# US 2026/0100953 A1 · Automated user access management for web-based applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100953 A1 - Document ID: US20260100953A1 - Status: Published application - Kind: A1 - Application number: 18/908,924 - Filed: 2024-10-08 - Published: 2026-04-09 - Earliest claimed: 2024-10-08 - Assignees: Sailpoint Technologies, Inc. - Applicants: Sailpoint Technologies, Inc. - Inventors: Eldar Kleiner; David Ben Zakai; Daniel Parolla; Timor Eizenman - Web page: https://patentgrep.com/patent/US20260100953A1 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method includes, in a browser running on a computing device, detecting that an administrator of a given web-based application (WBA) among multiple WBAs, has logged-in to the given WBA. While the administrator is logged-in: (i) a user whose access privileges to the given WBA are required to be changed is automatically identified, and (ii) the access privileges of the user in the given WBA by the browser, are changed on behalf of the logged-in administrator. ## Claims ### Claim 1 A method, comprising: in a browser running on a computing device, detecting that an administrator, of a given web-based application (WBA) among multiple WBAs, has logged-in to the given WBA; and while the administrator is logged-in: automatically identifying a user whose access privileges to the given WBA are required to be changed; and changing the access privileges of the user in the given WBA by the browser, on behalf of the logged-in administrator. ### Claim 2 (depends on 1) The method according to claim 1, wherein, in logging-in, the administrator initiates a secure session with the given WBA, and wherein changing the access privileges is performed as part of the secure session. ### Claim 3 (depends on 1) The method according to claim 1, wherein automatically identifying the user comprises: sending from the browser to a server, in response to detecting that the administrator has logged-in, a query for users that are associated with the given WBA and whose access privileges are required to be changed; and receiving from the server information relating to the user in response to the query. ### Claim 4 (depends on 1) The method according to claim 1, wherein changing the access privileges comprises automatically changing the access privileges on behalf of the logged-in administrator using a cookie to authenticate the administrator. ### Claim 5 (depends on 4) The method according to claim 4, wherein automatically changing the access privileges comprises: in response to detecting that the administrator has logged-in, obtaining from a server to the browser, access-management Application Programming Interface (API) information of the given WBA; and accessing the given WBA using the obtained access-management API information. ### Claim 6 (depends on 1) The method according to claim 1, wherein changing the access privileges comprises displaying, to the administrator, a message indicative of the user whose access privileges to the given WBA are required to be changed. ### Claim 7 (depends on 6) The method according to claim 6, and comprising providing the administrator with instructions for changing the access privileges of the user in the given WBA. ### Claim 8 (depends on 1) The method according to claim 1, wherein changing the access privileges comprises deleting the access privileges of the user to the given WBA. ### Claim 9 (depends on 1) The method according to claim 1, wherein changing the access privileges comprises granting the user new access privileges to the given WBA. ### Claim 10 (depends on 1) The method according to claim 1, wherein the access privileges comprise: (i) a first level of access privileges granting the user to perform a first set of operations in the given WBA, and (ii) a second level of access privileges granting the user to perform a second set of operations in the given WBA, different from the first set, wherein changing the access privileges comprises changing the access privileges of the user from the first level to the second level. ### Claim 11 A system, comprising: a network interface, which is configured to communicate over a data network with one or more web-based applications (WBAs); and a processor, which is configured to run a browser, and detect in the browser that an administrator, of a given web-based application (WBA) among the WBAs, has logged-in to the given WBA, and while the administrator is logged-in: the processor is configured to: (a) automatically identify a user whose access privileges to the given WBA are required to be changed; and (b) change, via the network interface, the access privileges of the user in the given WBA by the browser, on behalf of the logged-in administrator. ### Claim 12 (depends on 11) The system according to claim 11, wherein, in response to the logging-in of the administrator, the processor is configured to initiate a secure session with the given WBA, and wherein the processor is configured to change the access privileges as part of the secure session. ### Claim 13 (depends on 11) The system according to claim 11, wherein the processor is configured to automatically identify the user by: sending from the browser to a server, in response to detecting that the administrator has logged-in, a query for users that are associated with the given WBA and whose access privileges are required to be changed; and receiving from the server information relating to the user in response to the query. ### Claim 14 (depends on 11) The system according to claim 11, wherein the processor is configured to automatically change the access privileges on behalf of the logged-in administrator using a cookie to authenticate the administrator. ### Claim 15 (depends on 14) The system according to claim 14, wherein the processor is configured to automatically change the access privileges on behalf of the logged-in administrator by: in response to detecting that the administrator has logged-in, the processor is configured to obtain from a server to the browser, access-management Application Programming Interface (API) information of the given WBA; and accessing the given WBA using the obtained access-management API information. ### Claim 16 (depends on 11) The system according to claim 11, wherein the processor is configured to change the access privileges on behalf of the logged-in administrator by displaying, to the administrator, a message indicative of the user whose access privileges to the given WBA are required to be changed, and changing the access privileges (i) by the logged-in administrator, or (ii) on behalf of the logged-in administrator. ### Claim 17 (depends on 16) The system according to claim 16, wherein the processor is configured to provide the administrator with instructions for changing the access privileges of the user in the given WBA. ### Claim 18 (depends on 11) The system according to claim 11, wherein, in changing the access privileges, the processor is configured to delete the access privileges of the user to the given WBA. ### Claim 19 (depends on 11) The system according to claim 11, wherein, in changing the access privileges, the processor is configured to grant the user new access privileges to the given WBA. ### Claim 20 (depends on 11) The system according to claim 11, wherein the access privileges comprise: (i) a first level of access privileges granting the user to perform a first set of operations in the given WBA, and (ii) a second level of access privileges granting the user to perform a second set of operations in the given WBA, different from the first set, and wherein, in changing the access privileges, the processor is configured to change the access privileges of the user from the first level to the second level.