Patent Description:
Sherer Tim: "azure-docs/migrate-sdfs-apps-to-azure. md", URL: https://github. com/MicrosoftDocs/azure-does/blob/d022calf51029778852b5e5b928441167606f48f/articles/active-directory/manage-apps/migrate-adfs-apps-to-azure. md [retrieved on <NUM>-<NUM>-<NUM>], describes Azure active directory, which offers a universal identity platform on the cloud. When migrating to Azure AD it should be considered whether apps that use modern authentication protocol are migrated first. Apps that use SAML <NUM> for authentication can be configured for SAML based single sign-on. Apps that use the standard set of configuration elements and claims such as user principle name, email address, given name, surname can be moved easily.

<CIT> relates to an automated end-to-end network migration process from on-premise to cloud-based management platforms. The approach allows a plug and play approach for initiating the migration process. The PNP service on the target management platform receives a migration request from the device PNP agent and maps the requested device on to a client profile existing on the target management platform. The device is then directed to acquire and boot-up on a new software image compatible with the target management platform and converts its existing configuration to a version compatible with the new software image. The PNP software agent may specifically initiate a connection to a cloud onboarding server.

It is the object of the present invention to provide an apparatus, a method, and a computer-readable medium providing for an improved migration process of on-premise applications to the cloud.

For simplicity and illustrative purposes, the principles of the present disclosure are described by referring mainly to embodiments and examples thereof. In the following description, numerous specific details are set forth in order to provide an understanding of the embodiments and examples. It will be apparent, however, to one of ordinary skill in the art, that the embodiments and examples may be practiced without limitation to these specific details. In some instances, well known methods and/or structures have not been described in detail so as not to unnecessarily obscure the description of the embodiments and examples. Furthermore, the embodiments and examples may be used together in various combinations.

Many organizations may maintain on-premises access management systems to provide users with authentication services to applications. That is, the organizations may maintain infrastructures on their premises, such as servers, gateways, data storage devices, access points, cooling systems, and/or the like. The organizations may also store and execute software on-premises, in which the software may be executed to authenticate users such that authenticated users may be granted access to certain applications. As used herein, the applications may include services, applications executing on various types of devices, and/or the like.

In some examples, the on-premises software may provide federation services to users such that the users may have single sign-on access to the certain applications. For instance, the software may enable users to access the certain applications through entry of a single set of user credentials, e.g., user name, password, one time code, biometric information, and/or the like. Single sign-on identity management may allow users to access a large number of applications through the single sign-on process, which may save the users time and may make access to the applications more efficient. In some examples, the software may enable the single sign-on access through implementation of claims-based access-control authorization schemes. The claims-based access-control authorization schemes may involve the authentication of users based on sets of claims about the users' identities included in trusted tokens. The trusted tokens may be used and signed by an entity, e.g., the on-premise access management service, that is able to authenticate the users using the sets of user credentials.

The organizations may maintain the on-premise infrastructures necessary to provide users with the authentication services to the applications. This may include purchasing and maintaining servers and networking equipment, setting up cooling systems for the server and the networking equipment, setting up security on the software and networking equipment (e.g., malware protection), updating and executing the security, employing personnel to maintain the infrastructure, etc. Maintaining on-premise infrastructures may thus be cost and labor-intensive. As a result, many organizations may migrate some of the services, such as authentication services, to the cloud. However, the migration of the services may be a relatively difficult undertaking especially in instances in which there are a large number of applications for which single sign-on for users is to be implemented.

Disclosed herein are apparatuses, methods, and computer-readable media in which a processor may migrate authentication of users from an on-premise access management service to a cloud-based access management service in a relatively efficient manner. Particularly, for instance, the processor may identify configuration information that the on-premise access management service may use to provide authentication services to applications by users, such as single sign-on authentication. In addition, the processor may transform the identified configuration information into a transformed set of configuration information to be used by the cloud-based access management service in providing authentication services, such as single sign-on authentication, to the applications by the users. The processor may transform the configuration information of the applications by mapping the configuration information of the applications to configuration information that may be compatible for use by the cloud-based access management service.

In addition, the processor may store the transformed set of configuration information for use by the cloud-based access management service to provide authentication services to the applications by users to migrate authentication of the users from the on-premise access management service to the cloud-based access management service. The migration may not be active until the processor <NUM> receives an instruction, e.g., from an administrator of the cloud-based management service, to migrate authentication of the users from the on-premise access management service to the cloud-based access management service.

As discussed herein, the processor may perform configuration tests on the rules and/or settings of the applications that are to be migrated to determine whether the applications are ready to be migrated. The configuration tests may be performed to determine whether the rules and/or settings of the applications that the on-premise access management service may use are compatible with the rules and/or settings of the applications that the cloud-based access management service may use. In addition, or alternatively, the processor may determine priorities of the applications and may determine an order in which authentication of access to the applications may be migrated based on the determined priorities of the applications. The processor may output the results of the configuration tests such that, for instance, an administrator may identify any potential issues with the migration and may fix the potential issues prior to initiating the migration.

Through implementation of the features of the present disclosure, user authentication operations may be migrated from an on-premise infrastructure to the cloud in a relatively seamless and efficient manner. For instance, the applications may be made ready for the migration prior to initiating the migration, which may help resolve potential issues that may arise during the migration. In addition, the order in which the applications are to be migrated may be determined such that, for instance, any potential impacts of errors occurring during the migration may be reduced or minimized.

Implementation of the features of the present disclosure may reduce the uncertainty on time, budget, and technical expertise that may be required to migrate applications, e.g., move application identities, to the cloud. Implementation of the features of the present disclosure may also provide the technical improvement of migrating applications with configuration information that may function correctly in the cloud. The authentication of access by users to applications in the cloud may also benefit from the improved scalability, security, updates, and/or the like afforded by the cloud.

Reference is first made to <FIG> and <FIG>. <FIG> shows a block diagram of a network environment <NUM>, in which an apparatus <NUM> may transform configuration information to be used by an on-premise access management service into a transformed set of configuration information to be used by a cloud-based access management service to provide authentication services to applications such that authentication of users may be migrated to the cloud-based access management service, in accordance with an embodiment of the present disclosure. <FIG> depicts a block diagram of the apparatus <NUM> depicted in <FIG>, in accordance with an embodiment of the present disclosure. It should be understood that the network environment <NUM> and the apparatus <NUM> may include additional features and that some of the features described herein may be removed and/or modified without departing from the scopes of the network environment <NUM> and/or the apparatus <NUM>.

As shown in <FIG>, the network environment <NUM> may include the apparatus <NUM>, a user(s) <NUM>, an on-premise access management service <NUM>, a cloud-based access management service <NUM>, and applications <NUM>. The apparatus <NUM> may be any type of computing device such as a server, a laptop computer, a desktop computer, a tablet computer, and/or the like. In some examples, the apparatus <NUM> may be part of the cloud-based access management service <NUM>, e.g., a server in the cloud. In other examples, the functionalities of and/or operations that the apparatus <NUM> may perform may be distributed across multiple servers, multiple virtual machines, and/or the like, on the cloud.

The applications <NUM> may be web-based applications that the user <NUM> (or equivalently, multiple users <NUM>) may access via a network <NUM>. For instance, the applications <NUM> may be productivity applications, business applications, data storage applications, word processing applications, spreadsheet applications, banking applications, social media applications, and/or the like. The applications <NUM> may also be applications for which the user <NUM> may provide user credentials to access. The network <NUM> may be a local area network, a wide area network, the Internet, and/or the like. According to examples, the on-premise access management service <NUM> may provide authentication services <NUM> to the applications <NUM> by the user <NUM>. Particularly, the on-premise access management service <NUM> may be an organization specific system, e.g., include an on-premise infrastructure, that may provide users with single sign-on access to the applications <NUM>. In contrast, the cloud-based access management service <NUM> may be a multi-tenant system that may provide users in multiple organizations with respective single sign-on access, e.g., authentication services <NUM>, to respective applications <NUM>. That is, a cloud infrastructure, which may include the apparatus <NUM>, may provide the cloud-based access management service <NUM> via the network <NUM>, which may be the Internet. In some examples, a cloud-based service provider may provide the cloud-based access management service <NUM>. The cloud-based service provider may include a number of servers, virtual machines, data stores, and other types of machines through which the cloud-based access management service <NUM> may provide the authentication services <NUM> to the applications <NUM>. As discussed herein, the authentication of the user <NUM> to access the applications <NUM> may be migrated from the on-premise access management service <NUM> to the cloud-based management service <NUM> such that the cloud-based management service <NUM> may provide the authentication services <NUM> to the user <NUM>.

As shown in <FIG> and <FIG>, the apparatus <NUM> may include a processor <NUM> that may control operations of the apparatus <NUM>. The apparatus <NUM> may also include a memory <NUM> on which data that the processor <NUM> may access and/or may execute may be stored. The processor <NUM> may be a semiconductor-based microprocessor, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), and/or other hardware device. The memory <NUM>, which may also be termed a computer readable medium, may be, for example, a Random Access memory (RAM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a storage device, or the like. The memory <NUM> may be a non-transitory computer readable storage medium, where the term "non-transitory" does not encompass transitory propagating signals. In any regard, the memory <NUM> may have stored thereon machine-readable instructions that the processor <NUM> may execute.

Although the apparatus <NUM> is depicted as having a single processor <NUM>, it should be understood that the apparatus <NUM> may include additional processors and/or cores without departing from a scope of the apparatus <NUM>. In this regard, references to a single processor <NUM> as well as to a single memory <NUM> may be understood to additionally or alternatively pertain to multiple processors <NUM> and multiple memories <NUM>. In addition, or alternatively, the processor <NUM> and the memory <NUM> may be integrated into a single component, e.g., an integrated circuit on which both the processor <NUM> and the memory <NUM> may be provided. In addition, or alternatively, the operations described herein as being performed by the processor <NUM> may be distributed across multiple apparatuses <NUM> and/or multiple processors <NUM>.

As shown in <FIG>, the memory <NUM> may have stored thereon machine-readable instructions <NUM>-<NUM> that the processor <NUM> may execute. Although the instructions <NUM>-<NUM> are described herein as being stored on the memory <NUM> and may thus include a set of machine-readable instructions, the apparatus <NUM> may include hardware logic blocks that may perform functions similar to the instructions <NUM>-<NUM>. For instance, the processor <NUM> may include hardware components that may execute the instructions <NUM>-<NUM>. In other examples, the apparatus <NUM> may include a combination of instructions and hardware logic blocks to implement or execute functions corresponding to the instructions <NUM>-<NUM>. In any of these examples, the processor <NUM> may implement the hardware logic blocks and/or execute the instructions <NUM>-<NUM>. As discussed herein, the apparatus <NUM> may also include additional instructions and/or hardware logic blocks such that the processor <NUM> may execute operations in addition to or in place of those discussed above with respect to <FIG>.

The processor <NUM> may execute the instructions <NUM> to identify the applications <NUM> to which the on-premise access management service <NUM> is to provide authentication services <NUM> to the users <NUM>. For instance, an entity, such as an administrator or other individual of the organization that may own the on-premise access management service <NUM>, may instruct the processor <NUM> that access to the applications <NUM> is to be migrated from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. The entity may instruct the processor <NUM> through a portal, for instance, a portal provided by the apparatus <NUM>, which may be part of the cloud-based access management service <NUM>. In addition, the entity may provide the apparatus <NUM> with the identification of the applications <NUM> to which the on-premise access management service <NUM> is to or currently provides users with authentication services <NUM>.

The processor <NUM> may execute the instructions <NUM> to identify configuration information <NUM> to be used by the on-premise access management service <NUM> to provide authentication services <NUM> to applications <NUM> by users <NUM>. The processor <NUM> may identify the configuration information <NUM> from the identified applications <NUM>. For instance, the processor <NUM> may identify the configuration information <NUM> from information received from the cloud-based access management service <NUM>. In addition, the processor <NUM> may store the identified configuration information <NUM> in a data store <NUM>, which may be a Random Access memory (RAM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a storage device, or the like. The configuration information <NUM> may include endpoints that may provide access to single sign-on functionalities of the on-premise access management service <NUM>. For instance, the on-premise access management service <NUM> may be executed in a federation server of an active directory federation service. The endpoints may provide access to the functionalities of the federation server, such as token issuance and the publication of federation metadata. By way of example, the endpoints may be single sign-on uniform resource locators (URLs), certificates, etc..

The configuration information <NUM> may also include claims that may include statements about users <NUM>, e.g., identity information, to be used by the on-premise access management service <NUM> in authenticating the users <NUM>. For instance, the on-premise access management service <NUM> may issue a token that contains a set of claims, in which the decisions regarding which claims the on-premise access management service <NUM> may accept may be governed by claim rules. In other words, the configuration information <NUM> may include policies pertaining to the claims that the on-premise access management service <NUM> may accept. The configuration information <NUM> may also include an identification of the users who are allowed to access the applications <NUM>.

According to examples, the identified configuration information <NUM> may be configured for use by the on-premise access management service <NUM>. By way of particular example, the on-premise access management service <NUM> may have various policies and/or rules that the identified configuration information <NUM> may follow. In some instances, the configuration information <NUM> may not be compatible with the cloud-based access management service <NUM>. That is, for instance, the formatting of the configuration information <NUM> may not be compatible with the cloud-based access management service <NUM>, the cloud-based access management service <NUM> may not support some of the functionalities with the configuration information <NUM> that the on-premise access management service <NUM> may support, and/or the like.

The processor <NUM> may execute the instructions <NUM> to transform the identified configuration information <NUM> into a transformed set of configuration information <NUM> to be used by the cloud-based access management service <NUM> to provide authentication services <NUM> to the applications <NUM> by users <NUM>. Generally speaking, the processor <NUM> may transform the identified configuration information <NUM> such that the cloud-based access management service <NUM> may use the transformed set of configuration information <NUM> in providing the single sign-on services to the users.

For instance, the processor <NUM> may map the endpoints that may provide access to the functionalities of the on-premise access management service <NUM> to provide users <NUM> with single sign-on access to the applications <NUM> to endpoints that may provide access to the functionalities of the cloud-based access management service <NUM> to provide users <NUM> with single sign-on access to the applications <NUM>. By way of example, the processor <NUM> may map the single sign-on URLs used by the on-premise access management service <NUM> to provide the authentication services <NUM> to single sign-on URLs that the cloud-based access management service <NUM> may use to provide the authentication services <NUM>. In some examples, the processor <NUM> may access a database, a look up table, or other source of data that may include the mappings between the configuration information <NUM> and the transformed set of configuration information <NUM>.

The processor <NUM> may also map certificates used by the on-premise access management service <NUM> to certificates that the cloud-based access management service <NUM> may use to authenticate the users <NUM>. The processor <NUM> may further map claims mapping policies from the on-premise access management service <NUM> to the cloud-based access management service <NUM>.

The processor <NUM> may execute the instructions <NUM> to store the transformed set of configuration information <NUM> for use by the cloud-based access management service <NUM> to provide authentication services <NUM> to the applications <NUM> by users <NUM>. In some examples, the processor <NUM> may store the transformed set of configuration information <NUM> in the data store <NUM>. In other examples, such as when the apparatus <NUM> is not part of the cloud-based access management service <NUM>, the processor <NUM> may cause the transformed set of configuration information <NUM> to be stored at a data storage to which the cloud-based access management service <NUM> may have access.

In some examples, the processor <NUM> may execute the instructions <NUM> to receive an instruction to migrate authentication of the users <NUM> from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. For instance, the processor <NUM> may receive an instruction from an entity of the organization that owns the on-premise access management service <NUM> to stop authenticating users <NUM> on-premises and instead, to start authenticating the users <NUM> through the cloud-based access management service <NUM>. In addition, the processor <NUM> may execute the instructions <NUM> to migrate authentication of the users <NUM> from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. Following the migration of the authentication, when a user <NUM> attempts to execute a single sign-on action, the cloud-based access management service <NUM> may authenticate the user <NUM> instead of the on-premise access management service <NUM>.

In some examples, the processor <NUM> may execute the instructions <NUM> to determine priorities of the applications <NUM>. For instance, the processor <NUM> may determine metrics associated with the applications <NUM> and may determine the priorities from the metrics. The metrics may include, for instance, the names of the users, the identifiers of the users, the number of users of the applications <NUM>, the number of times users accessed the applications <NUM> over a period of time, the frequency at which users access the applications <NUM>, and/or the like. In some examples, the on-premise access management service <NUM> may track the metrics and the processor <NUM> may receive the tracked metrics from on-premise access management service <NUM>.

In some examples, the priorities of the applications <NUM> may be used to determine the order in which the applications <NUM> are to be migrated to the cloud-based access management service <NUM>. For instance, the applications <NUM> that are accessed with the lowest frequency may be determined to have the highest priority for migration such that errors present during the migration may have a minimal impact on the users <NUM>. In other examples, the applications <NUM> that have the largest number of users <NUM> and/or are accessed with the greatest frequency may be determined to have the highest priority. In any of these examples, the processor <NUM> may execute the instructions <NUM> to transform the identified configuration information <NUM> in an order according to the determined priorities of the applications <NUM> to which the configuration information <NUM> correspond.

According to examples, the processor <NUM> may execute the instructions <NUM> to perform configuration tests on the configuration information <NUM> of each of a plurality of the applications <NUM> to determine whether the applications <NUM> are ready to be migrated. For instance, the processor <NUM> may determine whether there are rules and/or settings in the on-premise access management service <NUM> that may be incompatible with rules and/or settings in the cloud-based access management service <NUM>. In some examples, the configuration tests may depend on rules and/or settings of the on-premise access management service <NUM> and the cloud-based access management service <NUM> and may thus vary depending upon the specific on-premise access management service <NUM> and the specific cloud-based access management service <NUM> to which the applications <NUM> are to be migrated.

The processor <NUM> may determine that an application <NUM> is ready to be migrated when there are no issues identified that may block the migration of the application <NUM>. Likewise, the processor <NUM> may determine that an application <NUM> is not ready to be migrated when an issue is identified that may block the migration of the application <NUM>. For the applications <NUM> that are determined to be ready to be migrated, the processor <NUM> may transform the configuration information <NUM> corresponding to those applications <NUM>. Additionally, for the applications that are determined to not be ready to be migrated, the processor <NUM> may output an indication that the rules and/or settings of the applications are to be reviewed and/or fixed. The processor <NUM> may also output transforms of the configuration information <NUM> that the processor <NUM> may have identified, even if the processor <NUM> does not recognize the transform.

The configuration tests may include a test to determine whether the applications <NUM> include a rule that may not be migratable to the cloud-based access management service <NUM>. In instances in which a rule is determined to not be migratable, a warning may be issued. As another example, the configuration tests may include a test to determine whether the on-premise access management service <NUM> includes an endpoint for an application <NUM> that is not supported by the cloud-based access management service <NUM>. The processor <NUM> may determine that an application with such an endpoint may not be ready to be migrated. As a further example, the configuration test may include a test to determine whether the on-premise access management service <NUM> includes a setting that specifies whether the application <NUM> is configured to only allow certain authentication types that the cloud-based access management service <NUM> may not include.

Additional settings may include whether an application is configured to ignore single sign-on cookies, whether an application is configured to auto update, whether an application has custom delegation authorization rules, whether an application has custom impersonation authorization rules defined, whether an application has custom issuance authorization rules defined, whether an application has custom issuance transform rules defined, whether the on-premise access management service <NUM> is configured to monitor a federation metadata for an application, and/or the like.

The processor <NUM> may execute the instructions <NUM> to determine whether configuration templates for the applications <NUM> have been generated. The configuration templates may include information that the processor <NUM> may use to create the applications <NUM> in the cloud-based access management service <NUM>. For instance, each of the applications <NUM> may have their own way to configure single sign-on and the templates may make it easier for the applications <NUM> to be created in the cloud-based access management service <NUM>. In addition, the processor <NUM> may execute the instructions <NUM> to, based on a determination that a configuration template for an application <NUM> has been generated, use the configuration template for the application <NUM> to migrate the application from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. However, based on a determination that a configuration template for the application <NUM> has not been generated, the processor <NUM> may generate a new configuration template based on information received from a user <NUM>.

Various manners in which the processor <NUM> of the apparatus <NUM> may operate are discussed in greater detail with respect to the methods <NUM> and <NUM> respectively depicted in <FIG> and <FIG>. Particularly, <FIG> and <FIG>, respectively, depict flow diagrams of methods <NUM>, <NUM> for transforming configuration information <NUM> of applications <NUM> into a transformed set of configuration information <NUM> that a cloud-based access management service <NUM> may use to provide authentication services <NUM> to the applications <NUM> by users such that authentication of users may be migrated to the cloud-based access management service <NUM>, in accordance with embodiments of the present disclosure. It should be understood that the method <NUM> may include additional operations and that some of the operations described therein may be removed and/or modified without departing from the scopes of the methods <NUM> and <NUM>. The descriptions of the methods <NUM> and <NUM> are made with reference to the features depicted in <FIG> and <FIG> for purposes of illustration.

At block <NUM>, the processor <NUM> may identify configuration information <NUM> that an on-premise access management service <NUM> is to use to provide authentication services <NUM> to applications <NUM> by users <NUM>. As discussed herein, the configuration information <NUM> may include endpoints and claims. As also discussed herein, the on-premise access management service <NUM> may be an organization specific system that may provide users <NUM> with single sign-on access to the applications <NUM>.

At block <NUM>, the processor <NUM> may transform the identified configuration information <NUM> into a transformed set of configuration information <NUM> that a cloud-based access management service <NUM> may use to provide authentication services <NUM> to the applications <NUM> by the users <NUM>. As discussed herein, the cloud-based access management service <NUM> may include a multi-tenant system that may provide users <NUM> in multiple organizations with respective single sign-on access to respective applications <NUM> via the network <NUM>, such as the Internet. For instance, a cloud services provider may provide the cloud-based management service <NUM> and the owner of the on-premise access management service <NUM> may be a tenant of the cloud services provider.

At block <NUM>, the processor <NUM> may store the transformed set of configuration information <NUM> for use by the cloud-based access management service <NUM> in providing authentication services <NUM> to the applications <NUM> by the users <NUM>.

With reference now to <FIG>, at block <NUM>, the processor <NUM> may identify the applications <NUM> to which the on-premise access management service <NUM> is to provide authentication services <NUM> to the users <NUM>. At block <NUM>, the processor <NUM> may identify configuration information <NUM> of the identified applications <NUM>. At block <NUM>, the processor <NUM> may determine metrics associated with the identified applications <NUM>. In addition, at block <NUM>, the processor <NUM> may determine priorities of the applications based on the determined metrics as discussed herein.

In some examples, the processor <NUM> may, at block <NUM>, determine, for each of a plurality of applications <NUM>, whether the configuration information <NUM> for the application <NUM> is ready to be migrated. As discussed herein, the processor <NUM> may perform configuration tests on the configuration information <NUM> of an application <NUM> to determine whether authentication of access to the application <NUM> is ready to be migrated. For the applications <NUM> that are determined to be ready to be migrated (e.g., applications for which authentication of access to the applications <NUM> or application identities are ready to be migrated), at block <NUM>, the processor <NUM> may transform the configuration information <NUM> corresponding to the applications <NUM> into transformed sets of configuration information <NUM>. According to the claims, the processor <NUM> transforms the configuration information <NUM> according to an order corresponding to the determined priorities of the applications <NUM> to which the configuration information <NUM> respectively correspond. In addition, at block <NUM>, the processor <NUM> may store the transformed set of configuration information <NUM> for use by the cloud-based access management service <NUM> in providing authentication services <NUM> to the applications <NUM> by the users <NUM>.

However, for the applications <NUM> that are determined to not be ready to be migrated (e.g., applications for which authentication of access to the applications or application identities are determined to not be ready to be migrated), the processor <NUM> may output an indication that the rules and/or settings of the applications <NUM> are to be reviewed and/or fixed. For instance, the processor <NUM> may output an indication that there is a rule and/or a setting in the on-premise access management service <NUM> that may be incompatible with the cloud-based access management service <NUM>. The indication may include the incompatible rule and/or setting such that a recipient of the indication may fix the incompatibility issue.

In some examples, the processor <NUM> may receive an instruction to migrate authentication of the users <NUM> from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. In addition, the processor <NUM> may cause the authentication of the users <NUM> to be migrated from the on-premise access management service <NUM> to the cloud-based access management service <NUM> based on receipt of the instruction.

In some examples, the processor <NUM> may, for each of the applications <NUM>, determine whether a configuration template for the application <NUM> has been generated. Based on a determination that a configuration template for the application <NUM> has been generated, the processor <NUM> may use the configuration template for the application <NUM> to migrate management of access to the application from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. However, based on a determination that a configuration template for the application <NUM> has not been generated, the processor <NUM> may generate a new configuration template based on information received from a user.

Some or all of the operations set forth in the methods <NUM> and <NUM> may be included as utilities, programs, or subprograms, in any desired computer accessible medium. In addition, the methods <NUM> and <NUM> may be embodied by computer programs, which may exist in a variety of forms both active and inactive. For example, they may exist as machine-readable instructions, including source code, object code, executable code or other formats. Any of the above may be embodied on a non-transitory computer readable storage medium.

Examples of non-transitory computer readable storage media include computer system RAM, ROM, EPROM, EEPROM, and magnetic or optical disks or tapes. It is therefore to be understood that any electronic device capable of executing the above-described functions may perform those functions enumerated above.

Turning now to <FIG>, there is shown a block diagram of a computer-readable medium <NUM> that may have stored thereon computer-readable instructions for migrating management of access to applications <NUM> by users <NUM> from an on-premise access management service <NUM> to a cloud-based access management service <NUM>, in accordance with an embodiment of the present disclosure. It should be understood that the computer-readable medium <NUM> depicted in <FIG> may include additional instructions and that some of the instructions described herein may be removed and/or modified without departing from the scope of the computer-readable medium <NUM> disclosed herein. The computer-readable medium <NUM> may be a non-transitory computer-readable medium, in which the term "non-transitory" does not encompass transitory propagating signals. The computer-readable medium <NUM> may have stored thereon computer-readable instructions <NUM>-<NUM> that a processor, such as a processor <NUM> of the apparatus <NUM> depicted in <FIG> and <FIG>, may execute. The computer-readable medium <NUM> may be an electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. The computer-readable medium <NUM> may be, for example, Random Access memory (RAM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a storage device, an optical disc, and the like.

The processor may fetch, decode, and execute the instructions <NUM> to identify applications <NUM> to which an on-premise access management service <NUM> may provide single sign-on authentication services to a plurality of users <NUM>. The processor may fetch, decode, and execute the instructions <NUM> to identify configuration information <NUM> that the on-premise access management service <NUM> may use to provide the plurality of users <NUM> with the single sign-on authentication services <NUM> to the applications <NUM>. The processor may fetch, decode, and execute the instructions <NUM> to transform the identified configuration information <NUM> into a transformed set of configuration information <NUM> that a cloud-based access management service <NUM> may use to provide the plurality of users <NUM> with single sign-on authentication services <NUM> to the applications <NUM>. The processor may also fetch, decode, and execute the instructions <NUM> to store the transformed set of configuration information <NUM> for use by the cloud-based access management service <NUM> in providing the plurality of users <NUM> with the single sign-on authentication services <NUM> to the applications <NUM>.

In some examples, the processor may fetch, decode, and execute the instructions <NUM> to receive an instruction to migrate authentication of the plurality of users <NUM> from the on-premise access management service <NUM> to the cloud-based access management service <NUM>. In addition, the processor may fetch, decode, and execute the instructions <NUM> to cause the authentication of the plurality of users <NUM> to be migrated from the on-premise access management service <NUM> to the cloud-based access management service <NUM> based on receipt of the instruction.

As discussed herein, and in some examples, the processor may determine metrics associated with the identified applications <NUM>, may determine priorities of the applications <NUM> based on the determined metrics, and may transform the identified configuration information <NUM> in an order according to the determined priorities of the applications <NUM> to which the configuration information <NUM> correspond. In addition, or alternatively, the processor may perform configuration tests on the configuration information <NUM> of the identified applications <NUM> to determine which of the application are ready to be migrated. For the applications <NUM> for which authentication of access to the applications <NUM> are determined to be ready to be migrated, the processor may transform the configuration information <NUM> corresponding to the applications. However, for the applications <NUM> for which authentication of access to the applications <NUM> are determined to not be ready to be migrated, the processor <NUM> may output an indication that the rules and/or settings are to be reviewed and/or fixed.

Claim 1:
An apparatus (<NUM>) comprising:
a processor (<NUM>); and
a memory (<NUM>) on which is stored machine-readable instructions that when executed by the processor, cause the processor to:
identify (<NUM>) configuration information (<NUM>) to be used by an on-premise access management service (<NUM>) to provide authentication services to applications (<NUM>) by users (<NUM>);
transform (<NUM>) the identified configuration information into a transformed set of configuration information (<NUM>) to be used by a cloud-based access management service (<NUM>) to provide authentication services to the applications (<NUM>) by users (<NUM>); and
store (<NUM>) the transformed set of configuration information (<NUM>) for use by the cloud-based access management service (<NUM>) to provide authentication services to the applications (<NUM>) by users (<NUM>) to migrate authentication of the users (<NUM>) from the on-premise access management service (<NUM>) to the cloud-based access management service,
wherein the instructions further cause the processor to:
identify (<NUM>) the applications (<NUM>) to which the on-premise access management service (<NUM>) is to provide authentication services to the users (<NUM>);
characterized in further causing the processor to:
determine metrics associated with the identified applications (<NUM>), wherein the metrics comprise a frequency at which users (<NUM>) access the applications (<NUM>); and
determine (<NUM>) priorities of the applications (<NUM>) based on the determined metrics,
wherein the transforming the identified configuration information into a transformed set of configuration information comprises transforming the identified configuration information in an order according to the determined priorities of the applications to which the configuration information correspond.