--- title: "Identity & Access Management Glossary — IAM, SSO, MFA, SCIM, IGA, PAM | IDSync" description: "Vendor-neutral definitions for identity, access, and authentication terms — SSO, SAML, OIDC, OAuth, SCIM, MFA, passkeys, IGA, PAM, CIAM, AI agent identity and more." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" } ] }, { "@context": "https://schema.org", "@type": "DefinedTermSet", "name": "IDSync Identity & Access Management Glossary", "description": "Vendor-neutral definitions for identity, access, and authentication terms — SSO, SAML, OIDC, OAuth, SCIM, MFA, passkeys, IGA, PAM, CIAM, AI agent identity and more.", "url": "https://idsync.com/glossary", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "Access Review", "alternateName": [ "access certification", "user access review", "UAR" ], "description": "An access review is a periodic check where managers or system owners confirm that each user's current access is still appropriate — typically required by SOX, SOC 2, ISO 27001, and HIPAA.", "url": "https://idsync.com/glossary/access-review" }, { "@type": "DefinedTerm", "name": "Access Token", "alternateName": [ "Access Token", "Bearer Token" ], "description": "An access token is a short-lived credential issued by an OAuth 2.0 authorization server that a client presents to a resource server (API) to prove it has been authorized to act on behalf of a user or workload, within a specific scope.", "url": "https://idsync.com/glossary/access-token" }, { "@type": "DefinedTerm", "name": "Active Directory", "alternateName": [ "AD", "AD", "AD DS", "Microsoft Active Directory" ], "description": "Active Directory (AD) is Microsoft's on-premises directory service — a combination of LDAP, Kerberos, and DNS — that has authenticated and authorized users, computers, groups, and policies inside Windows networks for 25+ years and remains the identity backbone of most enterprises.", "url": "https://idsync.com/glossary/active-directory" }, { "@type": "DefinedTerm", "name": "AI Agent Identity", "alternateName": [ "Agent identity", "Autonomous agent identity" ], "description": "AI agent identity is the practice of giving autonomous AI agents, copilots, and bots their own first-class identities — with scoped credentials, delegated authority, audit trails, and lifecycle controls — instead of letting them impersonate users with broad permissions.", "url": "https://idsync.com/glossary/ai-agent-identity" }, { "@type": "DefinedTerm", "name": "API Key", "alternateName": [ "API token" ], "description": "An API key is a long, opaque string an application sends with each request to authenticate to an API — simple to implement but weak compared to OAuth, mTLS, or workload identity for high-value APIs.", "url": "https://idsync.com/glossary/api-key" }, { "@type": "DefinedTerm", "name": "Attribute-Based Access Control", "alternateName": [ "ABAC", "ABAC", "Policy-Based Access Control", "PBAC" ], "description": "Attribute-Based Access Control (ABAC) decides whether a user can take an action by evaluating attributes of the user, the resource, the action, and the environment against a policy — instead of relying solely on group or role membership.", "url": "https://idsync.com/glossary/attribute-based-access-control" }, { "@type": "DefinedTerm", "name": "Authorization Code Flow", "alternateName": [ "Auth Code Flow", "OAuth Authorization Code Grant" ], "description": "The Authorization Code Flow is the OAuth 2.0 grant in which a client redirects the user to the authorization server, receives a one-time code at a registered redirect_uri, and exchanges that code (with PKCE and/or a client secret) for tokens — the standard flow for almost every modern app.", "url": "https://idsync.com/glossary/authorization-code-flow" }, { "@type": "DefinedTerm", "name": "Break-Glass Access", "alternateName": [ "emergency access", "break-glass account" ], "description": "Break-glass access is a pre-provisioned, heavily monitored emergency account used only when normal authentication paths fail — for example when the IdP itself is down or an admin is locked out during an incident.", "url": "https://idsync.com/glossary/break-glass-access" }, { "@type": "DefinedTerm", "name": "Cloud Infrastructure Entitlement Management", "alternateName": [ "CIEM", "CIEM", "Cloud Entitlement Management", "Cloud Permissions Management" ], "description": "Cloud Infrastructure Entitlement Management (CIEM) tools discover, visualize, and right-size the permissions that human and machine identities have across cloud providers (AWS, Azure, GCP) — closing the gap between what identities are *granted* and what they actually *use*.", "url": "https://idsync.com/glossary/ciem" }, { "@type": "DefinedTerm", "name": "Conditional Access", "alternateName": [ "Conditional Access", "Adaptive Access", "Risk-Based Authentication" ], "description": "Conditional Access is an IdP policy capability that evaluates signals (user, device, location, app, risk score) at authentication time and decides whether to allow, block, require MFA, require a compliant device, or require step-up authentication.", "url": "https://idsync.com/glossary/conditional-access" }, { "@type": "DefinedTerm", "name": "Continuous Authentication", "alternateName": [ "continuous access evaluation", "CAE" ], "description": "Continuous authentication re-evaluates a user's session in near real time using signals like device posture, location, and token revocation — so a compromised or stale session can be terminated mid-flight instead of waiting for token expiry.", "url": "https://idsync.com/glossary/continuous-authentication" }, { "@type": "DefinedTerm", "name": "Customer Identity & Access Management", "alternateName": [ "CIAM", "CIAM", "Customer IAM", "B2C identity" ], "description": "Customer Identity & Access Management (CIAM) is the identity stack for your customers — registration, login, social and passkey sign-in, profile management, consent, and progressive profiling — at consumer scale.", "url": "https://idsync.com/glossary/ciam" }, { "@type": "DefinedTerm", "name": "Decentralized Identifier", "alternateName": [ "DID", "DID", "W3C DID" ], "description": "A decentralized identifier (DID) is a W3C standard for globally unique identifiers that are controlled by the subject — not issued by a central registrar — and that resolve to a public-key document used to verify signatures.", "url": "https://idsync.com/glossary/decentralized-identifier" }, { "@type": "DefinedTerm", "name": "Device Trust", "alternateName": [ "device posture", "device compliance" ], "description": "Device trust uses signals from a managed or attested device — MDM enrollment, disk encryption, OS version, EDR presence — as a factor in access decisions, ensuring only healthy devices can reach sensitive apps.", "url": "https://idsync.com/glossary/device-trust" }, { "@type": "DefinedTerm", "name": "DPoP", "alternateName": [ "Demonstrating Proof-of-Possession", "RFC 9449" ], "description": "DPoP (Demonstrating Proof-of-Possession, RFC 9449) binds an OAuth access token to a client-held key, so a stolen bearer token cannot be replayed from a different device or process.", "url": "https://idsync.com/glossary/dpop" }, { "@type": "DefinedTerm", "name": "FIDO2", "alternateName": [ "FIDO2", "WebAuthn", "CTAP2" ], "description": "FIDO2 is the open authentication standard that lets users sign in to websites and apps using public-key cryptography — implemented by WebAuthn in browsers and CTAP2 between the browser and the authenticator (security key, phone, or platform TPM).", "url": "https://idsync.com/glossary/fido2" }, { "@type": "DefinedTerm", "name": "Identity Federation", "alternateName": [ "Federation", "B2B SSO", "Federated Identity" ], "description": "Identity federation is the practice of letting one organization's identity provider authenticate users into another organization's applications — enabling B2B SSO, customer SSO into partner apps, and cross-domain single sign-on without duplicating accounts.", "url": "https://idsync.com/glossary/federation" }, { "@type": "DefinedTerm", "name": "Identity Governance & Administration", "alternateName": [ "IGA", "IGA", "Identity governance" ], "description": "Identity Governance & Administration (IGA) is the discipline — and the tooling category — for managing who should have access to what, granting and revoking that access, and proving it to auditors.", "url": "https://idsync.com/glossary/iga" }, { "@type": "DefinedTerm", "name": "Identity Provider", "alternateName": [ "IdP", "IdP", "Identity Provider", "OP (OpenID Provider)" ], "description": "An Identity Provider (IdP) is the system that authenticates users (or workloads) and issues signed assertions about their identity to other applications — Okta, Microsoft Entra ID, Google Workspace, Auth0, Ping Identity, and Keycloak are common examples.", "url": "https://idsync.com/glossary/identity-provider" }, { "@type": "DefinedTerm", "name": "Identity Threat Detection and Response", "alternateName": [ "ITDR", "ITDR" ], "description": "Identity Threat Detection and Response (ITDR) is a category of security tooling focused on detecting and responding to attacks that target identity infrastructure itself — credential theft, MFA bombing, session hijacking, AD/Entra compromise, OAuth abuse, and identity-based lateral movement.", "url": "https://idsync.com/glossary/itdr" }, { "@type": "DefinedTerm", "name": "Joiner / Mover / Leaver", "alternateName": [ "JML", "JML", "Lifecycle management", "Employee lifecycle" ], "description": "Joiner / Mover / Leaver (JML) is the operational model for managing identity through the employee lifecycle — granting access on hire, changing it on role change, and removing it on exit — typically driven from an HR system through the IdP and into downstream apps via SCIM.", "url": "https://idsync.com/glossary/joiner-mover-leaver" }, { "@type": "DefinedTerm", "name": "JSON Web Token", "alternateName": [ "JWT", "JWT", "Bearer Token" ], "description": "A JSON Web Token (JWT) is a compact, signed (and optionally encrypted) JSON payload used to transmit claims about a user or workload between parties — most commonly as an OAuth 2.0 access token or OpenID Connect ID token.", "url": "https://idsync.com/glossary/jwt" }, { "@type": "DefinedTerm", "name": "Just-in-Time Access", "alternateName": [ "JIT Access", "JIT access", "ephemeral access", "zero standing privilege" ], "description": "Just-in-time access grants elevated permissions only for the moment they're needed and revokes them automatically — eliminating standing privilege and shrinking the blast radius of compromised admin accounts.", "url": "https://idsync.com/glossary/just-in-time-access" }, { "@type": "DefinedTerm", "name": "Just-in-Time Provisioning", "alternateName": [ "JIT", "JIT Provisioning", "JIT" ], "description": "Just-in-Time (JIT) provisioning creates or updates a user account in a downstream application at the moment the user first signs in via SSO — using attributes from the SAML/OIDC assertion instead of a pre-built SCIM sync.", "url": "https://idsync.com/glossary/jit-provisioning" }, { "@type": "DefinedTerm", "name": "Kerberos", "alternateName": [ "Kerberos", "Windows Integrated Authentication" ], "description": "Kerberos is a network authentication protocol that uses time-bound, encrypted tickets issued by a trusted Key Distribution Center (KDC) so users and services can prove their identity without sending passwords over the wire — most famously the authentication engine behind Active Directory.", "url": "https://idsync.com/glossary/kerberos" }, { "@type": "DefinedTerm", "name": "Lightweight Directory Access Protocol", "alternateName": [ "LDAP", "LDAP" ], "description": "LDAP is the open, decades-old protocol for querying and modifying directory services — used most famously by Microsoft Active Directory and OpenLDAP — and still the backbone of authentication for Linux servers, network gear, legacy apps, and on-prem infrastructure.", "url": "https://idsync.com/glossary/ldap" }, { "@type": "DefinedTerm", "name": "Magic Links", "alternateName": [ "email magic links", "passwordless email" ], "description": "Magic links are a passwordless sign-in method that emails the user a single-use, time-limited URL — clicking it logs them in without needing a password.", "url": "https://idsync.com/glossary/magic-links" }, { "@type": "DefinedTerm", "name": "Multi-Factor Authentication", "alternateName": [ "MFA", "MFA", "2FA", "Two-factor authentication" ], "description": "Multi-factor authentication (MFA) requires a user to present two or more independent factors — something they know, have, or are — before being granted access.", "url": "https://idsync.com/glossary/multi-factor-authentication" }, { "@type": "DefinedTerm", "name": "Mutual TLS", "alternateName": [ "mTLS", "mTLS", "Mutual Authentication", "Client Certificate Authentication" ], "description": "Mutual TLS (mTLS) is TLS where both the client and the server present X.509 certificates and authenticate each other — used for strong, phishing-resistant, machine-to-machine authentication in service meshes, Zero Trust networks, and high-security APIs.", "url": "https://idsync.com/glossary/mtls" }, { "@type": "DefinedTerm", "name": "Non-Human Identity", "alternateName": [ "NHI", "NHI", "Machine identity", "Workload identity" ], "description": "Non-Human Identity (NHI) is the umbrella term for service accounts, API keys, OAuth tokens, certificates, secrets, workload identities, and AI agent identities — every identity in the environment that isn't a person.", "url": "https://idsync.com/glossary/non-human-identity" }, { "@type": "DefinedTerm", "name": "OAuth 2.0", "alternateName": [ "Open Authorization 2.0", "OAuth", "OAuth2" ], "description": "OAuth 2.0 is an authorization framework that lets a user grant a third-party application limited access to their data on another service without sharing their password.", "url": "https://idsync.com/glossary/oauth-2" }, { "@type": "DefinedTerm", "name": "OAuth Scopes", "alternateName": [ "Scopes", "OAuth Scopes" ], "description": "OAuth scopes are strings (like 'read:users' or 'mail.send') that a client requests at authorization time and that the resource server uses to enforce least privilege — they declare *what* an access token is allowed to do, not *who* the user is.", "url": "https://idsync.com/glossary/oauth-scopes" }, { "@type": "DefinedTerm", "name": "OpenID Connect", "alternateName": [ "OIDC", "OIDC", "OpenID Connect 1.0" ], "description": "OpenID Connect (OIDC) is a thin identity layer on top of OAuth 2.0 that lets a relying party verify a user's identity and obtain basic profile information via a signed JSON Web Token (ID token).", "url": "https://idsync.com/glossary/openid-connect" }, { "@type": "DefinedTerm", "name": "Passkeys", "alternateName": [ "Passkey", "Discoverable credential" ], "description": "Passkeys are phishing-resistant, password-replacing credentials based on FIDO2/WebAuthn that are synced across a user's devices via their platform or password manager.", "url": "https://idsync.com/glossary/passkeys" }, { "@type": "DefinedTerm", "name": "Phishing-Resistant MFA", "alternateName": [ "Phishing-Resistant MFA", "FIDO2 MFA", "WebAuthn MFA" ], "description": "Phishing-resistant MFA is multi-factor authentication that cannot be intercepted, replayed, or socially engineered around — in practice today this means FIDO2/WebAuthn (security keys and passkeys) or PIV / CAC smart cards. SMS, TOTP, and push-approve MFA are *not* phishing-resistant.", "url": "https://idsync.com/glossary/phishing-resistant-mfa" }, { "@type": "DefinedTerm", "name": "Policy as Code", "alternateName": [ "Policy as Code", "PaC" ], "description": "Policy as Code is the practice of expressing authorization, compliance, and governance rules in version-controlled, testable code — evaluated by a dedicated policy engine — instead of hardcoding them in application code or maintaining them in config files and tickets.", "url": "https://idsync.com/glossary/policy-as-code" }, { "@type": "DefinedTerm", "name": "Principle of Least Privilege", "alternateName": [ "PoLP", "least privilege", "PoLP" ], "description": "The principle of least privilege says every user, service, and process should hold only the minimum access required to perform its job — and nothing more — at any given moment.", "url": "https://idsync.com/glossary/least-privilege" }, { "@type": "DefinedTerm", "name": "Privileged Access Management", "alternateName": [ "PAM", "PAM", "Privileged access" ], "description": "Privileged Access Management (PAM) is the discipline and tooling for securing, controlling, monitoring, and auditing accounts that have elevated rights — admins, root accounts, service accounts, and break-glass credentials.", "url": "https://idsync.com/glossary/pam" }, { "@type": "DefinedTerm", "name": "Privileged Session Management", "alternateName": [ "PSM", "session recording", "PSM" ], "description": "Privileged session management proxies, monitors, and records sessions where users access sensitive systems with elevated rights — providing real-time visibility, recording, and the ability to terminate suspicious activity.", "url": "https://idsync.com/glossary/privileged-session-management" }, { "@type": "DefinedTerm", "name": "Proof Key for Code Exchange", "alternateName": [ "PKCE", "PKCE", "Pixie" ], "description": "Proof Key for Code Exchange (PKCE, pronounced 'pixie') is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow from interception attacks by requiring the client to prove it initiated the original authorization request.", "url": "https://idsync.com/glossary/pkce" }, { "@type": "DefinedTerm", "name": "Refresh Token", "alternateName": [ "Refresh Token" ], "description": "A refresh token is a long-lived credential issued alongside an access token in OAuth 2.0; the client exchanges it for a new access token (and optionally a new refresh token) without prompting the user to re-authenticate.", "url": "https://idsync.com/glossary/refresh-token" }, { "@type": "DefinedTerm", "name": "Relationship-Based Access Control", "alternateName": [ "ReBAC", "ReBAC", "Zanzibar" ], "description": "ReBAC models authorization as a graph of relationships — *user is editor of document, document is in folder, folder belongs to team* — making it ideal for collaborative products like Google Docs, Notion, GitHub, and Figma.", "url": "https://idsync.com/glossary/relationship-based-access-control" }, { "@type": "DefinedTerm", "name": "Risk-Based Authentication", "alternateName": [ "RBA", "adaptive authentication", "contextual authentication" ], "description": "Risk-based authentication scores each login or action using signals like device, location, IP reputation, and behavior, then decides whether to allow, challenge, or block — rather than treating every request the same.", "url": "https://idsync.com/glossary/risk-based-authentication" }, { "@type": "DefinedTerm", "name": "Role-Based Access Control", "alternateName": [ "RBAC", "RBAC", "Role based access" ], "description": "Role-Based Access Control (RBAC) grants permissions to named roles and assigns users to those roles, instead of granting permissions to users directly.", "url": "https://idsync.com/glossary/rbac" }, { "@type": "DefinedTerm", "name": "SAML 2.0", "alternateName": [ "Security Assertion Markup Language", "SAML", "SAML 2" ], "description": "SAML 2.0 is an XML-based standard that lets an identity provider (IdP) issue signed assertions about a user so a service provider (SP) can sign them in without a separate password.", "url": "https://idsync.com/glossary/saml" }, { "@type": "DefinedTerm", "name": "SCIM", "alternateName": [ "System for Cross-domain Identity Management", "SCIM 2.0", "User provisioning" ], "description": "SCIM is an open standard REST/JSON protocol for automatically creating, updating, and deactivating user accounts and groups across SaaS applications from a central identity source.", "url": "https://idsync.com/glossary/scim" }, { "@type": "DefinedTerm", "name": "Secrets Management", "alternateName": [ "Secrets Management", "Secret Store" ], "description": "Secrets management is the discipline (and tooling) for securely storing, distributing, rotating, and auditing access to sensitive values — API keys, database passwords, TLS keys, OAuth client secrets — used by humans and workloads.", "url": "https://idsync.com/glossary/secrets-management" }, { "@type": "DefinedTerm", "name": "Segregation of Duties", "alternateName": [ "SoD", "separation of duties", "SoD" ], "description": "Segregation of duties is a control that prevents any single user from holding combinations of permissions that would enable fraud — for example, creating a vendor *and* approving payments to it.", "url": "https://idsync.com/glossary/segregation-of-duties" }, { "@type": "DefinedTerm", "name": "Service Account", "alternateName": [ "bot account", "system account" ], "description": "A service account is a non-human identity used by an application, script, or system to authenticate to other systems — historically a long-lived username + password or API key, increasingly replaced by workload identity and short-lived tokens.", "url": "https://idsync.com/glossary/service-account" }, { "@type": "DefinedTerm", "name": "Service Provider", "alternateName": [ "SP", "SP", "Relying Party", "RP" ], "description": "A Service Provider (SP) is an application that delegates authentication to an Identity Provider and consumes signed identity assertions to grant access — 'Sign in with Okta' makes Salesforce the SP and Okta the IdP. In OIDC the equivalent term is Relying Party (RP).", "url": "https://idsync.com/glossary/service-provider" }, { "@type": "DefinedTerm", "name": "Single Sign-On", "alternateName": [ "SSO", "SSO", "Web SSO", "Enterprise SSO" ], "description": "Single Sign-On (SSO) lets a user authenticate once with an identity provider and then access many independent applications without signing in again.", "url": "https://idsync.com/glossary/single-sign-on" }, { "@type": "DefinedTerm", "name": "Standing Privilege", "alternateName": [ "standing access", "persistent privilege" ], "description": "Standing privilege is any elevated permission that remains assigned to a user, role, or service account when it isn't actively being used — making it a persistent target for attackers and the single biggest source of blast radius in modern breaches.", "url": "https://idsync.com/glossary/standing-privilege" }, { "@type": "DefinedTerm", "name": "Step-Up Authentication", "alternateName": [ "step-up auth", "transaction authentication" ], "description": "Step-up authentication prompts a user who is already signed in for an additional, stronger factor before allowing a sensitive action — like transferring money, changing payout details, or accessing PII.", "url": "https://idsync.com/glossary/step-up-authentication" }, { "@type": "DefinedTerm", "name": "Token Introspection", "alternateName": [ "RFC 7662", "OAuth introspection" ], "description": "Token introspection is an OAuth 2.0 endpoint (RFC 7662) where a resource server asks the authorization server whether an opaque access token is still active and what scopes and subject it represents.", "url": "https://idsync.com/glossary/token-introspection" }, { "@type": "DefinedTerm", "name": "TOTP", "alternateName": [ "Time-Based One-Time Password", "authenticator app", "RFC 6238" ], "description": "TOTP is the algorithm behind authenticator-app codes (Google Authenticator, Authy, 1Password) — a 6-digit code that changes every 30 seconds, derived from a shared secret and the current time.", "url": "https://idsync.com/glossary/totp" }, { "@type": "DefinedTerm", "name": "Verifiable Credentials", "alternateName": [ "VC", "VCs", "W3C VC" ], "description": "Verifiable credentials are a W3C standard for cryptographically signed digital attestations — a tamper-evident way to prove things like 'I'm over 18', 'I'm a licensed nurse', or 'I work for Acme' without phoning home to the issuer each time.", "url": "https://idsync.com/glossary/verifiable-credentials" }, { "@type": "DefinedTerm", "name": "WebAuthn", "alternateName": [ "Web Authentication API", "Web Authentication" ], "description": "WebAuthn is the W3C browser API that lets web apps authenticate users with public-key cryptography backed by hardware — the foundation underneath passkeys and security keys.", "url": "https://idsync.com/glossary/webauthn" }, { "@type": "DefinedTerm", "name": "Workload Identity", "alternateName": [ "Workload Identity", "Workload Identity Federation", "SPIFFE" ], "description": "Workload identity is the practice of giving non-human compute (containers, VMs, Lambdas, CI jobs, Kubernetes pods) cryptographic, short-lived identities — instead of long-lived secrets — so they can authenticate to APIs and each other.", "url": "https://idsync.com/glossary/workload-identity" }, { "@type": "DefinedTerm", "name": "Zero Trust", "alternateName": [ "Zero Trust Architecture", "ZTA" ], "description": "Zero Trust is a security model that assumes no implicit trust based on network location and instead verifies every access request against identity, device posture, and context before granting least-privilege access.", "url": "https://idsync.com/glossary/zero-trust" }, { "@type": "DefinedTerm", "name": "Zero Trust Network Access", "alternateName": [ "ZTNA", "ZTNA" ], "description": "Zero Trust Network Access (ZTNA) replaces the implicit trust of a VPN with per-application, identity- and context-aware access — users authenticate to a broker that brokers connections to specific apps based on identity, device posture, and policy, hiding the apps from the public internet.", "url": "https://idsync.com/glossary/ztna" } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. Glossary Glossary # The IDSync identity & access management glossary Plain-language, vendor-neutral definitions for the acronyms, protocols, and concepts you'll meet when evaluating identity, access, and authentication software — from SSO and SAML to SCIM, IGA, PAM, passkeys, and AI agent identity. Quick answer ## What's in the IDSync identity glossary? Short answer 60 in-depth entries covering authentication (SSO, SAML, OIDC, OAuth, MFA, passkeys), authorization (RBAC, ABAC, ReBAC), provisioning (SCIM, JML), governance (IGA, access reviews), privileged access (PAM, JIT), customer identity (CIAM), and machine and AI agent identity. Each entry explains what the term means, how it works, when buyers care, and which vendor categories to evaluate. Best for Identity, security, and IT teams evaluating tools or learning the vocabulary of modern IAM. When to choose You want a quick definition plus enough buyer context to know what to do next. When not to choose You need an implementation runbook — pair the glossary with the IDSync resources library or the IAM Stack Finder. Related tools & categories [IAM Stack Finder](/stack-finder)[Browse vendors](/directory)[Resources](/resources) AllArchitectureAuthenticationAuthorizationCloud SecurityCustomer IdentityDecentralized IdentityDetection & ResponseGovernanceIdentity GovernanceMFAMachine & Agent IdentityMachine IdentityMulti-Factor AuthenticationNetwork SecurityPrivileged AccessProvisioningStandardsStandards & Protocols [A](#letter-A)[B](#letter-B)[C](#letter-C)[D](#letter-D)E [F](#letter-F)G H [I](#letter-I)[J](#letter-J)[K](#letter-K)[L](#letter-L)[M](#letter-M)[N](#letter-N)[O](#letter-O)[P](#letter-P)Q [R](#letter-R)[S](#letter-S)[T](#letter-T)U [V](#letter-V)[W](#letter-W)X Y [Z](#letter-Z) ## A - Identity Governance ### [Access Review](/glossary/access-review) An access review is a periodic check where managers or system owners confirm that each user's current access is still appropriate — typically required by SOX, SOC 2, ISO 27001, and HIPAA. - Standards ### [Access Token](/glossary/access-token) An access token is a short-lived credential issued by an OAuth 2.0 authorization server that a client presents to a resource server (API) to prove it has been authorized to act on behalf of a user or workload, within a specific scope. - Architecture ### [Active Directory— AD ](/glossary/active-directory) Active Directory (AD) is Microsoft's on-premises directory service — a combination of LDAP, Kerberos, and DNS — that has authenticated and authorized users, computers, groups, and policies inside Windows networks for 25+ years and remains the identity backbone of most enterprises. - Machine & Agent Identity ### [AI Agent Identity](/glossary/ai-agent-identity) AI agent identity is the practice of giving autonomous AI agents, copilots, and bots their own first-class identities — with scoped credentials, delegated authority, audit trails, and lifecycle controls — instead of letting them impersonate users with broad permissions. - Machine Identity ### [API Key](/glossary/api-key) An API key is a long, opaque string an application sends with each request to authenticate to an API — simple to implement but weak compared to OAuth, mTLS, or workload identity for high-value APIs. - Authorization ### [Attribute-Based Access Control— ABAC ](/glossary/attribute-based-access-control) Attribute-Based Access Control (ABAC) decides whether a user can take an action by evaluating attributes of the user, the resource, the action, and the environment against a policy — instead of relying solely on group or role membership. - Standards ### [Authorization Code Flow](/glossary/authorization-code-flow) The Authorization Code Flow is the OAuth 2.0 grant in which a client redirects the user to the authorization server, receives a one-time code at a registered redirect\_uri, and exchanges that code (with PKCE and/or a client secret) for tokens — the standard flow for almost every modern app. ## B - Privileged Access ### [Break-Glass Access](/glossary/break-glass-access) Break-glass access is a pre-provisioned, heavily monitored emergency account used only when normal authentication paths fail — for example when the IdP itself is down or an admin is locked out during an incident. ## C - Cloud Security ### [Cloud Infrastructure Entitlement Management— CIEM ](/glossary/ciem) Cloud Infrastructure Entitlement Management (CIEM) tools discover, visualize, and right-size the permissions that human and machine identities have across cloud providers (AWS, Azure, GCP) — closing the gap between what identities are \*granted\* and what they actually \*use\*. - Authentication ### [Conditional Access](/glossary/conditional-access) Conditional Access is an IdP policy capability that evaluates signals (user, device, location, app, risk score) at authentication time and decides whether to allow, block, require MFA, require a compliant device, or require step-up authentication. - Authentication ### [Continuous Authentication](/glossary/continuous-authentication) Continuous authentication re-evaluates a user's session in near real time using signals like device posture, location, and token revocation — so a compromised or stale session can be terminated mid-flight instead of waiting for token expiry. - Customer Identity ### [Customer Identity & Access Management— CIAM ](/glossary/ciam) Customer Identity & Access Management (CIAM) is the identity stack for your customers — registration, login, social and passkey sign-in, profile management, consent, and progressive profiling — at consumer scale. ## D - Decentralized Identity ### [Decentralized Identifier— DID ](/glossary/decentralized-identifier) A decentralized identifier (DID) is a W3C standard for globally unique identifiers that are controlled by the subject — not issued by a central registrar — and that resolve to a public-key document used to verify signatures. - Authentication ### [Device Trust](/glossary/device-trust) Device trust uses signals from a managed or attested device — MDM enrollment, disk encryption, OS version, EDR presence — as a factor in access decisions, ensuring only healthy devices can reach sensitive apps. - Authentication ### [DPoP— Demonstrating Proof-of-Possession ](/glossary/dpop) DPoP (Demonstrating Proof-of-Possession, RFC 9449) binds an OAuth access token to a client-held key, so a stolen bearer token cannot be replayed from a different device or process. ## F - Authentication ### [FIDO2](/glossary/fido2) FIDO2 is the open authentication standard that lets users sign in to websites and apps using public-key cryptography — implemented by WebAuthn in browsers and CTAP2 between the browser and the authenticator (security key, phone, or platform TPM). ## I - Architecture ### [Identity Federation](/glossary/federation) Identity federation is the practice of letting one organization's identity provider authenticate users into another organization's applications — enabling B2B SSO, customer SSO into partner apps, and cross-domain single sign-on without duplicating accounts. - Governance ### [Identity Governance & Administration— IGA ](/glossary/iga) Identity Governance & Administration (IGA) is the discipline — and the tooling category — for managing who should have access to what, granting and revoking that access, and proving it to auditors. - Architecture ### [Identity Provider— IdP ](/glossary/identity-provider) An Identity Provider (IdP) is the system that authenticates users (or workloads) and issues signed assertions about their identity to other applications — Okta, Microsoft Entra ID, Google Workspace, Auth0, Ping Identity, and Keycloak are common examples. - Detection & Response ### [Identity Threat Detection and Response— ITDR ](/glossary/itdr) Identity Threat Detection and Response (ITDR) is a category of security tooling focused on detecting and responding to attacks that target identity infrastructure itself — credential theft, MFA bombing, session hijacking, AD/Entra compromise, OAuth abuse, and identity-based lateral movement. ## J - Provisioning ### [Joiner / Mover / Leaver— JML ](/glossary/joiner-mover-leaver) Joiner / Mover / Leaver (JML) is the operational model for managing identity through the employee lifecycle — granting access on hire, changing it on role change, and removing it on exit — typically driven from an HR system through the IdP and into downstream apps via SCIM. - Standards ### [JSON Web Token— JWT ](/glossary/jwt) A JSON Web Token (JWT) is a compact, signed (and optionally encrypted) JSON payload used to transmit claims about a user or workload between parties — most commonly as an OAuth 2.0 access token or OpenID Connect ID token. - Privileged Access ### [Just-in-Time Access— JIT Access ](/glossary/just-in-time-access) Just-in-time access grants elevated permissions only for the moment they're needed and revokes them automatically — eliminating standing privilege and shrinking the blast radius of compromised admin accounts. - Provisioning ### [Just-in-Time Provisioning— JIT ](/glossary/jit-provisioning) Just-in-Time (JIT) provisioning creates or updates a user account in a downstream application at the moment the user first signs in via SSO — using attributes from the SAML/OIDC assertion instead of a pre-built SCIM sync. ## K - Authentication ### [Kerberos](/glossary/kerberos) Kerberos is a network authentication protocol that uses time-bound, encrypted tickets issued by a trusted Key Distribution Center (KDC) so users and services can prove their identity without sending passwords over the wire — most famously the authentication engine behind Active Directory. ## L - Architecture ### [Lightweight Directory Access Protocol— LDAP ](/glossary/ldap) LDAP is the open, decades-old protocol for querying and modifying directory services — used most famously by Microsoft Active Directory and OpenLDAP — and still the backbone of authentication for Linux servers, network gear, legacy apps, and on-prem infrastructure. ## M - Authentication ### [Magic Links](/glossary/magic-links) Magic links are a passwordless sign-in method that emails the user a single-use, time-limited URL — clicking it logs them in without needing a password. - Authentication ### [Multi-Factor Authentication— MFA ](/glossary/multi-factor-authentication) Multi-factor authentication (MFA) requires a user to present two or more independent factors — something they know, have, or are — before being granted access. - Authentication ### [Mutual TLS— mTLS ](/glossary/mtls) Mutual TLS (mTLS) is TLS where both the client and the server present X.509 certificates and authenticate each other — used for strong, phishing-resistant, machine-to-machine authentication in service meshes, Zero Trust networks, and high-security APIs. ## N - Machine & Agent Identity ### [Non-Human Identity— NHI ](/glossary/non-human-identity) Non-Human Identity (NHI) is the umbrella term for service accounts, API keys, OAuth tokens, certificates, secrets, workload identities, and AI agent identities — every identity in the environment that isn't a person. ## O - Standards & Protocols ### [OAuth 2.0— Open Authorization 2.0 ](/glossary/oauth-2) OAuth 2.0 is an authorization framework that lets a user grant a third-party application limited access to their data on another service without sharing their password. - Standards ### [OAuth Scopes](/glossary/oauth-scopes) OAuth scopes are strings (like 'read:users' or 'mail.send') that a client requests at authorization time and that the resource server uses to enforce least privilege — they declare \*what\* an access token is allowed to do, not \*who\* the user is. - Standards & Protocols ### [OpenID Connect— OIDC ](/glossary/openid-connect) OpenID Connect (OIDC) is a thin identity layer on top of OAuth 2.0 that lets a relying party verify a user's identity and obtain basic profile information via a signed JSON Web Token (ID token). ## P - Authentication ### [Passkeys](/glossary/passkeys) Passkeys are phishing-resistant, password-replacing credentials based on FIDO2/WebAuthn that are synced across a user's devices via their platform or password manager. - MFA ### [Phishing-Resistant MFA](/glossary/phishing-resistant-mfa) Phishing-resistant MFA is multi-factor authentication that cannot be intercepted, replayed, or socially engineered around — in practice today this means FIDO2/WebAuthn (security keys and passkeys) or PIV / CAC smart cards. SMS, TOTP, and push-approve MFA are \*not\* phishing-resistant. - Authorization ### [Policy as Code](/glossary/policy-as-code) Policy as Code is the practice of expressing authorization, compliance, and governance rules in version-controlled, testable code — evaluated by a dedicated policy engine — instead of hardcoding them in application code or maintaining them in config files and tickets. - Identity Governance ### [Principle of Least Privilege— PoLP ](/glossary/least-privilege) The principle of least privilege says every user, service, and process should hold only the minimum access required to perform its job — and nothing more — at any given moment. - Privileged Access ### [Privileged Access Management— PAM ](/glossary/pam) Privileged Access Management (PAM) is the discipline and tooling for securing, controlling, monitoring, and auditing accounts that have elevated rights — admins, root accounts, service accounts, and break-glass credentials. - Privileged Access ### [Privileged Session Management— PSM ](/glossary/privileged-session-management) Privileged session management proxies, monitors, and records sessions where users access sensitive systems with elevated rights — providing real-time visibility, recording, and the ability to terminate suspicious activity. - Standards ### [Proof Key for Code Exchange— PKCE ](/glossary/pkce) Proof Key for Code Exchange (PKCE, pronounced 'pixie') is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow from interception attacks by requiring the client to prove it initiated the original authorization request. ## R - Standards ### [Refresh Token](/glossary/refresh-token) A refresh token is a long-lived credential issued alongside an access token in OAuth 2.0; the client exchanges it for a new access token (and optionally a new refresh token) without prompting the user to re-authenticate. - Authorization ### [Relationship-Based Access Control— ReBAC ](/glossary/relationship-based-access-control) ReBAC models authorization as a graph of relationships — \*user is editor of document, document is in folder, folder belongs to team\* — making it ideal for collaborative products like Google Docs, Notion, GitHub, and Figma. - Authentication ### [Risk-Based Authentication— RBA ](/glossary/risk-based-authentication) Risk-based authentication scores each login or action using signals like device, location, IP reputation, and behavior, then decides whether to allow, challenge, or block — rather than treating every request the same. - Authorization ### [Role-Based Access Control— RBAC ](/glossary/rbac) Role-Based Access Control (RBAC) grants permissions to named roles and assigns users to those roles, instead of granting permissions to users directly. ## S - Standards & Protocols ### [SAML 2.0— Security Assertion Markup Language ](/glossary/saml) SAML 2.0 is an XML-based standard that lets an identity provider (IdP) issue signed assertions about a user so a service provider (SP) can sign them in without a separate password. - Provisioning ### [SCIM— System for Cross-domain Identity Management ](/glossary/scim) SCIM is an open standard REST/JSON protocol for automatically creating, updating, and deactivating user accounts and groups across SaaS applications from a central identity source. - Machine Identity ### [Secrets Management](/glossary/secrets-management) Secrets management is the discipline (and tooling) for securely storing, distributing, rotating, and auditing access to sensitive values — API keys, database passwords, TLS keys, OAuth client secrets — used by humans and workloads. - Identity Governance ### [Segregation of Duties— SoD ](/glossary/segregation-of-duties) Segregation of duties is a control that prevents any single user from holding combinations of permissions that would enable fraud — for example, creating a vendor \*and\* approving payments to it. - Machine Identity ### [Service Account](/glossary/service-account) A service account is a non-human identity used by an application, script, or system to authenticate to other systems — historically a long-lived username + password or API key, increasingly replaced by workload identity and short-lived tokens. - Architecture ### [Service Provider— SP ](/glossary/service-provider) A Service Provider (SP) is an application that delegates authentication to an Identity Provider and consumes signed identity assertions to grant access — 'Sign in with Okta' makes Salesforce the SP and Okta the IdP. In OIDC the equivalent term is Relying Party (RP). - Authentication ### [Single Sign-On— SSO ](/glossary/single-sign-on) Single Sign-On (SSO) lets a user authenticate once with an identity provider and then access many independent applications without signing in again. - Privileged Access ### [Standing Privilege](/glossary/standing-privilege) Standing privilege is any elevated permission that remains assigned to a user, role, or service account when it isn't actively being used — making it a persistent target for attackers and the single biggest source of blast radius in modern breaches. - Authentication ### [Step-Up Authentication](/glossary/step-up-authentication) Step-up authentication prompts a user who is already signed in for an additional, stronger factor before allowing a sensitive action — like transferring money, changing payout details, or accessing PII. ## T - Authorization ### [Token Introspection](/glossary/token-introspection) Token introspection is an OAuth 2.0 endpoint (RFC 7662) where a resource server asks the authorization server whether an opaque access token is still active and what scopes and subject it represents. - Multi-Factor Authentication ### [TOTP— Time-Based One-Time Password ](/glossary/totp) TOTP is the algorithm behind authenticator-app codes (Google Authenticator, Authy, 1Password) — a 6-digit code that changes every 30 seconds, derived from a shared secret and the current time. ## V - Decentralized Identity ### [Verifiable Credentials— VC ](/glossary/verifiable-credentials) Verifiable credentials are a W3C standard for cryptographically signed digital attestations — a tamper-evident way to prove things like 'I'm over 18', 'I'm a licensed nurse', or 'I work for Acme' without phoning home to the issuer each time. ## W - Authentication ### [WebAuthn— Web Authentication API ](/glossary/webauthn) WebAuthn is the W3C browser API that lets web apps authenticate users with public-key cryptography backed by hardware — the foundation underneath passkeys and security keys. - Machine Identity ### [Workload Identity](/glossary/workload-identity) Workload identity is the practice of giving non-human compute (containers, VMs, Lambdas, CI jobs, Kubernetes pods) cryptographic, short-lived identities — instead of long-lived secrets — so they can authenticate to APIs and each other. ## Z - Architecture ### [Zero Trust](/glossary/zero-trust) Zero Trust is a security model that assumes no implicit trust based on network location and instead verifies every access request against identity, device posture, and context before granting least-privilege access. - Network Security ### [Zero Trust Network Access— ZTNA ](/glossary/ztna) Zero Trust Network Access (ZTNA) replaces the implicit trust of a VPN with per-application, identity- and context-aware access — users authenticate to a broker that brokers connections to specific apps based on identity, device posture, and policy, hiding the apps from the public internet. ## Missing a term? Tell us what's missing and we'll add it. The IDSync glossary is editorially independent and updated continuously. [Suggest a term](/contact) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.