Dynamic service access

Apparatus, systems, and methods may operate to authenticate a desktop client to an identity service (IS) (326), to receive a request (344), from an application (356), at the IS via the desktop client for a virtual service internet protocol (IP) address associated with a service (332). The IS may operate to build a routing token (340) that includes an original physical IP address associated with the service when a policy (338) associated with the IS permits access to the service by a user identity (346) associated with the desktop client. After the routing token is validated, the application may be connected to the service via the desktop client. The application may comprise an e-mail application or a remote control application, such as a virtual network computing (VNC) application. Additional apparatus, systems, and methods are disclosed.