Cross-Tenant Identity Objects for Guest-Free Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In multi-tenant environments, users face challenges in accessing resources across different organizations without creating individual guest accounts, leading to inefficiencies and lack of centralized management for resource sharing, which complicates authorization and configuration.

Innovation Solution

A system for cross-tenant access that authenticates users using a user token, determines cross-tenant policies, and forms an identity object based on these policies to manage permissions dynamically, allowing secure access without manual guest account creation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If individual guest accounts are created for each user accessing resources across different organizations, then access permission can be granted to specific users, but the system complexity and manual management overhead increase significantly

Engineering Contradiction:

Improveaccess permission managementVSAvoidsystem complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The patent implements a universal identity token system that serves multiple functions: authentication, authorization, and cross-tenant access management. Instead of creating separate guest accounts for each user-organization pair, the system uses a single identity object that can be reused across multiple tenants, eliminating the need for manual account creation and reducing system complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent merges the authentication and authorization processes by combining user identity verification with cross-tenant access permissions into a single identity object. This consolidation eliminates the need for separate guest account management and reduces the number of manual operations required.

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If manual guest account creation is used for cross-tenant access, then user access can be controlled, but the time and computational resources required for account management increase

Engineering Contradiction:

Improveaccess controlVSAvoidaccount management time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary authentication and generates the identity object before the user actually accesses cross-tenant resources. This advance preparation eliminates the need for manual account creation at the time of access, reducing the time required for cross-tenant resource access while maintaining secure control.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system enables self-service cross-tenant access by automatically generating and managing identity objects based on pre-configured policies. Users can access resources across tenants without manual administrative intervention, as the system automatically handles authentication and permission verification.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If multiple guest accounts are maintained for accessing different organizations, then users can access resources from multiple tenants, but the operational complexity and account switching requirements increase

Engineering Contradiction:

Improvecross-tenant access capabilityVSAvoidaccount management ease

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The identity object is designed to be universal and multi-functional, serving as a single credential that works across multiple tenants and organizations. This eliminates the need for users to maintain and switch between multiple guest accounts, as the same identity object can be used to access resources from any configured tenant.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Productivity

If centralized management for resource sharing is implemented, then permission configuration can be streamlined, but the system architecture complexity increases

Engineering Contradiction:

Improvepermission configuration efficiencyVSAvoidsystem architecture complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system introduces an intermediary identity object that mediates between users and cross-tenant resources. This identity object serves as a standardized interface that simplifies permission configuration and management, allowing centralized control without significantly increasing overall system architecture complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12489750B2User permission in a multi-tenant environment

Publication Date: 2025.12.02 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A cross-tenant authentication system is described. The system receives a user token from a client device that is registered with a first tenant of a service application of a server. The system receives a request, from the client device, to access a second feature of a second tenant of the service application. The second feature of the second tenant of the service application is separate from a first feature of the first tenant of the service application. The second feature is only accessible to devices registered with the second tenant of the service application. The system authenticates the request by validating the user token from the client device and determines a cross-tenant policy of the second tenant of the service application based on the user token. The system forms an identity object based on the cross-tenant policy.