Data classification and access control for cloud based data

A client device comprising:

• a processor;
• and
• a computer-readable hardware storage device having stored computer-executable instructions that are executable by the processor to cause the client device to enforce policy received from an external policy server by at least performing the following:
• receiving, from the external policy server, the policy including an entry specifying a first application that is identified as being unsafe and that causes the client device to configure an operating system of the client device in response to the policy to prevent the first application from accessing a resource maintained on a resource server and an entry specifying a second application that is identified as being safe to access the resource maintained on the resource server;
• determining that a first particular application, which is executing on the client device, does not implement the policy based, at least in part, on the first particular application being specified in the policy as being unsafe;
• determining that a second particular application, which is executing on the client device, implements the policy based, at least in part, on the second particular application being specified in the policy as being safe;
• storing an access credential within a credential store maintained by the operating system, the access credential being a credential required by the resource server to access resources maintained on the resource server, including said resource;
• in response to the determining that the first particular application does not implement the policy and based on the policy, determining that the first particular application is not allowed to use a particular access credential from the credential store, wherein the particular access credential is configured to enable access to the resource maintained on the resource server, and wherein, as a result of the first particular application not being allowed to use the particular access credential, the first particular application is denied from accessing the resource;
• and
• in response to the determining that the second particular application implements the policy, providing, from the credential store, the particular access credential to the second particular application, the particular access credential being configured to enable the second particular application to access the resource maintained on the resource server.

A client device comprising:

• a processor;
• and
• a computer-readable hardware storage device having stored thereon computer-executable instructions that are executable by the processor to cause the client device to enforce policy received from an external policy server by at least performing the following:
• receiving, from the external policy server, the policy including (i) a first set of entries specifying a first set of applications that are identified as being safe to access a resource maintained on a resource server and (ii) a second set of entries specifying a second set of applications that are identified as being unsafe to access the resource and that cause the client device to configure an operating system of the client device in response to the policy to prevent the second set of applications from accessing the resource maintained on the resource server;
• determining that a first application, which is executing on the client device, implements the policy based, at least in part, on the policy specifying the first application as being safe;
• determining that a second application, which is also executing on the client device, does not implement the policy based, at least in part, on the policy specifying the second application as being unsafe;
• storing an access credential within a credential store maintained by the operating system, the access credential being a credential required by the resource server to access resources maintained on the resource server, including said resource;
• in response to the determining that the first application implements the policy, providing, from the credential store, a particular access credential to the first application for use by the first application to access the resource, the particular access credential being configured to enable access to the resource maintained on the resource server;
• and
• in response to the determining that the second application does not implement the policy, denying use of the particular access credential by the second application, wherein as a result of the second application being denied use of the particular access credential, the second particular application is denied from accessing the resource.