# US 2026/0100948 A1 · Automated multi-factor authentication enforcement during administrative account lifecycle events

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0100948 A1
- Document ID: US20260100948A1
- Status: Published application
- Kind: A1
- Application number: 18/907,214
- Filed: 2024-10-04
- Published: 2026-04-09
- Earliest claimed: 2024-10-04
- Assignees: Hartford Fire Insurance Company
- Inventors: Lori-Ann Forand; Timothy R. Keefe; Donella King-Smith; David Maraia; Aurelio Miguel; Colleen Ryan; Annadurai Shanmugam; Anshuman Upadhyay
- Web page: https://patentgrep.com/patent/US20260100948A1

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A Multi-Factor Authentication (“MFA”) tool may implement an enforcement system for an enterprise. The tool may scan a computing environment along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise. The employee and account data store may contain, for example, electronic records associated with a plurality of employees and cloud computing accounts for the enterprise. Responsive to the identified administrative account lifecycle events, modifications to MFA requirements may be automatically determined. Responsive to that determination, embodiments may automatically implement second factor mappings to enforce the MFA requirements. The second factor mappings might be associated with, for example, mobile phone numbers, hardware tokens, or biometric information.

## Claims

### Claim 1

A Multi-Factor Authentication (“MFA”) enforcement system for an enterprise, comprising:
(a) an employee and account data store that contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise; and
(b) an MFA tool, coupled to the employee and account data store, including:
a computer processor, and
a computer memory coupled to the computer processor and storing instructions that, when executed by the computer processor, cause a back-end application computer server associated with the MFA tool to:
scan a computing environment along with the employee and account data store to automatically detect administrative account lifecycle events for the enterprise,
responsive to the identified administrative account lifecycle events, automatically determine modifications to MFA requirements, and
responsive to the determination, automatically implement second factor mappings to enforce the MFA requirements.

### Claim 2 (depends on 1)

The system of claim 1, wherein the lifecycle events are associated with at least one of: (i) onboarding a newly hired employee of the enterprise, (ii) an indication that an employee has a new role, (iii) an employee termination.

### Claim 3 (depends on 1)

The system of claim 1, wherein the MFA tool communicates with an Identity and Access Management (“IAM”) tool.

### Claim 4 (depends on 3)

The system of claim 3, wherein the computing environment is associated with Lightweight Directory Access Protocol (“LDAP”).

### Claim 5 (depends on 4)

The system of claim 4, wherein the second factor mappings are associated with mobile phone numbers.

### Claim 6 (depends on 5)

The system of claim 5, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result:
automatically enabling MFA,
identifying a mobile phone number for an account owner,
setting up an MFA profile,
associating accounts to appropriate mobile numbers in MFA, and
transmitting activation links.

### Claim 7 (depends on 6)

The system of claim 6, wherein the IAM tool automatically adds any required privileges via group memberships and performs synchronization with the MFA tool.

### Claim 8 (depends on 6)

The system of claim 6, wherein MFA is automatically removed if the identified account does not qualify for MFA and MFA is currently enabled.

### Claim 9 (depends on 6)

The system of claim 6, wherein accounts are grouped based on User Principal Names (“UPN”).

### Claim 10 (depends on 4)

The system of claim 4, wherein the second factor mappings are associated with hardware tokens.

### Claim 11 (depends on 10)

The system of claim 10, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result:
selecting hardware token serial numbers, client keys, and secrets from a repository by the IAM tool,
registering, by the IAM tool, the serial numbers, client keys, and secrets with the MFA tool, and
arranging to physically provide the hardware token to the employee.

### Claim 12 (depends on 11)

The system of claim 11, wherein the second factor mappings are associated with biometric information.

### Claim 13 (depends on 12)

The system of claim 12, wherein the automatic implementation of second factor mappings to enforce the MFA requirements includes determining that an identified account qualifies for MFA but is not currently enabled and, as a result:
during issuance of a smart card to the employee, capturing biometrics,
mapping, by an IAM tool, the employee smart card and biometrics with employee's profile,
generating a unique reference for each mapping, and
mapping, by the MFA tool, the unique reference.

### Claim 14 (depends on 4)

The system of claim 4, wherein the automatic detection of an administrative account lifecycle event is associated with an Information Technology (“IT”) ticketing application.

### Claim 15 (depends on 1)

The system of claim 1, further comprising:
(c) a communication port coupled to the back-end application computer server to facilitate an exchange of data with a remote device via a distributed communication network to support interactive user interface displays that include information about the second factor mappings to enforce the MFA requirements.

### Claim 16

A Multi-Factor Authentication (“MFA”) enforcement method for an enterprise, comprising:
scanning, by a computer processor of an MFA tool, a computing environment along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise, wherein the employee and account data store that contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise;
responsive to the identified administrative account lifecycle events, automatically determining modifications to MFA requirements; and
responsive to the determination, automatically implementing second factor mappings to enforce the MFA requirements.

### Claim 17 (depends on 16)

The method of claim 16, wherein the lifecycle events are associated with at least one of: (i) onboarding a newly hired employee of the enterprise, (ii) an indication that an employee has a new role, (iii) an employee termination.

### Claim 18 (depends on 16)

The method of claim 16, wherein the MFA tool communicates with an Identity and Access Management (“IAM”) tool.

### Claim 19 (depends on 18)

The method of claim 18, wherein the computing environment is associated with Lightweight Directory Access Protocol (“LDAP”).

### Claim 20 (depends on 19)

The method of claim 19, wherein the second factor mappings are associated with at least one of: (i) mobile phone numbers, (ii) hardware tokens, and (iii) biometric information.

### Claim 21

A non-transitory, computer-readable medium storing instructions, that, when executed by a processor, cause the processor to perform a multi-factor authentication (“MFA”) enforcement method for an enterprise, the method comprising:
scanning, by a computer processor of an MFA tool, a computing environment along with an employee and account data store to automatically detect administrative account lifecycle events for the enterprise, wherein the employee and account data store that contains electronic records associated with a plurality of employees and cloud computing accounts for the enterprise;
responsive to the identified administrative account lifecycle events, automatically determining modifications to MFA requirements; and
responsive to the determination, automatically implementing second factor mappings to enforce the MFA requirements.

### Claim 22 (depends on 21)

The medium of claim 21, wherein a back-end application computer server associated with the MFA tool includes an Identity and Access Management (“IAM”) tool, the computing environment is associated with Lightweight Directory Access Protocol (“LDAP”), and the second factor mappings are associated with at least one of: (i) mobile phone numbers, (ii) hardware tokens, and (iii) biometric information.