US Patent 11063930 Resource access provisioning for on-premises network client devices

A managed directory service receives, from a computer system operated in a first network, a request to obtain a set of credentials usable to access resources in a second network. In response to the request, the managed directory service determines, based at least in part on a first set of permissions in a directory maintained in the second network, that the computer system is authorized to receive the set of credentials. The managed directory service provides the set of credentials to the computer system, which enables use of the set of credentials to identify a second set of permissions for accessing resources in the second network.