IGA Glossary

Identity Governance Glossary

Clear, practical definitions for every identity governance and access management term you will run into. No jargon walls, no vendor spin — just the stuff you need to know.

ABCDEFGHI JKL M NOPQR STUVWXYZ

A

Access Certification

Access certification is a formal governance process where designated reviewers (typically managers or application owners) verify that users' current access to systems and data is still appropriate. It is a key control for maintaining least-privilege access and meeting compliance requirements.

Access Review

An access review is the process of examining and validating users' current access to systems, applications, and data to ensure it is still appropriate. Access reviews help organizations maintain security, enforce least-privilege access, and satisfy compliance requirements.

D

Dynamic Groups

Dynamic groups are groups in Microsoft Entra ID that automatically add and remove members based on user attributes like department, job title, or location. They replace the need for manual group management and are a key building block for automating identity governance.

I

ISO 27001

ISO 27001 is an international standard for information security management systems (ISMS). It provides a framework for organizations to identify, manage, and reduce information security risks through a systematic set of policies, processes, and controls.

Identity Governance and Administration(IGA)

Identity Governance and Administration (IGA) is a framework of policies, processes, and technology that manages digital identities and controls who has access to what within an organization. It combines identity lifecycle management with access governance to make sure the right people have the right access at the right time.

Identity and Access Management(IAM)

Identity and Access Management (IAM) is the discipline of managing who can access which systems and what they can do within those systems. It covers everything from user authentication and authorization to directory services and access policies.

J

Joiner-Mover-Leaver(JML)

Joiner-Mover-Leaver (JML) is a framework for managing the three major events in an employee's identity lifecycle: joining the organization, moving to a new role or department, and leaving. Each event triggers specific changes to the user's access and accounts.

L

Least Privilege

The principle of least privilege states that users should only have the minimum level of access required to perform their job duties — nothing more. It is a foundational security concept that reduces risk by limiting the potential damage from compromised accounts, insider threats, and human error.

Lifecycle Management(ILM)

Lifecycle management (also called identity lifecycle management) is the process of managing user accounts and their access from the moment someone joins an organization through role changes and eventually to their departure. It covers creating accounts, assigning access, updating permissions when roles change, and revoking everything when someone leaves.

M

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It handles authentication, authorization, and user management for organizations using Microsoft 365, Azure, and thousands of third-party applications.

Multi-Factor Authentication(MFA)

Multi-factor authentication (MFA) is a security method that requires users to verify their identity using two or more different factors before they can access an account or application. It significantly reduces the risk of unauthorized access, even when passwords are compromised.

N

NIS2 Directive(NIS2)

The NIS2 Directive is a European Union cybersecurity regulation that sets stricter security and incident reporting requirements for organizations in essential and important sectors. It expands on the original NIS Directive and requires covered organizations to implement proper risk management measures, including identity and access controls.

P

Privileged Access Management(PAM)

Privileged access management (PAM) is the set of practices and tools used to control, monitor, and secure access to critical systems through elevated or administrative accounts. It ensures that privileged credentials are properly managed and that high-risk access is limited to authorized users for only as long as they need it.

R

Role-Based Access Control(RBAC)

Role-Based Access Control (RBAC) is a method of managing access to systems and data by assigning permissions to roles rather than to individual users. Users are then assigned to roles based on their job function, and they inherit the access that role provides.

S

SOC 2

SOC 2 (System and Organization Controls 2) is an auditing framework developed by the American Institute of CPAs (AICPA) that evaluates how organizations manage customer data. It focuses on five trust service criteria: security, availability, processing integrity, confidentiality, and privacy.

Separation of Duties(SoD)

Separation of Duties (SoD) is a governance principle that prevents any single person from having enough access or authority to complete a high-risk process alone. By requiring multiple people to be involved in sensitive operations, SoD reduces the risk of fraud, errors, and abuse of privilege.

Single Sign-On(SSO)

Single sign-on (SSO) is an authentication method that lets users log in once and then access multiple applications without entering their credentials again. It reduces password fatigue, improves security, and gives IT teams centralized control over application access.

U

User Deprovisioning

User deprovisioning is the process of revoking a user's access to systems, applications, and data when they leave an organization or no longer need that access. It is the "remove access" side of identity lifecycle management, and it is critical for security and compliance.

User Provisioning

User provisioning is the process of creating user accounts and granting the appropriate access to systems, applications, and resources when someone joins an organization or takes on a new role. It is the "give access" side of identity lifecycle management.

Z

Zero Trust

Zero trust is a security model based on the principle of "never trust, always verify." Instead of assuming that users and devices inside the corporate network are safe, zero trust requires continuous verification of every access request, regardless of where it originates.

Put these concepts into practice

Adcyma makes identity governance simple for companies using Microsoft Entra ID. See how these terms translate into actual features.

Start Free Trial