Patent ID: 11956239
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 7:
8. One or more computer storage media having computer executable instructions stored thereon which, when executed by hardware one or more processors, cause the processors to execute a method for detection of identity misconfiguration in a remote computing resource provider system, the method comprising:
collecting identity to role binding data and role to access rules data from multiple clusters supported by the remote computing resource provider system;
for each of one or more identities in the collected identity to role binding data, extracting a set of access rules for each identity from the identity to role binding data and role to access rules data collected from the multiple clusters;
creating an access rule prediction model from the sets of access rules extracted for the one or more identities from the identity to role binding data and role to access rules data collected from the multiple clusters to predict access rules for identities;
receiving an identity definition request for a tenant, the identity definition request having a requested identity and a requested role assigned to the identity;
obtaining a set of access rules for the role assigned to the identity;
obtaining a predicted set of access rules for the requested identity from the access rule prediction model;
comparing the set of access rules for the requested role to the predicted set of access rules for the requested identity;
determining that there is a difference between the set of access rules for the requested role and the predicted set of access rules for the requested identity;
based on determining that there is the difference between the set of access rules for the requested role and the predicted set of access rules for the requested identity, generating an identity misconfiguration alert that identifies the difference between the set of access rules for the requested role and the predicted set of access rules for the requested identity; and
based on generating the identity misconfiguration alert, reconfiguring the requested identity using the predicted set of access rules for the requested identity.