Online service access controls using scale out directory features

A system comprising:

• server resources including processing and memory components to support one or more server farms as part of providing an online application service;
• a synchronization component to synchronize online customer data with the online application service using a number of directory service instance (DSI) data structures that include customer and partner information, wherein each DSI data structure includes one or more organizational units, wherein each organizational unit is associated with a distinct customer and includes authorized users and one or more authorized FPOs;
• a grid manager to maintain global mappings associated with tenants and the number of DSI data structures, wherein the grid manager operates in part to monitor a deployment status of the number of DSI data structures and make one or more new DSI data structures available to the tenants when called, wherein the grid manager provides global mapping information for synchronizing DSI data structure updates;
• storage to store the DSI data structures;
• and
• a claim provider component to query a domain controller associated with a DSI data structure stored in the storage to control access to the server resources.

A computer readable storage device which stores encoded instructions used in part to provide online services comprising:

• maintaining global mappings associated with tenants and a plurality of directory service instances;
• monitoring a deployment status of the plurality of directory service instances;
• making one or more new directory service instances available to the tenants when called and providing global mapping information for synchronizing directory service instance updates;
• receiving a request for an online resource of a data grid network;
• obtaining access information from the request;
• identifying a directory service instance associated with the access information, wherein each directory service instance includes one or more organizational units, wherein each organizational unit is associated with a distinct customer and includes authorized users and one or more authorized FPOs;
• and
• examining the directory service instance to determine if the request issued from an authorized user and an access level of the authorized user.