# US 2026/0100941 A1 · Composite identity for accessing network-based services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100941 A1 - Document ID: US20260100941A1 - Status: Published application - Kind: A1 - Application number: 18/905,977 - Filed: 2024-10-03 - Published: 2026-04-09 - Earliest claimed: 2024-10-03 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Ariel Nicolas GORDON; Muhammad Ali Malik; Kundan Bharti - Web page: https://patentgrep.com/patent/US20260100941A1 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/102: {Entity profiles} - H04L 63/104: {Grouping of entities} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Access management in a network-based service involves identifying an action involving a first account and determining if an account policy forbids the action. If forbidden, the system identifies an identity data structure linking the first account with a second account of a different type. The system determines if the second account allows the action, sends a transmission to the user's device identifying the second account, and receives an access token. If the token is valid, the system performs the action. The system may also create a new account if policies allow. ## Claims ### Claim 1 A method for access management in a network-based service, the method comprising: identifying, at a server of the network-based service, an action involving a first account used by a user to access resources; determining, at the server of the network-based service, that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response: identifying, at the server of the network-based service, an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account; determining, at the server of the network-based service, according to the policy, that the second account referenced in the identity data structure allows for taking the action; sending, at the server of the network-based service, a transmission to a device of the user via the first account of the user, the transmission identifying the second account; receiving, at the device of the user, the transmission; selecting, at the device of the user, an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account; transmitting, at the device of the user, the access token to the server of the network-based service; receiving, at the server of the network-based service, the access token from the device of the user; and responsive to the server of the network-based service validating that the access token received from the device of the user is valid and allows the action, the server causing performance of the action involving the user. ### Claim 2 (depends on 1) The method of claim 1, wherein the identity data structure includes different account types that are required to access different actions within a first tenant. ### Claim 3 (depends on 1) The method of claim 1, further comprising, at the server of the network-based service: responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention. ### Claim 4 (depends on 1) The method of claim 1, further comprising, at the server of the network-based service: creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account. ### Claim 5 (depends on 4) The method of claim 4, wherein the attribute is one of: an email address, a phone number, or an internet protocol address. ### Claim 6 (depends on 1) The method of claim 1, further comprising, at the server of the network-based service: identifying that the second account was created based upon the first account, and in response, creating the identity data structure associating the first and second accounts. ### Claim 7 (depends on 1) The method of claim 1, wherein the action is sharing content. ### Claim 8 (depends on 1) The method of claim 1, further comprising: identifying, in the network-based service, a first action and a second action associated with a first tenant, the first action requiring a first privilege level and the second action requiring a second privilege level; determining that the first account does not have the first privilege level to perform the first action; identifying that the second account has the second privilege level to perform the first action; sending a transmission to the first account of the user, the transmission causing a computing device of the user to utilize an associated token of the second account to perform the first action; determining that the first and second accounts do not have the required privilege level to perform the second action; identifying, in the identity data structure, a third account that has the required privilege level to perform the second action; sending a transmission to the first account of the user, the transmission causing the computing device of the user to utilize an associated token of the third account to perform the second action; and determining that if the third account is not included in the identity data structure, the user cannot perform the second action. ### Claim 9 A computing device for access management in a network-based service, the computing device comprising: a hardware processor; a memory, the memory storing instructions, which when executed by the hardware processor cause the computing device to perform operations comprising: identifying an action involving a first account used by a user to access resources; determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response: identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account; determining, according to the policy, that the second account referenced in the identity data structure allows for taking the action; sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account; receiving the transmission at the device of the user; selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account; transmitting the access token to the server of the network-based service; receiving the access token from the device of the user; and responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the identity data structure includes different account types that are required to access different actions within a first tenant. ### Claim 11 (depends on 9) The computing device of claim 9, wherein the operations further comprise: responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention. ### Claim 12 (depends on 9) The computing device of claim 9, wherein the operations further comprise: creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the attribute is one of: an email address, a phone number, or an internet protocol address. ### Claim 14 (depends on 9) The computing device of claim 9, wherein the operations further comprise: identifying that the second account was created based upon the first account, and in response, creating the identity data structure associating the first and second accounts. ### Claim 15 (depends on 9) The computing device of claim 9, wherein the action is sharing content. ### Claim 16 (depends on 9) The computing device of claim 9, wherein the operations further comprise: identifying a first action and a second action associated with a first tenant, the first action requiring a first privilege level and the second action requiring a second privilege level; determining that the first account does not have the first privilege level to perform the first action; identifying that the second account has the second privilege level to perform the first action; sending a transmission to the first account of the user, the transmission causing a computing device of the user to utilize an associated token of the second account to perform the first action; determining that the first and second accounts do not have the required privilege level to perform the second action; identifying, in the identity data structure, a third account that has the required privilege level to perform the second action; sending a transmission to the first account of the user, the transmission causing the computing device of the user to utilize an associated token of the third account to perform the second action; and determining that if the third account is not included in the identity data structure, the user cannot perform the second action. ### Claim 17 A machine-readable medium, storing instructions for access management in a network-based service, the instructions, which when executed, cause the machine to perform operations comprising: identifying an action involving a first account used by a user to access resources; determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response: identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account; determining, according to the policy, that the second account referenced in the identity data structure allows for taking the action; sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account; receiving the transmission at the device of the user; selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account; transmitting the access token to the server of the network-based service; receiving the access token from the device of the user; and responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user. ### Claim 18 (depends on 17) The machine-readable medium of claim 17, wherein the identity data structure includes different account types that are required to access different actions within a first tenant. ### Claim 19 (depends on 17) The machine-readable medium of claim 17, wherein the operations further comprise: responsive to determining that the account policy forbids performing the action for the account type of the first account, evaluating the account policy and an account creation policy to determine whether a different account type may be created for the user that is authorized to perform the action; and responsive to determining that the account policy and the account creation policy allows creation of the different account type, automatically creating the second account without user intervention. ### Claim 20 (depends on 17) The machine-readable medium of claim 17, wherein the operations further comprise: creating the identity data structure with the first account and the second account by matching an attribute of the first account with a same attribute of the second account.