Access Orchestration Engine for Consumer Identity Cloud Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional cloud access management systems lack comprehensive computing logic and infrastructure to support consumer-identity-based access to remote clients, leading to inefficient utilization of compute and storage resources and a deficient user experience due to the need to manage both organization and consumer identities.

Innovation Solution

Implementing an access orchestration engine that supports consumer-identity-based access orchestration operations, including configuring a consumer-identity-supported tenant environment, provisioning remote clients with necessary resources, and allowing users to access remote clients using their consumer identities, thereby eliminating the need for organization domains and identities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional cloud access management systems are used with organization identities only, then access control is maintained, but resource utilization is inefficient and user experience is deficient

Engineering Contradiction:

Improveresource utilization efficiencyVSAvoiduser experience

Core Design Contradiction:

ProductivityVSEase of operation

Solution Approach 1:

The patent merges organization identities and consumer identities into a unified identity framework. The system allows users to access organization resources using their existing consumer identities (e.g., personal email accounts) while maintaining proper access control. This eliminates the need for separate identity management systems and improves both resource utilization and user experience by allowing seamless access with familiar credentials.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The access management system is enhanced to support multiple identity types (organization identities and consumer identities) through a universal framework. The system can handle different identity kinds uniformly, allowing the same infrastructure to serve both traditional enterprise identity management and modern consumer identity access patterns, thereby improving efficiency and ease of operation.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Ease of operation

If consumer identity support is added to cloud access management, then user experience improves, but system complexity increases

Engineering Contradiction:

Improveuser experienceVSAvoidsystem complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The patent introduces an identity federation layer that acts as an intermediary between consumer identity providers and organization resources. This mediator handles the complexity of identity mapping, authentication, and authorization transparently, allowing consumer identity support to be added without directly complicating the core access management system. The federation layer absorbs the complexity while presenting a simple interface to users.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If dual identity management (organization and consumer) is implemented, then access flexibility improves, but computing resource overhead increases

Engineering Contradiction:

Improveaccess flexibilityVSAvoidcomputing resource overhead

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts the identity management complexity into a separate identity federation service that operates independently from the core access management system. By separating consumer identity handling from organization identity management, the system achieves access flexibility without duplicating computing resources. The extracted identity service reuses infrastructure and avoids redundant processing.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12603871B2Access orchestration engine in a cloud access management system

Publication Date: 2026.04.14 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Methods, systems, and computer storage media for providing cloud access management using an access orchestration engine in a cloud access management system. Cloud access management provides access to a remote client of a consumer-identity-supported tenant environment of an organization. In operation, a consumer identity of a user is accessed. The consumer identity is approved for access to the consumer-identity-supported tenant environment. Based on accessing the consumer identity, access orchestration operations are executed for the remote client using remote client access resources, organization resources, and consumer identity resources. Executing the access orchestration operations comprises provisioning the remote client with remote access services for consumer identities; provisioning the remote client with organization resources; and priming the remote client with the consumer identity resources upon determining that the consumer identity is associated with the consumer-identity-supported tenant environment. The remote client is deployed, and the remote client is accessible based on the consumer identity.