GLOSSARY
IAM glossary: identity and access management terms explained
Short answer
Short definitions of the terms used on this site, grouped alphabetically. Where a standard or a vendor defines a term, the source is linked. Each term shows which IAM job it belongs to.
A
Access request J2
A request for access that is routed to an approver and recorded, so the grant has an owner and a reason.
Access review J2
A periodic check in which a manager or application owner confirms that each person's access is still needed, and access that is not needed is removed. Also called a certification or attestation.
Account discovery J3
Finding the accounts that exist inside an application and matching them to people. Microsoft uses the name for an Entra feature that shows app users who do not match an Entra ID user.
Source: Microsoft Learn: governing existing users in an application · Read 27 Sep 2026
Active Directory (AD) J1
Microsoft's on-premises directory service, still common in large organizations and often synced to a cloud identity provider. Attacks on AD are a main focus of identity threat detection.
Adaptive MFA J1
Multi-factor authentication that asks for a second factor based on context such as device, network, location and behavior. Okta uses the name for its product.
Source: Okta Adaptive MFA · Read 27 Sep 2026
Application coverage J3
This site's name for the job of finding the applications and accounts that the identity provider and governance tool do not reach, and bringing them under control.
B
Birthright access J2
Access granted automatically from a person's role or attributes when they join, without a request. Veza describes birthright access in its lifecycle product.
Source: Veza Lifecycle Management · Read 27 Sep 2026
Break-glass account J4
An emergency account kept for when normal sign-in fails. It is privileged by design, so it should be vaulted, monitored and tested.
C
CAEP (Continuous Access Evaluation Profile) J5
An OpenID Foundation specification for sharing session events between tools, such as Session Revoked and Credential Change. Approved as Final on 2 September 2025.
Source: OpenID Foundation: Shared Signals Working Group · Read 27 Sep 2026
Certification campaign J2
A batch of access reviews run at one time, for example by manager or by application. SailPoint documents Manager, Source Owner and Search campaigns.
Source: SailPoint documentation: certifications · Read 27 Sep 2026
Conditional Access J1
Microsoft's policy engine for sign-in decisions, using signals such as user, location, device, application and risk. It needs Entra ID P1; risk-based policies need P2.
Source: Microsoft Learn: Conditional Access overview · Read 27 Sep 2026
D
Directory J1
The store of people, groups and attributes that other identity tools read as the source of who works in an organization.
Disconnected application J3
An application with no connector, SCIM endpoint or single sign-on link to the identity provider or governance tool, so its accounts are managed by hand or not at all.
E
Entitlement J2
A specific permission inside a system, such as a role, group or right. Governance tools review and grant entitlements, not only accounts.
I
Identity Dark Matter J3
Orchid Security's term, and a trademark of Orchid Security, for identity activity inside applications that sits outside central visibility.
Source: Orchid Security homepage · Read 27 Sep 2026
Identity orchestration J3
Coordinating identity data and actions across several tools, for example feeding accounts found in an application to the governance and privileged access tools that act on them. Ping's PingOne DaVinci uses the term for orchestrating sign-in journeys across identity tools.
Identity provider (IdP) J1
The service that authenticates people and tells applications who they are, usually through SAML or OpenID Connect.
IGA (identity governance and administration) J2
The tools and processes that decide who should have access, run access requests and reviews, and keep evidence.
ITDR (identity threat detection and response) J5
Detection of attacks on the identity layer, such as credential attacks, token theft and directory abuse, with a response such as an MFA challenge, a block or ending a session.
J
Joiner, mover, leaver (JML) J2
The three lifecycle events that change access: a person joins, moves to a new role, or leaves.
Just-in-time access J4
Access granted when a task needs it and removed when the task ends, so nobody holds standing rights they are not using. Apono describes just-in-time access to cloud resources.
Source: Apono homepage · Read 27 Sep 2026
K
Kerberoasting J5
An attack on Active Directory that requests Kerberos service tickets and cracks them offline to recover service account passwords. Silverfort lists it among the attacks it detects.
Source: Silverfort: identity threat detection and response · Read 29 Sep 2026
L
Least privilege J4
Giving users only the access they need to do their tasks. NIST's glossary defines the term.
Source: NIST glossary: least privilege · Read 27 Sep 2026
Local account J3
An account created and stored inside an application rather than in the identity provider, so disabling a person in the directory does not touch it.
M
MFA (multi-factor authentication) J1
Sign-in that needs two or more kinds of evidence, such as a password and a device. Phishing-resistant methods include passkeys and FIDO2 security keys.
Source: Microsoft Learn: Entra authentication methods · Read 27 Sep 2026
N
Non-human identity (NHI) J4
An identity used by software rather than a person: service accounts, API keys, tokens, workloads and AI agents. OWASP publishes a Top 10 of NHI risks.
Source: OWASP Non-Human Identities Top 10 · Read 29 Sep 2026
O
OpenID Connect (OIDC) J1
A sign-in protocol built on OAuth 2.0 that lets an application trust an identity provider, common in newer and mobile applications.
Orphaned account J3
An active account with no current owner, often left behind after someone leaves or changes role. Orchid Security publishes a report on orphan and local accounts.
Source: Orchid Security report: orphan and local accounts · Read 27 Sep 2026
P
PAM (privileged access management) J4
The tools and processes that control admin and other high-risk access: inventory, just-in-time grants, vaulting, rotation and session control.
Pass-the-Hash J5
An attack that reuses a captured password hash to authenticate without knowing the password. Silverfort lists it among the attacks it detects.
Source: Silverfort: identity threat detection and response · Read 29 Sep 2026
Passkey J1
A phishing-resistant credential based on public-key cryptography, stored on a device or synced between devices, that replaces a password.
Source: Microsoft Learn: Entra authentication methods · Read 27 Sep 2026
Privileged account J4
An account with rights beyond those of an ordinary user, such as an administrator. NIST's glossary defines the term.
Source: NIST glossary: privileged account · Read 27 Sep 2026
R
RISC (Risk Incident Sharing and Coordination) J5
An OpenID Foundation specification for sharing account events between tools, such as Account Disabled and Identifier Changed. Approved as Final on 2 September 2025.
Source: OpenID Foundation: Shared Signals Working Group · Read 27 Sep 2026
S
SAML J1
An XML-based sign-in protocol that lets an application trust an identity provider, common in older enterprise applications.
SCIM J2
The System for Cross-domain Identity Management: a standard for creating, updating and removing accounts in applications. RFC 7644 defines the protocol.
Source: RFC 7644: SCIM Protocol · Read 27 Sep 2026
Secrets management J4
Storing, issuing and rotating the passwords, keys and tokens that machines and applications use. CyberArk describes secrets management as SaaS or self-hosted.
Source: CyberArk Secrets Management · Read 29 Sep 2026
Service account J4
An account used by an application or script rather than a person. Service accounts are often privileged and often outlive their creators.
Shadow IT J3
Applications people use without the IT team's knowledge, often signed up for with a work email. C1 and Lumos describe detecting shadow apps.
Source: C1: shadow IT · Read 27 Sep 2026
Shared Signals Framework (SSF) J5
The OpenID Foundation's framework for tools to send each other security events, used by CAEP and RISC.
Source: OpenID Foundation: Shared Signals Working Group · Read 27 Sep 2026
Single sign-on (SSO) J1
Signing in once to reach many applications, which trust the identity provider instead of keeping their own passwords.
U
Universal Logout J5
Okta's name for signing a user out of every connected application at once when risk is detected.
Source: Okta Identity Threat Protection · Read 27 Sep 2026
Z
Zero trust General
NIST SP 800-207: "Zero trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources."
Source: NIST SP 800-207 Zero Trust Architecture · Read 29 Sep 2026