# US 12,015,606 B2 · Virtual machine provisioning and directory service management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,606 B2 - Document ID: US12015606B2 - Status: Granted - Kind: B2 - Application number: 17/373,542 - Filed: 2021-07-12 - Published: 2022-12-29 - Granted: 2024-06-18 - Earliest claimed: 2021-06-28 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Yan Zhang; Xuling Luo; Honglu Chen; Yizhong Wu; Christian Cruz Montoya; Jun Shi; Na Li; Prasanna Chromepet Padmanabhan; Somesh Goel - Web page: https://patentgrep.com/patent/US12015606B2 ## CPC - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 41/5054: Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components - H04L 63/10: {for controlling access to devices or network resources} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer implemented method includes granting a tenant administrator client machine access to a cloud hosted tenant service joined to a directory service. A bulk token for the tenant is obtained in response to a request received from the tenant administrator client machine. An identifier of an authorized tenant client to the cloud hosted tenant service is received and results in the provisioning of a tenant client virtual machine in a cloud service for the authorized tenant client in accordance with a specified provisioning package associated with the bulk token. The tenant client virtual machine is then joined to the directory service. On receipt of an authorized client token at the cloud hosted tenant service from a tenant client machine, the tenant client machine is provided a connection to the tenant client virtual machine. ## Claims ### Claim 1 A computer implemented method comprising: granting a tenant administrator client machine access to a cloud hosted tenant service joined to a directory service; receiving, at the cloud hosted tenant service, a request for a bulk token, the request being received from the tenant administrator client machine; obtaining, in response to the request, the bulk token from the directory service; obtaining, at the cloud hosted tenant service, an identifier of an authorized tenant client of the cloud hosted tenant service; provisioning, in response to obtaining the identifier of the authorized tenant client, a tenant client virtual machine in a cloud service for the authorized tenant client in accordance with a specified provisioning package associated with the bulk token; and joining, in response to the provisioning, the tenant client virtual machine to the directory service. ### Claim 2 (depends on 1) The method of claim 1 and further comprising: receiving an authorized tenant client token at the cloud hosted tenant service from a tenant client machine; and granting the tenant client machine a connection to the client virtual machine. ### Claim 3 (depends on 2) The method of claim 2 wherein the tenant client token comprises the identifier and a password. ### Claim 4 (depends on 1) The method of claim 1 wherein the tenant client virtual machine is managed within the cloud service. ### Claim 5 (depends on 1) The method of claim 1 wherein the directory service authenticates and authorizes access based on tokens. ### Claim 6 (depends on 1) The method of claim 1 wherein the bulk token comprises a unique binary string. ### Claim 7 (depends on 1) The method of claim 1 and further comprising: receiving multiple additional identifiers, each identifier corresponding to a respective one of multiple additional authorized tenant clients of the cloud hosted tenant service; provisioning multiple additional respective tenant client virtual machines in the cloud service in accordance with a specified provisioning package associated with the bulk token; and joining the tenant client virtual machines to the directory service. ### Claim 8 (depends on 1) The method of claim 1 wherein the bulk token is encrypted within the cloud hosted tenant service. ### Claim 9 (depends on 1) The method of claim 1 wherein the provisioning package includes the bulk token. ### Claim 10 (depends on 1) The method of claim 1 wherein receiving an identifier of an authorized tenant client of the cloud hosted tenant service is performed in response to a tenant client being confirmed as having a license to services in the specified provisioning package. ### Claim 11 (depends on 10) The method of claim 10 wherein the authorized tenant client comprises a device providing an authorized tenant client token of a user included in the license. ### Claim 12 (depends on 11) The method of claim 11 wherein the device is coupled to a portal website providing access to the cloud hosted tenant service. ### Claim 13 (depends on 1) The method of claim 1 wherein joining the tenant client virtual machine to the directory service comprises providing a connection between the client virtual machine and the directory service for providing directory service functions to the tenant client virtual machine. ### Claim 14 A machine-readable storage device having instructions for execution by a processor of a machine to cause the processor to perform operations, the operations comprising: granting a tenant administrator client machine access to a cloud hosted tenant service joined to a directory service; receiving, at the cloud hosted tenant service, a request for a bulk token, the request being received from the tenant administrator client machine; obtaining, in response to the request, the bulk token from the directory service; obtaining, at the cloud hosted tenant service, an identifier of an authorized tenant client of the cloud hosted tenant service; provisioning, in response to obtaining the identifier of the authorized tenant client, a tenant client virtual machine in a cloud service for the authorized tenant client in accordance with a specified provisioning package associated with the bulk token; and joining, in response to the provisioning, the tenant client virtual machine to the directory service. ### Claim 15 (depends on 14) The device of claim 14 wherein the operations further comprise: receiving an authorized tenant client token at the cloud hosted tenant service; and granting the authorized tenant client a connection to the client virtual machine. ### Claim 16 (depends on 14) The device of claim 14 wherein the directory service authenticates and authorizes access based on tokens, wherein the directory service manages storage of information and deployment of services and wherein the bulk token comprises a unique binary string. ### Claim 17 (depends on 14) The device of claim 14 wherein the operations further comprise: receiving multiple additional identifiers, each identifier corresponding to a respective one of multiple additional authorized tenant clients of the cloud hosted tenant service; provisioning multiple additional respective tenant client virtual machines in the cloud service in accordance with a specified provisioning package associated with the bulk token; and joining the tenant client virtual machines to the directory service. ### Claim 18 (depends on 14) The device of claim 14 wherein the provisioning package includes the bulk token, wherein receiving an identifier of an authorized tenant client of the cloud hosted tenant service is performed in response to a tenant client being confirmed as having a license to services in the specified provisioning package, wherein the authorized tenant client comprises a device providing the authorized tenant client token of a user included in the license, and wherein the device is coupled to a portal website providing access to the cloud hosted tenant service. ### Claim 19 (depends on 14) The device of claim 14 wherein joining the tenant client virtual machine to the directory service comprises providing a connection between the client virtual machine and the directory service for providing directory service functions to the tenant client virtual machine. ### Claim 20 A device comprising: a processor; and a memory device coupled to the processor and having a program stored thereon for execution by the processor to perform operations comprising: granting a tenant administrator client machine access to a cloud hosted tenant service joined to a directory service; receiving, at the cloud hosted tenant service, a request for a bulk token, the request being received from the tenant administrator client machine; obtaining, in response to the request, the bulk token from the directory service; obtaining, at the cloud hosted tenant service, an identifier of an authorized tenant client of the cloud hosted tenant service; provisioning, in response to obtaining the identifier of the authorized tenant client, a tenant client virtual machine in a cloud service for the authorized tenant client in accordance with a specified provisioning package associated with the bulk token; and joining, in response to the provisioning, the tenant client virtual machine to the directory service.