# US 2021/0342196 A1 · Multiple customer environment management in a cloud services platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0342196 A1 - Document ID: US20210342196A1 - Status: Published application - Kind: A1 - Application number: 16/892,814 - Filed: 2020-06-04 - Published: 2021-11-04 - Earliest claimed: 2020-04-30 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Poornima Natarajan; Dasaradha Ramu Yalamanchili; Niraj Girishkumar Gandhi; Mutlu Kurtoglu; Mark Eugene Russinovich; Vladimir Joanovic; Kristopher A. Bash; Archana Balakrishnan; Kristian Nese; Stuart L. S. Kwan; Raju Charu Vikram Kakumani - Web page: https://patentgrep.com/patent/US20210342196A1 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - G06F 9/5005: {to service a request} - G06F 9/5072: {Grid computing} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0843: {based on generic templates} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 41/5048: {Automatic or semi-automatic definitions, e.g. definition templates} - H04L 41/0896: Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities (flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, apparatuses, and computer program products are described herein that enable a service provider to manage cloud resources deployed to different customer environments, residing in different tenants of a cloud services platform using a single access token. The service provider publishes templates that specify service provider permissions with respect to cloud resource deployments. By deploying such a template, a customer authorizes the service provider to manage cloud resources deployed to the customer's environment. In particular, the deployment causes an access token granted to the service provider to be associated with the customer cloud resources. When the service provider logs into his environment, the access token is provided to the cloud resource manager. Based at least on the service provider identifier included in the access token, the cloud resource manager logically projects to the service provider's environment the customer cloud resources that the service provider is permitted to manage. ## Claims ### Claim 1 A method implemented by a cloud services platform, comprising: determining that a first customer of the cloud services platform has deployed a first template published by a service provider to an environment of the first customer, the first template specifying first service provider permissions for a first cloud resource allocated to the environment of the first customer; responsive to determining that the first customer of the cloud services platform has deployed the first template, associating an identifier of the service provider with the first cloud resource, the associating indicating that the first customer has allowed the service provider to manage the first cloud resource; receiving a first request to perform an action with respect to the first cloud resource, the first request comprising an access token that comprises the identifier of the service provider; determining whether the service provider identified by the access token is associated with the first service provider permissions; and responsive to determining that the service provider identified by the access token is associated with the first service provider permissions, permitting the action to be completed with respect to the first cloud resource. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining that a second customer of the cloud services platform has deployed a second template published by the service provider to an environment of the second customer, the second template specifying second service provider permissions for a second cloud resource allocated to the environment of the second customer; responsive to determining that the second customer of the cloud services platform has deployed the second template, associating the identifier of the service provider with the second cloud resource, the associating indicating that the second customer has allowed the service provider to manage the second cloud resource; receiving a second request to perform an action with respect to the second cloud resource, the second request comprising the access token that comprises the identifier of the service provider; determining whether the service provider identified by the access token is associated with the second service provider permissions; and responsive to determining that the service provider identified by the access token is associated with the second service provider permissions, permitting the action to be completed with respect to the second cloud resource. ### Claim 3 (depends on 2) The method of claim 2, wherein the service provider is associated with a first tenant of the cloud services platform, wherein the first customer is associated with a second tenant of the cloud services platform, and wherein the second customer is associated with a third tenant of the cloud services platform. ### Claim 4 (depends on 2) The method of claim 2, wherein the first template and the second template are published to an online marketplace by the service provider and are selectable for deployment by at least one of the first customer or the second customer. ### Claim 5 (depends on 2) The method of claim 2, further comprising: providing a user interface via which the service provider is enabled to manage the first cloud resource allocated to the environment of the first customer and the second cloud resource allocated to the environment of the second customer; and receiving an input from the service provider via the user interface that causes a same action to be performed with respect to the first cloud resource and the second cloud resource. ### Claim 6 (depends on 2) The method of claim 2, wherein at least the first cloud resource or the second cloud resource comprises one or more of: a virtual machine; a Platform-as-a-Service (PaaS) application; a Software-as-a-Service (SaaS) application; a storage account; a Web application, a database; or a virtual network. ### Claim 7 (depends on 1) The method of claim 1, further comprising: providing the service provider a limited duration of time to perform the action, the limited duration of time being specified by the first customer via the first template. ### Claim 8 (depends on 1) The method of claim 1, wherein the access token is provided to the service provider responsive to the service provider logging into an environment associated with the service provider. ### Claim 9 (depends on 1) The method of claim 1, further comprising: logging the action in an activity log that is accessible to both the service provider and the first customer. ### Claim 10 A system, comprising: at least one processor circuit; and at least one memory that stores program code configured to be executed by the at least one processor circuit, the program code comprising: a cloud resource manager of a cloud services platform configured to: determine that a first customer of the cloud services platform has deployed a first template published by a service provider to an environment of the first customer, the first template specifying first service provider permissions for a first cloud resource allocated to the environment of the first customer; responsive to determining that the first customer of the cloud services platform has deployed the first template, associate an identifier of the service provider with the first cloud resource, the association indicating that the first customer has allowed the service provider to manage the first cloud resource; receive a first request to perform an action with respect to the first cloud resource, the first request comprising an access token that comprises the identifier of the service provider; determine whether the service provider identified by the access token is associated with the first service provider permissions; and responsive to determining that the service provider identified by the access token is associated with the first service provider permissions, permit the action to be completed with respect to the first cloud resource. ### Claim 11 (depends on 10) The system of claim 10, wherein the cloud resource manager is further configured to: determine that a second customer of the cloud services platform has deployed a second template published by the service provider to an environment of the second customer, the second template specifying second service provider permissions for a second cloud resource allocated to the environment of the second customer; responsive to determining that the second customer of the cloud services platform has deployed the second template, associate the identifier of the service provider with the second cloud resource, the association indicating that the second customer has allowed the service provider to manage the second cloud resource; receive a second request to perform an action with respect to the second cloud resource, the second request comprising the access token that comprises the identifier of the service provider; determine whether the service provider identified by the access token is associated with the second service provider permissions; and responsive to determining that the service provider identified by the access token is associated with the second service provider permissions, permit the action to be completed with respect to the second cloud resource. ### Claim 12 (depends on 11) The system of claim 11, wherein the service provider is associated with a first tenant of the cloud services platform, wherein the first customer is associated with a second tenant of the cloud services platform, and wherein the second customer is associated with a third tenant of the cloud services platform. ### Claim 13 (depends on 11) The system of claim 11, wherein the first template and the second template are published to an online marketplace by the service provider and are selectable for deployment by at least one of the first customer or the second customer. ### Claim 14 (depends on 11) The system of claim 11, wherein the cloud resource manager is further configured to: provide a user interface via which the service provider is enabled to manage the first cloud resource allocated to the environment of the first customer and the second cloud resource allocated to the environment of the second customer; and receive an input from the service provider via the user interface that causes a same action to be performed with respect to the first cloud resource and the second cloud resource. ### Claim 15 (depends on 11) The system of claim 11, wherein at least the first cloud resource or the second cloud resource comprises one or more of: a virtual machine; a Platform-as-a-Service (PaaS) application; a Software-as-a-Service (SaaS) application; a storage account; a Web application, a database; or a virtual network. ### Claim 16 (depends on 10) The system of claim 10, wherein the cloud resource manager is further configured to: provide the service provider a limited duration of time to perform the action, the limited duration of time being specified by the first customer via the first template. ### Claim 17 (depends on 10) The system of claim 10, wherein the access token is provided to the service provider responsive to the service provider logging into an environment associated with the service provider. ### Claim 18 (depends on 10) The system of claim 10, wherein the cloud resource manager is further configured to: log the action in an activity log that is accessible to both the service provider and the first customer. ### Claim 19 A computer-implemented system for managing cloud resources of a cloud services platform, comprising: a first user interface (UI) that enables a first customer to deploy a first template published by a service provider, the deployment of the first template causing a first cloud resource deployed to an environment of the first customer to be manageable by the service provider; a second UI that enables a second customer to deploy a second template published by the service provider, the deployment of the second template causing a second cloud resource deployed to an environment of the second customer to be manageable by the service provider; and a third UI that enables the service provider to take actions with respect to both the first cloud resource and the second cloud resource via a single input. ### Claim 20 (depends on 19) The system of claim 19, wherein the actions comprise one or more of: updating the first cloud resource and the second cloud resource; reading the first cloud resource and the second cloud resource; deleting the first cloud resource and the second cloud resource; performing a security-related task with respect to the first cloud resource and the second cloud resource; or performing a maintenance-related task with respect to the first cloud resource and the second cloud resource.