Microsoft patents access checks that verify both user and app identity
Microsoft describes a system that checks if a user is allowed to access a private file or service by looking at more than just their login. It also verifies the specific app running on the device, the device itself, and where it is located before granting permission. This multi-step check helps ensure that only the right person using the right program can access sensitive data.
In the filing’s own words
Methods, systems and computer program products are provided for granular secure user access to private resources. Increased granularity of security policies for user access may reduce security threats to resources. Security policies indicating user access to secure resources may be based on various combinations of user identities, client-side process (e.g., sub-process) identities, device identities, device types, device locations, resource access types, intelligent access (e.g., selective traffic routing), etc. For example, a security policy may indicate user A, using computing device B executing process C with process signature S (e.g., a signing signature thumbprint, etc.) may access private resource D. A process identity may be indicated by at least one of a process name, a code signing signature, a thumbprint, a process version, or a process publisher. Resource access security policy determinations and/or enforcement may be performed by security clients and/or security engines (e.g., SASE providing ZTNA).
What exactly they claim (claim 1)
1. A client computing device associated with a first identity, the client computing device comprising: a processor; and a memory comprising programming instructions structured to cause the processor to: execute a process with a second identity, execute a security client, utilize the security client to make a first access determination based on the first identity and the second identity satisfying a first security policy, utilize the security client to provide the first identity and the second identity to a server that enforces a second security policy, the second security policy specifying whether a combination of the first identity and the second identity is authorized to access a resource, and receive, from the server, a second access determination of whether the first identity and the second identity authorizes the client computing device to access the resource.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- GRANULAR SECURE USER ACCESS TO PRIVATE RESOURCES
- Publication number
- US20260261561A1
- Application number
- 19653817
- Filed
- Apr 21, 2026
- Published
- Sep 3, 2026
- Inventors
- 6
- Claims
- 20
Classified under
H04L 63/102 Electricity & electronicsH04L 63/08 Electricity & electronicsH04L 63/20 Electricity & electronicsMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.