Identity and Access Administration

Vocabulary practice flashcards covering fundamental concepts in Identity and Access Management (IAM), including Zero Trust principles, Microsoft Entra ID terminology, decentralized identity, authentication protocols, tokens, and authorization models.

Zero Trust Model

A security model designed to adapt to the complexities of modern working conditions based on three core principles: verify explicitly, use least privilege access, and assume breach.

Verify Explicitly

A Zero Trust principle requiring organizations to always validate all available data points, including user identity, location, device health, service or workload context, data classification, and anomalies.

Least Privilege Access

A Zero Trust principle that helps secure data and productivity by limiting user access using Just-In-Time (JIT) access, risk-based adaptive policies, and data protection against out-of-band vectors.

Assume Breach

A Zero Trust principle that seeks to minimize the blast radius of security incidents and prevent lateral movement through network segmentation, end-to-end session encryption, and threat analytics.

Identity Provider (IdP)

A trusted system that creates, manages, and stores digital identities (such as Microsoft Entra ID), verifying them through one or more authentication factors to facilitate Single Sign-On (SSO).

OpenID Connect (OIDC)

An authentication protocol built on the OAuth 2.0 authorization framework where an OpenID Provider issues JSON-formatted identity tokens to relying parties via a RESTful HTTP API.

Security Assertion Markup Language (SAML)

An open, XML-based standard and markup language used for exchanging authentication and authorization data (security assertions) between an identity provider and a service provider.

Active Directory Domain Services (AD DS)

A core on-premises IT component that provides centralized user account authentication and computer management features across an organization.

Identity Administration

The manual or automated management of identity objects over the lifetime of their existence within an IT environment.

Identity Proliferation

An identity administration challenge concerning the storage and spread of identity objects across various platforms, including Active Directory, other directory services, and application-specific stores.

Provisioning

The identity administration process that governs how identity objects are created and set up within a system.

Deprovisioning

The identity administration process focused on removing access from an identity, which includes account deletion, disablement of security principals, or revoking access rights.

Synchronization

The process of keeping identity systems updated with current information across an environment, performed via manual, time-based, or event-driven mechanisms.

Application Entitlement Management

A capability defining how identities are granted access to applications, encompassing coarse-grained application entitlements within authorization and fine-grained entitlements managed as identity attributes.

Control Plane

A concept identifying the component or service that directs access to resources based on specific criteria; identity functions as the control plane because it is the sole common denominator across networks, devices, and applications.

Centralized Identity Management

A single identity tool (hosted on-premises or in the cloud) where user credentials are stored and managed by an identity authority to provide authentication and authorization services.

Decentralized Identity

An identity model allowing individuals, organizations, and things to interact transparently and securely by enabling users to generate, self-own, and control their own globally unique digital identifiers and credentials.

W3C Decentralized Identifiers (DIDs)

Globally unique identifiers that users create, own, and control independently of any centralized entity, linked to Decentralized Public Key Infrastructure (DPKI) JSON documents containing public keys, authentication descriptors, and service endpoints.

DID User Agents

Applications (such as digital wallet apps) that enable users to create DIDs, manage associated data and permissions, and sign or validate DID-linked claims.

DIF Universal Resolver

A server that uses DID Drivers to execute lookups and resolutions of DIDs across different decentralized systems, returning the DID Document Object (DDO) containing DPKI metadata.

DIF Identity Hubs

A replicated mesh of encrypted personal datastores spanning cloud and edge devices (such as PCs, mobile phones, or smart speakers) that facilitates identity data storage and interactions.

DID Attestations

Standard-format, DID-signed statements that enable identity owners to generate, present, and verify claims to establish trust.

Identity (Microsoft Entra ID)

An object that can be authenticated, such as a user identified with a username and password.

Account (Microsoft Entra ID)

An identity that has data associated with it; an account cannot exist without an underlying identity.

Microsoft Entra Account

An identity created via Microsoft Entra ID or another cloud service that is stored in Entra ID and accessible to an organization's cloud subscriptions.

Administrative Unit

A portioned-off segment of a Microsoft Entra tenant designed to establish an administrative boundary for delegation.

Authentication Assurance

The degree of confidence an organization maintains that an entity accessing a resource is truly who they claim to be, influenced by personal vs. shared accounts, multi-factor authentication, and risk-based validation.

Federated Identity

A collection of distinct domains joined by an established trust relationship, allowing users to leverage existing identities from trusted external directories (such as on-premises Active Directory).

Access Token

A short-lived security token issued by an authorization server under OAuth 2.0 containing details about the user and target resource, used to grant access to a client application.

Refresh Token

A token issued simultaneously with an access token by an authorization server, used by client applications to obtain a new access token without re-prompting the user.

ID Token

A token issued during an OpenID Connect (OIDC) flow that provides the client application with user authentication information, sent either alongside or instead of an access token.

JSON Web Token (JWT)

A compact, self-contained JSON format used to transmit information securely between parties, cryptographically verified using public/private key pairs or secret keys.

Claim

A key-value pair of data located within a security token representing a specific statement about an entity.

Assertion

A package of data, typically in token form, that shares identity and security details about a user or account across disparate security domains.

Augmentation

The process of appending additional claims to an existing user token to provide extra detail about that user.

Access Control Lists (ACLs)

An explicit list defining the specific entities granted or denied access to a particular resource or function, providing fine-grained control that can be difficult to manage at scale.

Role-Based Access Control (RBAC)

The most common authorization approach, where permissions are assigned to defined roles reflecting job activities rather than directly to individual users.

Attribute-Based Access Control (ABAC)

An authorization method where access decisions are evaluated dynamically using rules based on entity attributes, resource attributes, and current environmental attributes.

Policy-Based Access Control (PBAC)

An access management strategy where an entity's business role is evaluated in combination with governance policies to determine permissible access across systems.