Abstract: Some embodiments control access by applications to resources in a computing environment. An embodiment notes a request from an application to access a resource, determines a compliance status of the application based on access control policy compliance criteria, ascertains an authorization status of the request based on an authorization credential of the request and an authorization requirement of the resource, and responds to the request based on the compliance status and also based on the authorization status, thereby providing fine-grained access control. Access may also be controlled based on a request's beneficiary. An access request response may allow access, deny access, or ask for additional authorization. A compliance classifier reduces risk by dynamically updating compliance status after compliance criteria changes or attribute changes. An identity service access control architecture uses a compliance attribute to improve efficiency.

Abstract: Disclosed herein is a system for enabling a default label to be configured for a network location created to store files. The default label can be assigned at a time when the files are uploaded to the network location. An owner of the network location can define the default label to be assigned to the files. Whenever an unlabeled file is uploaded to the network location, the unlabeled file automatically inherits the default label. Furthermore, the system is configured to consider an order of label priority when determining whether to assign a default label to a previously labeled file to be uploaded to the network location. The system is configured to upgrade a file with a preassigned label of lower priority to the default label, while permitting another file to be stored without a label change if the preassigned label is of higher priority compared to the default label.

Abstract: The techniques disclosed herein enable systems to manage remote file storage systems while bolstering information security through file encryption on download and permissions labels. To achieve this, a site owner configures permissions for a network site that stores files and that enables encryption on download. Various users with file access via the permissions may then interact with the site. When a user downloads a file from the site, they receive an encrypted copy that includes a permissions label that synchronizes with the network site permissions. When a user attempts to interact with an encrypted file the permissions label is used by the system to determine whether the user is authorized to access the file. In addition, permissions that are changed at the network site can be propagated to downloaded encrypted copies. In this way, permissions can be enforced for all site files even when copies leave the network site.

Abstract: Disclosed herein is a system for enabling a default label to be configured for a network location created to store files. The default label can be assigned at a time when the files are uploaded to the network location. An owner of the network location can define the default label to be assigned to the files. Whenever an unlabeled file is uploaded to the network location, the unlabeled file automatically inherits the default label. Furthermore, the system is configured to consider an order of label priority when determining whether to assign a default label to a previously labeled file to be uploaded to the network location. The system is configured to upgrade a file with a preassigned label of lower priority to the default label, while permitting another file to be stored without a label change if the preassigned label is of higher priority compared to the default label.

Abstract: Information technology use policies based on classification of groups, teams, and sites is provided. Example systems may enable information technology administrators to specify which policies may apply based on manual or automatic classification of groups, teams and sites. This may include the ability to specify associated membership, sharing, and access policies, data storage and sharing locations, retention policies for different types of content, and application of various information governance and protection options/requirements. Information technology administrators, who inherently understand the data and information management needs of organizations and members, may define a reasonable set of simplified classification options that information workers can use. Thus, information workers may no longer need to learn the details of data policies.