# US 12,764,111 B2 · Automated multi-factor authentication enforcement during administrative account lifecycle events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,111 B2 - Document ID: US12764111B2 - Status: Granted - Kind: B2 - Application number: 18/907,214 - Filed: 2024-10-04 - Published: 2026-04-09 - Granted: 2026-10-13 - Earliest claimed: 2024-10-04 - Assignees: Hartford Fire Insurance Company - Applicants: Hartford Fire Insurance Company - Inventors: Lori-Ann Forand; Timothy R. Keefe; Donella King-Smith; David Maraia; Aurelio Miguel; Colleen Ryan; Annadurai Shanmugam; Anshuman Upadhyay - Web page: https://patentgrep.com/patent/US12764111B2 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A Multi-Factor Authentication (“MFA”) tool may implement an enforcement system for an enterprise. The tool may scan a computing environment along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise. The employee and account data store may contain, for example, electronic records associated with a plurality of employees and cloud computing accounts for the enterprise. Responsive to the identified administrative account lifecycle events, modifications to MFA requirements may be automatically determined. Responsive to that determination, embodiments may automatically implement second factor mappings to enforce the MFA requirements. The second factor mappings might be associated with, for example, mobile phone numbers, hardware tokens, or biometric information. ## Claims ### Claim 1 A Multi-Factor Authentication (“MFA”) enforcement system for an enterprise, comprising: (a) an employee and account data store that contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise; and (b) an MFA tool, in communication with an Identity and Access Management (“IAM”) tool and coupled to the employee and account data store, including: a computer processor, and a computer memory coupled to the computer processor and storing instructions that, when executed by the computer processor, cause a back-end application computer server associated with the MFA tool to: scan a computing environment, associated with Lightweight Directory Access Protocol (“LDAP”), along with the employee and account data store to automatically detect administrative account lifecycle events for the enterprise, responsive to the identified administrative account lifecycle events, automatically determine modifications to MFA requirements, and responsive to the determination, automatically implement second factor mappings, associated with hardware tokens, to enforce the MFA requirements, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result: selecting hardware token serial numbers, client keys, and secrets from a repository by the IAM tool, registering, by the IAM tool, the serial numbers, client keys, and secrets with the MFA tool, and arranging to physically provide the hardware token to the employee. ### Claim 2 (depends on 1) The system of claim 1, wherein the lifecycle events are associated with at least one of: (i) onboarding a newly hired employee of the enterprise, (ii) an indication that an employee has a new role, (iii) an employee termination. ### Claim 3 (depends on 1) The system of claim 1, wherein the second factor mappings are associated with mobile phone numbers. ### Claim 4 (depends on 3) The system of claim 3, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result: automatically enabling MFA, identifying a mobile phone number for an account owner, setting up an MFA profile, associating accounts to appropriate mobile numbers in MFA, and transmitting activation links. ### Claim 5 (depends on 4) The system of claim 4, wherein the IAM tool automatically adds any required privileges via group memberships and performs synchronization with the MFA tool. ### Claim 6 (depends on 4) The system of claim 4, wherein MFA is automatically removed if the identified account does not qualify for MFA and MFA is currently enabled. ### Claim 7 (depends on 4) The system of claim 4, wherein accounts are grouped based on User Principal Names (“UPN”). ### Claim 8 (depends on 1) The system of claim 1, wherein the second factor mappings are associated with biometric information. ### Claim 9 (depends on 8) The system of claim 8, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result: during issuance of a smart card to the employee, capturing biometrics, mapping, by an IAM tool, the employee smart card and biometrics with employee's profile, generating a unique reference for each mapping, and mapping, by the MFA tool, the unique reference. ### Claim 10 (depends on 1) The system of claim 1, wherein the automatic detection of an administrative account lifecycle event is associated with an Information Technology (“IT”) ticketing application. ### Claim 11 (depends on 1) The system of claim 1, further comprising: (c) a communication port coupled to the back-end application computer server to facilitate an exchange of data with a remote device via a distributed communication network to support interactive user interface displays that include information about the second factor mappings to enforce the MFA requirements. ### Claim 12 A Multi-Factor Authentication (“MFA”) enforcement method for an enterprise, comprising: scanning, by a computer processor of an MFA tool associated with a back-end computer server and in communication with an Identity and Access Management (“IAM”) tool, a computing environment, associated with Lightweight Directory Access Protocol (“LDAP”), along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise, wherein the employee and account data store contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise; responsive to the identified administrative account lifecycle events, automatically determining modifications to MFA requirements; and responsive to the determination, automatically implementing second factor mappings, associated with hardware tokens, to enforce the MFA requirements, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result: selecting hardware token serial numbers, client keys, and secrets from a repository by the IAM tool, registering, by the IAM tool, the serial numbers, client keys, and secrets with the MFA tool, and arranging to physically provide the hardware token to the employee. ### Claim 13 (depends on 12) The method of claim 12, wherein the lifecycle events are associated with at least one of: (i) onboarding a newly hired employee of the enterprise, (ii) an indication that an employee has a new role, (iii) an employee termination. ### Claim 14 (depends on 12) The method of claim 12, wherein the second factor mappings are further associated with at least one of: (i) mobile phone numbers, and (ii) biometric information. ### Claim 15 A non-transitory computer-readable medium storing instructions, that, when executed by a processor, cause the processor to perform a multi-factor authentication (MFA) enforcement method for an enterprise, the method comprising: scanning, by a computer processor of an MFA tool associated with a back-end computer server and in communication with an Identity and Access Management (“IAM”) tool, a computing environment, associated with Lightweight Directory Access Protocol (“LDAP”), along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise, wherein the employee and account data store that contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise; responsive to the identified administrative account lifecycle events, automatically determining modifications to MFA requirements; and responsive to the determination, automatically implementing second factor mappings, associated with hardware tokens, to enforce the MFA requirements, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result: selecting hardware token serial numbers, client keys, and secrets from a repository by the IAM tool, registering, by the IAM tool, the serial numbers, client keys, and secrets with the MFA tool, and arranging to physically provide the hardware token to the employee. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the second factor mappings are further associated with at least one of: (i) mobile phone numbers, and (ii) biometric information.