# US 12,603,871 B2 · Access orchestration engine in a cloud access management system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,871 B2 - Document ID: US12603871B2 - Status: Granted - Kind: B2 - Application number: 18/318,254 - Filed: 2023-05-16 - Published: 2024-11-21 - Granted: 2026-04-14 - Earliest claimed: 2023-05-16 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Zachary Cole Willson; Prasanna Chromepet Padmanabhan; Gaurav Raghu Dhawan; Yizhong Wu; Ivaylo Detelinov Ivanov; Purna Venkata S Bodapati; Suyin Liu; Wensheng Xu; Alexis Jade Lambert; William Lee Wayne Weston; Somesh Goel; Sandeep Patnaik - Web page: https://patentgrep.com/patent/US12603871B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/31: User authentication - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer storage media for providing cloud access management using an access orchestration engine in a cloud access management system. Cloud access management provides access to a remote client of a consumer-identity-supported tenant environment of an organization. In operation, a consumer identity of a user is accessed. The consumer identity is approved for access to the consumer-identity-supported tenant environment. Based on accessing the consumer identity, access orchestration operations are executed for the remote client using remote client access resources, organization resources, and consumer identity resources. Executing the access orchestration operations comprises provisioning the remote client with remote access services for consumer identities; provisioning the remote client with organization resources; and priming the remote client with the consumer identity resources upon determining that the consumer identity is associated with the consumer-identity-supported tenant environment. The remote client is deployed, and the remote client is accessible based on the consumer identity. ## Claims ### Claim 1 A computerized system comprising: one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations comprising: accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities; executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients; communicating an indication that the organization is configured with the consumer-identity-supported tenant environment; accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment; based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and deploying the remote client, wherein the remote client is accessible using the consumer identity. ### Claim 2 (depends on 1) The system of claim 1, wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment. ### Claim 3 (depends on 1) The system of claim 1, wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment. ### Claim 4 (depends on 1) The system of claim 1, wherein the organization is associated with the organization resources and the consumer identity is associated with the consumer identity resources, the organization resources and consumer identity resources are both accessible via the remote client associated with the consumer-identity-supported tenant environment. ### Claim 5 (depends on 1) The system of claim 1, wherein the remote client access resources comprise a plurality of remote access services that support accessing the remote client using the consumer identity. ### Claim 6 (depends on 1) The system of claim 1, wherein executing the first plurality of access orchestration operations further comprises: generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment; mapping a first consumer identity to the consumer-identity-supported tenant environment; and assigning a license to the consumer identity in the consumer-identity-supported tenant environment. ### Claim 7 (depends on 1) The system of claim 1, wherein executing the second plurality of access orchestration operations further comprises: provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity; provisioning the remote client with the organization resources of the organization; and priming the remote client with the consumer identity resources of the consumer identity. ### Claim 8 (depends on 1) The system of claim 1, the operations further comprising: accessing the consumer identity of the user, wherein the consumer identity is licensed for access to the consumer-identity-supported tenant environment; initiating a discovery operation to identify the consumer-identity-supported tenant environment associated with the consumer identity; based on the consumer identity, providing access to the consumer-identity-supported tenant environment; communicating an indication of the remote client that is accessible based on the consumer identity; accessing credentials associated with the consumer identity; and based on the credentials associated with the consumer identity, providing access to the remote client. ### Claim 9 (depends on 8) The system of claim 8, wherein the discovery operation further comprises communicating with a tenant directory to identify the consumer-identity-supported tenant environment that is mapped directly to the consumer identity of the user in the tenant directory. ### Claim 10 (depends on 1) The system of claim 1, the operations further comprising: communicating the consumer identity from a client device to access the remote client; based on communicating the consumer identity, receiving an identifier associated with the remote client; accessing a user selection of the identifier that causes initialization of a user session on the remote client; and signing into the user session on the remote client. ### Claim 11 One or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising: accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities; executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients; communicating an indication that the organization is configured with the consumer-identity-supported tenant environment; accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment; based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and deploying the remote client, wherein the remote client is accessible using the consumer identity. ### Claim 12 (depends on 11) The media of claim 11, wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment. ### Claim 13 (depends on 12) The media of claim 12, wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment. ### Claim 14 (depends on 11) The media of claim 11, wherein executing the first plurality of access orchestration operations further comprises: generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment; mapping a first consumer identity to the consumer-identity-supported tenant environment; and assigning a license to the consumer identity in the consumer-identity-supported tenant environment. ### Claim 15 (depends on 11) The media of claim 11, wherein executing the second plurality of access orchestration operations further comprises: provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity; provisioning the remote client with the organization resources of the organization; and priming the remote client with the consumer identity resources of the consumer identity. ### Claim 16 A computer-implemented method, the method comprising: accessing an organization identifier of an organization, wherein the organization identifier is associated with a request to configure the organization for a consumer-identity-supported tenant environment that provides access to remote clients of the organization based on consumer identities; executing a first plurality of access orchestration operations to configure the consumer-identity-supported tenant environment, wherein the consumer-identity-supported tenant environment is configured to authorize consumer-identity-based access to the remote clients; communicating an indication that the organization is configured with the consumer-identity-supported tenant environment; accessing a consumer identity of a user, wherein the consumer identity is approved for access to the consumer-identity-supported tenant environment; based on accessing the consumer identity, executing a second plurality of access orchestration operations for a remote client, wherein executing the second plurality of access orchestration operations are executed based on remote access client resources, organization resources and consumer identity resources; and deploying the remote client, wherein the remote client is accessible using the consumer identity. ### Claim 17 (depends on 16) The method of claim 16, wherein the consumer-identity-supported tenant environment is generated based on a consumer-identity-supported tenant configuration that removes domain requirements for the organization when configuring the consumer-identity-supported tenant environment. ### Claim 18 (depends on 16) The method of claim 16, wherein the consumer-identity-supported tenant environment supports mapping of consumer identities to the consumer-identity-supported tenant environment and discovery of mappings of consumer identities to the consumer-identity-supported tenant environment. ### Claim 19 (depends on 16) The method of claim 16, wherein executing the first plurality of access orchestration operations further comprises: generating a consumer-identity-supported tenant configuration that initializes the consumer-identity-supported tenant environment; mapping a first consumer identity to the consumer-identity-supported tenant environment; and assigning a license to the consumer identity in the consumer-identity-supported tenant environment. ### Claim 20 (depends on 16) The method of claim 16, wherein executing the second plurality of access orchestration operations further comprises: provisioning the remote client with remote client access resources comprising a plurality of remote access services that support accessing the remote client using the consumer identity; provisioning the remote client with the organization resources of the organization; and priming the remote client with the consumer identity resources of the consumer identity.