprise device is not permitted to navigate to.