# US 8,782,748 B2 · Online service access controls using scale out directory features > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,748 B2 - Document ID: US8782748B2 - Status: Granted - Kind: B2 - Application number: 12/821,103 - Filed: 2010-06-22 - Published: 2011-12-22 - Granted: 2014-07-15 - Earliest claimed: 2010-06-22 - Assignees: Microsoft Corporation - Applicants: Marcin Olszewski; Jonathan Luk; Alexander I. Hopmann; Fabricio Chalub Barbosa do Rosario; David Paul Harris Gorbet; Jason Matthew Cahill - Inventors: Marcin Olszewski; Jonathan Luk; Alexander I. Hopmann; Fabricio Chalub Barbosa do Rosario; David Paul Harris Gorbet; Jason Matthew Cahill - Web page: https://patentgrep.com/patent/US8782748B2 ## CPC - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/104: {Grouping of entities} - G06F 2221/2117: User registration - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments provide application and/or resource access control features of an online computing environment, but are not so limited. In an embodiment, a computer-implemented method provides access control features for an online application environment based in part on the use of a number of directory service instances isolated from direct customer access and deployed in a defined datacenter architecture. In one embodiment, a computing environment uses web-based access control features and a number of directory service instances having organizational units and corresponding mappings to maintain a support infrastructure as part of providing features of online application services to customers. Other embodiments are included and available. ## Claims ### Claim 1 A method comprising: using a grid network architecture that includes a plurality of serving computers including using a grid manager to maintain global mappings associated with tenants and a plurality of directory service instances, wherein the grid manager operates in part to monitor a deployment status of the plurality of directory service instances and make one or more new directory service instances available to the tenants when called, wherein the grid manager provides global mapping information for synchronizing directory service instance updates; using the plurality of directory service instances in part to define access privileges for groups of customers requesting services of the serving computers, each directory service instance being independent of other directory service instances and including one or more organizational units, wherein each organizational unit is associated with a distinct customer and includes authorized users and one or more authorized foreign principle objects (FPOs); populating each organizational unit with customer data used to control access to services of the serving computers; and storing the directory service instances in computer readable storage. ### Claim 2 (depends on 1) The method of claim 1, further comprising receiving access requests for access to a datacenter including using domain information of each request to identify an organizational unit of a directory service instance corresponding to a user issuing the request wherein each FPO includes mapping parameters that point to another user object, group, or directory service instance of a different organizational unit. ### Claim 3 (depends on 1) The method of claim 1, further comprising using the directory service instances in conjunction with a domain that includes online resources and service accounts corresponding to dedicated service farms. ### Claim 4 (depends on 1) The method of claim 1, further comprising creating organizational units for each directory service instance, each organizational unit to include the authorized users, one or more authorized groups, and the one or more authorized FPOs, wherein the one or more authorized FPOs include one or more non-employee users with a reference to one of a partner tenant and a support agent role. ### Claim 5 (depends on 4) The method of claim 4, further comprising creating organizational units of each data instance to include mappings between FPOs and organizational units. ### Claim 6 (depends on 5) The method of claim 5, further comprising examining a FPO of a first organizational unit as part of locating a second organizational unit to verify support access. ### Claim 7 (depends on 1) The method of claim 1, further comprising denying access to a requested service if a requesting user is not associated with an organizational unit. ### Claim 8 (depends on 1) The method of claim 1, further comprising providing access to the requested services if a requesting user is associated with an organizational unit and included in a security group having defined access permissions. ### Claim 9 (depends on 1) The method of claim 1, further comprising using a plurality of user classes as part of populating each organizational unit. ### Claim 10 (depends on 1) The method of claim 1, further comprising updating directory service instances to maintain current access permissions within corresponding organizational units. ### Claim 11 (depends on 1) The method of claim 1, further comprising adding additional directory service instances to support additional customers. ### Claim 12 (depends on 1) The method of claim 1, further comprising providing real-time inventory of customer information to facilitate user authorization and resource management by building service tokens for permitted users of a grid network architecture. ### Claim 13 A system comprising: server resources including processing and memory components to support one or more server farms as part of providing an online application service; a synchronization component to synchronize online customer data with the online application service using a number of directory service instance (DSI) data structures that include customer and partner information, wherein each DSI data structure includes one or more organizational units, wherein each organizational unit is associated with a distinct customer and includes authorized users and one or more authorized FPOs; a grid manager to maintain global mappings associated with tenants and the number of DSI data structures, wherein the grid manager operates in part to monitor a deployment status of the number of DSI data structures and make one or more new DSI data structures available to the tenants when called, wherein the grid manager provides global mapping information for synchronizing DSI data structure updates; storage to store the DSI data structures; and a claim provider component to query a domain controller associated with a DSI data structure stored in the storage to control access to the server resources. ### Claim 14 (depends on 13) The system of claim 13, wherein each DSI data structure includes a number of organizational unit data structures including user objects, group objects, and subscription objects. ### Claim 15 (depends on 14) The system of claim 14, wherein each DSI data structure includes multiple customer organizational units, each unit including customer employees, security groups, and extranet users. ### Claim 16 (depends on 14) The system of claim 14, wherein the server resources are accessible as part of an online service and based in part on at least one access type. ### Claim 17 A computer readable storage device which stores encoded instructions used in part to provide online services comprising: maintaining global mappings associated with tenants and a plurality of directory service instances; monitoring a deployment status of the plurality of directory service instances; making one or more new directory service instances available to the tenants when called and providing global mapping information for synchronizing directory service instance updates; receiving a request for an online resource of a data grid network; obtaining access information from the request; identifying a directory service instance associated with the access information, wherein each directory service instance includes one or more organizational units, wherein each organizational unit is associated with a distinct customer and includes authorized users and one or more authorized FPOs; and examining the directory service instance to determine if the request issued from an authorized user and an access level of the authorized user. ### Claim 18 (depends on 17) The computer readable storage device of claim 17 which stores encoded instructions to control access based in part on an associated permission of an existing user of an augmented security group. ### Claim 19 (depends on 17) The computer readable storage device of claim 17 which stores encoded instructions to control access to an online asset based in part on a subscription and user type. ### Claim 20 (depends on 17) The computer readable storage device of claim 17 which stores encoded instructions that provide online services including building a service collection token using in part the access information augmented with any group claims.