Microsoft patents account switch to bypass service restrictions

1. A method for access management in a network-based service, the method comprising: identifying, at a server of the network-based service, an action involving a first account used by a user to access resources; determining, at the server of the network-based service, that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response: identifying, at the server of the network-based service, an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account; determining, at the server of the network-based service, according to the account policy, that the second account referenced in the identity data structure allows for taking the action; sending, at the server of the network-based service, a transmission to a device of the user via the first account of the user, the transmission identifying the second account; receiving, at the device of the user, the transmission; selecting, at the device of the user, an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account; transmitting, at the device of the user, the access token to the server of the network-based service; receiving, at the server of the network-based service, the access token from the device of the user; and responsive to the server of the network-based service validating that the access token received from the device of the user is valid and allows the action, the server causing performance of the action involving the user.