Getting the fundamentals right starts with clear definitions and a shared vocabulary. So we've put together this IAM glossary for your reference* — written in plain language that business users can follow.
Don’t see what you are looking for? Let us know.
Access certification
Review of a user's current authorizations—their accounts and permission assignments—to confirm that continued access is warranted. The activity has two objectives: 1) to find and correct access that is excessive or no longer needed, and 2) to hold management accountable for knowing how access is distributed and used within their organization. Reviews may be directed to line managers, business leads, resource owners, or application owners. They may run as part of a larger certification campaign on a recurring schedule, or be triggered by a specific identity lifecycle event such as an organizational transfer. Also known as "access reviews" or "re-certifications."
Access eligibility requirements
Minimum criteria for determining whether a user may hold a given privilege or permission assignment. Eligibility requirements may include: 1) an organizational component ("the user is a member of the HR team"), 2) a functional component ("the user's job title is analyst"), 3) a competency component ("the user has completed annual training"), or 4) a dependency on other subject attributes ("the user has obtained FOMC clearance").
Access management
Processes for managing the permissions, entitlements, and policies that govern access to business resources. This covers the discovery and definition of permissions and entitlements, the bundling of access into roles or policies, administration-time authorizations, the rules governing how access is assigned to users and groups, and the runtime controls that grant or restrict access to resources.
Access model
Description of how access is represented and implemented within an application or system. An access model includes: 1) a data model for permissions, entitlements, or policies, 2) a map showing where access data comes from, where it is stored, and how it is used or interpreted when making authorization decisions, and 3) a management model describing how access is administered. A complete model also accounts for specifics such as local or direct assignments, permission inheritance, and externalized access information—for example, security groups managed in a central LDAP.
Access requests
Request and authorization processes made up of: 1) user interfaces for requesting access, and 2) the workflows behind them for collecting approvals and fulfilling requests. Requests may be initiated by any user through a self-service interface, or submitted on someone else's behalf by an authorized delegate, line manager, or IAM administrator.
Account correlation
Process of matching an account to a user and establishing a lasting link between the user's identity record and that account. Correlation typically relies on predefined matching ("correlation") rules—for example: correlate an account to a user when that user's employee ID matches the "emplID" on the account.
Account discovery
Automated activity of finding, recording, and making sense of application or system accounts. Results are typically captured in an account inventory that itemizes each discovered account along with its descriptive data. The primary objective is visibility into every account—not just those already "known" or declared—so that controls and governance can be applied to their use and administration. See also "account reconciliation."
Account inventory
Itemized list of accounts and their descriptive data, including account types, intended uses, ownership, eligibility requirements, and other characteristics that determine how each account should be controlled—for example, a flag indicating a SOX-covered account.
Account reconciliation
Process of comparing the state of identities, resources, and permissions as recorded in a central ledger against their actual state in the monitored environment. Discrepancies lead to updates in the ledger or to corrective action. Reconciliation may serve as a detective control, a corrective control, or both. See also "rogue account detection," "orphan account detection," "stale account detection," and "permission drift control."
API gateway
Software-based infrastructure that sits between clients and backend services, receiving API requests and returning responses in order to apply business logic and security measures such as message routing, throttling, API orchestration, and security proxying. Advanced gateway vendors may also support modern API standards like OAuth, SAML, and OpenID Connect, and complement the gateway with API lifecycle management products such as a developer portal.
Application onboarding
Operational activity of aligning an individual application to one or more IAM controls. It typically involves: 1) engagement with the application team, 2) an initial analysis period to understand existing controls, constraints, and access models, 3) an implementation period to integrate with or replace existing controls using common IAM services, and 4) ongoing change management to accommodate updates to the IAM platform or the application's security model.
Approval workflow management
Processes for defining and maintaining the components of an approval workflow: routing logic, notification rules, escalation paths, delegation of work items, and workflow expiration. It also overlaps with application onboarding, since some situations call for additional levels of review or approval—covered systems, privileged access, or access to sensitive data, for example.
Assessment
Inspection or analysis performed to verify a business's readiness to adopt IAM controls, or to identify deficiencies in existing controls that require remediation.
Attribute-based access control
Method of granting or denying access based on a user's identity attributes. The intent is to tie access to user characteristics such as organizational assignment, job title or job level, employee versus contingent worker status, region or location, certifications acquired, training completed, and management versus individual contributor status.
Audit logging
End-to-end logging that makes user activity traceable and maintains an authorization audit trail—who approved what, and when.
Authentication
Automated process of collecting and verifying a user's credentials to confirm their presence at the point of access. Different levels of assurance are possible depending on the strength of the verification method—sometimes called an "authenticator"—or on the use of several authenticators together, as in multi-factor authentication. Common authenticators include usernames and passwords, tokens, certificates, and biometrics.
Authorization
Process of allowing or denying an authenticated user's access request in real time. Authorization decisions may draw on: 1) permissions ("read/write permissions on a file"), 2) entitlements ("members of the administrators group may perform administrative functions"), or 3) policies ("employees can access internal network resources"). See also "attribute-based access control" and "role-based access control."
Awareness
Activities designed to build end-user understanding of IAM concepts, service offerings, and compliance obligations. Awareness work often includes training and marketing elements—such as change communications introducing a new IAM service offering—and is frequently folded into broader cybersecurity awareness campaigns.
Business adoption
Activities for enrolling business areas and their constituencies into new or existing IAM service offerings. When an initiative addresses a known deficiency, participation may become mandatory.
Business resource
Unit of management representing an asset with business value that requires access controls. Examples include a file share, a SharePoint site, an application, or a database.
Business resource discovery
Automated activity of finding, recording, and making sense of business resources within a defined boundary or scope of control. Automation implies the ability to perform deep discovery by navigating complex structures—for example, traversing a nested or hierarchical structure recursively.
Business rules
Business logic used in policies and throughout the IAM stack to match users to resources. This includes rules for generating unique identifiers, correlation rules for matching accounts to users, assignment rules for matching users to roles (or roles to permissions), rules that determine a user's access qualifications or eligibility, Segregation of Duties rules for identifying toxic combinations, and scoping rules for selecting populations of users, permissions, or resources.
Capability
A collection of the IAM skills, qualifications, and activities that, combined with other IAM capabilities, make up the overall IAM discipline. A capability provides the means to achieve specific business outcomes in service of top-level IAM objectives.
Compliance reporting
Measurements and outcomes used to demonstrate compliance with IAM control requirements, including risk reporting, performance monitoring, and trend analysis.
Control framework
Collection of definitions, vocabularies, measurements, models, and architectures related to IAM controls. A control framework provides a common point of reference for understanding and implementing controls, and for measuring how well they work.
Credential management
Processes for securely creating, maintaining, and distributing credentials of various types, used to identify and authenticate end users.
Credential vault
Strongly protected hardware or software structure used to store and safeguard credentials—for example, passwords held in a password vault. Vaults are often reserved for shared access to sensitive or privileged accounts, such as "firecall" or "breakglass" accounts, and may require a checkout process so that every use is: 1) always logged, and 2) authorized for one user at a time. Some vaults can also rotate a credential between uses—a password vault may be configured to change a password each time it is checked back in.
Cross-domain identity management
Variation of identity management in which identity data is transmitted from one environment or domain to another after a trust relationship has been established between them. SCIM (System for Cross-domain Identity Management) is a standard defining the semantics, data structures, and REST API for implementing it.
Directory services
Services that centralize user and group information into a single, unified view. Built primarily for fast lookups, directories can serve several roles—as a credential or entitlement store, or as an identity provider.
Enrollment
Process of collecting identity information from a new user and recording it in a central registry. Enrollment typically involves declaring a unique identifier, such as a username or email address, along with a corresponding credential (most often a password). See also "identity proofing."
Entitlement server
Repository of system and application entitlement data, along with the interfaces for maintaining that data and publishing it for downstream use—for example, when making runtime access control decisions.
Exception management
Processes for identifying and tracking IAM policy exceptions through their lifecycle. This includes taking a risk-based approach to exception approvals and oversight, and keeping exceptions aligned with formally defined risk tolerances.
Excessive access
Condition in which a single permission or entitlement carries greater privileges than intended, violating the principle of least privilege. Over-permissioning can occur when an Active Directory group is configured for multiple uses—as an email distribution list, as a security group, and in place of a business role—leaving existing members with more access than was originally intended.
Federation
Framework for establishing trust between multiple parties in order to simplify cross-domain communication. Federation relies on an up-front exchange of information covering: 1) how to verify the sender of a message, which establishes trust, 2) how exchanged messages are encrypted and decrypted, 3) the kinds of claims made about the subject ("facts about the user"), and 4) how to interpret those claims for authentication and authorization purposes ("what the user is allowed to do").
Fulfillment workflow management
Processes for defining and maintaining the components of a request fulfillment workflow: manual or automated provisioning steps, dependency resolution, error handling, notification rules, escalation paths, delegation of work items, and workflow expiration. Where provisioning is handled manually or in an otherwise asynchronous manner, additional steps may be needed to close the loop on work items that have been completed.
Governance
Organizational practices and guidelines that ensure every IAM business process carries an appropriate level of oversight.
Host-based access control
Access to system or application resources that requires the end user to log in to a host, or machine, first. Host-based access is inherently complicated by the one-off nature of its permissioning model, which is tied to individual machines and machine resources. It grows more complex when multiple tiers of permissioning are involved—for example, when access depends on a particular blend of host- and application-level entitlements.
Identity analytics
Meaningful information derived from the analysis of identity and access data that can be used to inform an authorization decision. Examples include calculating the probability that users with similar characteristics hold like entitlements, or using historical data about dormant accounts and permissions to predict revocation decisions during access certification.
Identity and access management
Security discipline covering aspects of both identity management and access management. It includes: 1) processes for enrolling and maintaining user identities throughout their lifecycle, and 2) managing the permissions, entitlements, and policies that govern access to business resources. See also "identity management" and "access management."
Identity attributes
Distinguishing traits or characteristics that uniquely identify a user or identity. Common identity attributes include name, location, email address, organizational assignment, job title, and manager.
Identity data services
Services that aggregate and publish identity data for use by authorized clients. These services were traditionally offered through an Enterprise Service Bus (ESB), though that integration method is gradually giving way to REST APIs.
Identity lifecycle management
Processes for adjusting a user's identity and access as their circumstances change. These adjustments are most often triggered by HR events such as onboarding a new hire, completing a transfer, or processing a termination. Sometimes called "joiner, mover, leaver" processes.
Identity management
Processes for enrolling and maintaining user identities throughout their lifecycle in service of both security and business enablement objectives. This includes provisioning and maintaining the downstream accounts linked to those identities and the access attached to them.
Identity proofing
Process of verifying the authenticity of the data a user declares during registration. Its primary purpose is to establish that the user is who they claim to be. Different levels of assurance are possible depending on the methods used to verify those claims. See also "identity registration."
Identity registration
Process of collecting identity information from a new user for enrollment purposes and recording it in a central registry. Registration typically involves declaring a unique identifier, such as a username or email address, along with a corresponding credential (most often a password). See also "identity proofing."
Just-in-time provisioning
Variation on the more common practice of provisioning access at administration time. Just-in-time (JIT) provisioning happens at runtime, immediately before the access is first used. JIT provisioning is common in cross-domain identity management, where it is used to assert a new identity between two trusted domains for the first time.
Last use date
Date of the most recent account login or permission use. This data point is useful for measuring frequency of use, identifying inactivity, and implementing preventive controls—for example, disabling privileged accounts that have been inactive for more than 90 days. Last use date is often included in certifications to enrich permission data, better inform access review decisions, and flag possible stale or excessive access.
Multi-factor authentication (MFA)
Method of achieving higher levels of authentication assurance by requiring additional authenticators, or multiple "factors"—typically something you know, like a password, plus something you have, like a physical token or device. When exactly two factors are used, MFA is sometimes referred to as "2FA" for two-factor authentication.
OAuth
Modern, open standard defining the semantics and data structures for delegating access, so that an application or other client can access an end user's information on their behalf. OAuth defines several "grant types" for flexibility—accommodating browser-less client technologies, for example—while making a best attempt to keep the end user's password private.
Omni-channel access
Ability to reach backend data and services through multiple delivery channels, in some cases by invoking APIs or web services. Omni-channel access usually refers to digital, customer-facing use cases rather than typical enterprise scenarios.
One-time password
Randomly generated initial password intended to be used just once, during first login. A one-time password typically expires on use, forcing a password reset.
Operations
Ongoing activities and procedures required to keep IAM functions running. Examples include fulfilling access requests that need manual intervention, running access certification campaigns, reporting IAM program metrics, reviewing incidents and findings for remediation and follow-up, onboarding new applications to IAM controls, and fielding requests related to other IAM services.
Orphan account
System or application account that cannot be matched to a user, or that is missing a link to an identity record. Orphan accounts are a problem because activity on them cannot be traced to a human user. Accounts become orphaned when a user leaves or transfers out of an organization, or when a user gives up ownership of a secondary or service account before it can be reassigned.
Orphan account detection
Process for detecting orphan accounts, most often as part of a parent process such as account reconciliation. Orphan accounts are commonly flagged for additional review or reassigned temporarily to an IAM delegate or administrator.
Overexposure
Condition in which a single permission or entitlement is assigned to an excessively large user population, violating the principle of least privilege. This can happen when a permission is assigned to a group inside a deeply nested or hierarchical structure, making the full membership hard to determine. In extreme cases, the resource effectively becomes open to all users.
Password manager
Strongly protected software structure used to store and safeguard passwords. Unlike a credential vault, a password manager is generally intended for personal use. Most are installed locally on a user's desktop or mobile device and can pre-fill passwords in forms through browser plugins or components embedded in apps or the device OS.
Password policy
Rules for constructing strong passwords and ensuring their safe use. A password policy gives direction to: 1) end users creating sufficiently complex passwords, and 2) application and system configurators responsible for upkeep—expiring passwords that have exceeded their longevity, for instance.
Password self-service
Self-service interfaces that let end users manage their own passwords. These can support reset flows involving multiple challenges to the user, or the use of emailed links containing a unique secret.
Performance indicators
Measurements designed to evaluate how well individual IAM controls—or an IAM program as a whole—are performing. Indicators should be quantifiable so they show progress against a desired outcome, for example, "# of production applications onboarded to a centralized authentication service."
Permission catalog
Central, searchable listing of permissions and their descriptive data, written for business users. Catalogs are most commonly used within an IDMS to support access requests. Permission data may be maintained in the IDMS itself or sourced from other systems of record.
Permission collection
Automated activity of gathering, recording, and making sense of the permissions on business resources and their descriptive data. It may or may not include information about which permissions are mapped to which users. Collection may run directly against a business resource or target system, or draw from an external entitlement store such as a directory or database.
Permission drift control
Process for detecting changes to permission assignments made out of band, bypassing the standard provisioning process—for example, when a permission is changed outside the IDMS. Assignments altered this way may end up being revoked or flagged for investigation.
Platform
Collection of common services and components shared across multiple, distinct applications. A platform may act as a single control provider across its application ecosystem, and the applications it hosts may share aspects of a common access model.
Platform onboarding
Operational activity of aligning a platform to one or more IAM controls. Efficiencies may allow several platform-based applications to be onboarded together—for example, when access is administered and controlled at the platform level, or when platform controls substitute for one or more application controls. See also "platform."
Policy
Requirements that together define users' obligations in service of an organization's control objectives. Policies typically have regulatory components.
Privileged access management
Variation of access management dealing with accounts and permissions that carry elevated privileges. The threshold for what counts as "elevated" or "privileged" varies from organization to organization, but it most commonly means access that lets an end user administer security, deploy code, or configure an application.
Reference architectures
Reference-level design artifacts—conceptual, logical, and functional architectures—that guide architects and designers implementing IAM controls in their own systems and applications. Reference architectures describe how a control should work across its various configurations, and are especially useful when teams are looking for pattern guidance.
Resource management
Processes for declaring or discovering business resources and keeping their resource definitions current. Depending on the type of resource, these processes may overlap with application or platform onboarding. See also "business resource discovery," "application onboarding," and "platform onboarding."
Risk indicators
Measurements designed to identify the presence or escalation of one or more risk factors. Indicators may be mapped to risk tolerances that define acceptable levels of risk.
Rogue account
System or application account created by circumventing the standard provisioning process, possibly for illegitimate or nefarious use. Sometimes referred to as an "out-of-band" account.
Rogue account detection
Process for detecting rogue accounts, most often as part of a parent process such as account reconciliation. Rogue accounts are commonly disabled on discovery and flagged for investigation.
Role engineering
Operational activity of mapping roles to permissions or entitlements and assigning them to users and groups. Role engineering may be done top-down, based on an understanding of business needs; bottom-up, using mined data; or through a hybrid of the two.
Role-based access control
Method of granting or denying access based on a user's role assignments. It involves: 1) bundling access entitlements into one or more roles that make business sense, and 2) assigning those roles to users or groups, administratively or automatically, based on business need—for example, assigning a business role to an employee who needs it to perform a particular job function or set of responsibilities, duties, or tasks.
Rules declaration
Activity of defining and maintaining the business rules used in policies and throughout the IAM stack to match users to resources. See "business rules" for the full range of rule types.
SAML
SAML (Security Assertion Markup Language) is an open standard defining the semantics, data structures, and verification methods for exchanging security information between two parties in service of access control goals such as federation and cross-domain communication. See also "Federation."
Secondary account
Account with a specialized purpose distinct from the holder's primary account—used for testing, or for audit or maintenance work, for example. Secondary accounts are sometimes shared by multiple users or across a team, in which case they are referred to as "shared accounts."
Secondary account management
Processes for administering secondary accounts. This includes maintaining an accurate inventory of every secondary account, complete with information about account types, ownership, sharing, and delegation.
Segregation of duties (SoD)
Measures that divide sensitive duties or tasks among more than one person—and never the same person—so those activities carry proper oversight and so privilege abuse and errors are prevented. For example, whoever submits an invoice should not be able to approve it.
Service account
Account assigned to a non-human user for the purpose of establishing service-to-service communication.
Service account management
Processes for administering service accounts, including account inventorying, credential management, identification of privileged access, and tracking ownership and delegation—alongside the standard account lifecycle management activities.
Service offering development
Activities for operationalizing new or modified IAM capabilities and bundling them into service offerings the business can consume. This includes cataloging available services, designing an engagement and intake process for initiating work, and communicating SLAs to customers.
Session
Period of time during which a user is active on an application, system, or network. A session begins when someone identifies themselves; authentication is sometimes required at that point. A unique identifier is assigned to the session for tracking purposes and to link session activity back to the user. Tasks performed within the session may require further authorization, as policy dictates. The session ends when the user closes it—by logging out of a system or application, for example—or when it times out.
Session cookie
Browser cookie issued by a web application, service, or external identity provider to track session activity.
Session management
Technical capability to maintain state and contextual information about user activity throughout a single session. See also "session" and "session cookie."
Single sign-on (SSO)
Method of permitting access to multiple applications without requiring the user to enter their credentials more than once. SSO is most commonly used with browser-based web applications, though solutions exist for mobile apps as well and are seeing adoption in enterprise settings.
Stale account
System or application account that has gone unused over a period of time. Stale accounts can point to problems such as over-permissioning, excessive access, or the presence of orphaned accounts. Note that some accounts are used infrequently by design—"breakglass" accounts, for instance, should only be accessed during emergencies.
Stale account detection
Process for detecting stale or inactive accounts using an account's last use date. Stale accounts are commonly flagged for additional review. Accounts that can reach sensitive data or hold elevated privileges may also be temporarily disabled.
Standard
Methods for satisfying the control requirements defined in policy. A standard serves as the point of reference for measuring policy compliance.
Strong authentication
Dynamic determination of how much assurance is needed to authenticate a user, based on a calculated risk score and a set of contextual inputs such as time of day, request type, geolocation, incoming IP address, and device DNA. An elevated risk score may prompt the user for additional authentication factors. Also known as "risk-based authentication" or "step-up authentication."
Toxic combinations
Combinations of permissions or entitlements that a single user is not allowed to hold at once, most often because the combination represents a Segregation of Duties violation or a potential conflict of interest. See also "Segregation of duties."
User Provisioning
Activity of creating or updating a system or application account assigned to an end user. Provisioning may be performed manually or administratively, or automated where the necessary mechanisms are in place. Sometimes called "access fulfillment."
Web access management
Technologies and services that provide access controls for web-based applications, including authentication, authorization, and the management interfaces used to define access policies and connect to user and policy stores. Web access management is often bundled with single sign-on and session management functionality.