Microsoft patents system that scores app security risks from manifest files
Microsoft describes a security tool that reads an application's manifest file, which lists its permissions and settings. It checks these details against specific security rules to calculate a risk score and generate a report for IT teams.
In the filing’s own words
Methods, systems, and computer storage media for providing manifest-based app risk evaluation using a manifest-based app risk evaluation engine of a security management system are described. Manifest-based app risk evaluation refers to the process of analyzing an application's manifest file to assess security risks by examining manifest-based security factors of the application and assigning a risk score to guide deployment decisions. The manifest-based app risk evaluation engine enables manifest ingestion and validation, security analysis and risk scoring, and classification with reporting. In operation, a manifest associated with an application is accessed. The manifest is analyzed based on a plurality of manifest-based app risk evaluation rules. A risk score is generated for the manifest based on a plurality of manifest-based security factors that correspond to the plurality of manifest-based app risk evaluation rules. A risk report associated with the application is generated. The risk report is then communicated to a client.
What exactly they claim (claim 1)
1. A computerized system comprising: one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations comprising: accessing a manifest associated with an application; analyzing the manifest based on manifest-based app risk evaluation rules, wherein a manifest-based app risk evaluation rule is a security policy that supports evaluating a risk level of applications based on corresponding manifests; based on analyzing the manifest, generating a risk score for the manifest based on manifest-based security factors that correspond to the manifest-based app risk evaluation rules; based on generating the risk score, generating a risk report associated with the application; and communicating the risk report to a client.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- MANIFEST-BASED APP RISK EVALUATION ENGINE IN A SECURITY MANAGEMENT SYSTEM
- Publication number
- US20260281141A1
- Application number
- 19081979
- Filed
- Mar 17, 2025
- Published
- Sep 17, 2026
- Inventors
- 2
- Claims
- 20
Classified under
H04L 63/1433 Electricity & electronicsG06F 21/577 Physics & computingH04L 63/20 Electricity & electronicsG06F 2221/033 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.