IDENTITY VOCABULARY

Identity vocabulary: IAM terms for apps and accounts outside the IdP

The short answer

Short, plain definitions of the terms used across this site, from local account and orphaned account to identity orchestration and access graph. Where a term comes from a standard or a vendor, the definition links the source. Each term has its own anchor you can link to.

Access graph

A model of identities, accounts and permissions across connected systems, used to answer who can do what, including access inherited through groups and roles. Veza describes its Access Graph this way.

Related: Veza profile

Source: Veza homepage · Read 27 Sep 2026

Access review

A periodic check in which a reviewer confirms or removes each person's access to a system. Also called an access certification when run as a formal campaign.

Related: Lesson 08: Account ownership

Source: SailPoint documentation: certifications · Read 27 Sep 2026

Account discovery

Finding the accounts that exist inside an application and matching them to known people. Microsoft uses the name for a feature that shows app users who do not match any Entra ID user.

Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026

Agent identity

An identity issued to an AI agent so its actions can be authenticated, authorized and traced back to an accountable person or team. Microsoft Entra Agent ID is one implementation.

Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026

Application onboarding

Connecting an application to an IGA platform so its accounts can be provisioned, reviewed and removed centrally.

Related: Lesson 07: Connector methods

Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026

Authentication path

Any route by which a user or system signs in to an application. A shadow authentication path is one that bypasses the identity provider.

Birthright access

The access a person receives automatically on joining, based on attributes such as department or role.

Source: Veza Lifecycle Management · Read 27 Sep 2026

Break-glass account

An emergency account kept for use when normal sign-in is unavailable. It should have a named custodian and a record of every use.

Related: Lesson 02: Local accounts

Connector

Software that lets an identity system read accounts from, and write changes to, an application, through SCIM, LDAP, SQL, an API or another method.

Related: Lesson 07: Connector methods

Source: Microsoft Learn: app provisioning · Read 27 Sep 2026

Coverage gap

The applications and accounts in use that the identity provider or IGA platform does not control. This site measures it as applications outside SSO and applications without automated provisioning.

Related: Coverage gap calculator

Disconnected application

An application with no provisioning connector to the IGA platform, so account changes happen manually or through tickets.

Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026

Dormant account

An active account that has not been used for a defined period. Dormancy is a common signal that an account is no longer needed.

Source: Veza homepage · Read 27 Sep 2026

ECMA connector host

Microsoft's on-premises agent that runs connectors such as LDAP and SQL so Entra can provision accounts into on-prem applications.

Source: Microsoft Learn: app provisioning · Read 27 Sep 2026

Effective permissions

What an identity can actually do in a system once group memberships, roles and inherited grants are resolved.

Source: Veza Access Reviews · Read 27 Sep 2026

Hardcoded credential

A username and password, key or token written into code, a script or a configuration file. It is long-lived because changing it means changing the code.

Related: Lesson 02: Local accounts

Source: OWASP Non-Human Identities Top 10 · Read 29 Sep 2026

Identity Dark Matter

Orchid Security's trademarked term for identity activity and accounts that sit inside applications outside central identity control.

Source: Orchid Security homepage · Read 27 Sep 2026

Identity governance and administration (IGA)

The category of products that provision and remove access, run access reviews and record decisions for audit.

Related: Lesson 05: Stack layers

Identity orchestration

Coordinating identity data and actions across several identity systems so a finding in one becomes a change in the system that owns it. Vendors also use the term for sign-in journey builders and access brokering.

Identity provider (IdP)

The system that authenticates users and federates sign-in to applications, usually with MFA and sign-in policy.

Related: Lesson 05: Stack layers

Identity threat detection and response (ITDR)

Tools that detect and respond to attacks on identity systems and sign-ins as they happen, such as credential theft and lateral movement.

Source: Silverfort homepage · Read 29 Sep 2026

Joiner, mover, leaver (JML)

The three lifecycle events that change a person's access: joining, changing role and leaving.

Related: Vocabulary: Birthright access

Just-in-time access

Access granted for a limited time when it is requested and approved, then removed automatically.

Source: Apono homepage · Read 27 Sep 2026

Local account

An account created and stored by an application itself rather than provisioned from a central directory. Local admins and vendor logins are common examples.

Related: Lesson 02: Local accounts

Non-human identity

An identity used by software rather than a person: service accounts, API keys, workload identities and AI agents.

Related: Lesson 04: Non-human accounts

Source: OWASP Non-Human Identities Top 10 · Read 29 Sep 2026

Open Authorization API (OAA)

Veza's interface for bringing permission data from custom systems into its Access Graph; OAA Write pushes changes back.

Source: Veza Lifecycle Management · Read 27 Sep 2026

Orphaned account

An active account with no current owner, often left behind when its user left or changed role.

Related: Lesson 08: Account ownership

Source: Orchid Security: Orphan and Local Accounts report · Read 27 Sep 2026

Privilege drift

The gradual build-up of access beyond what a role needs, as permissions are added and rarely removed.

Source: Orchid Security homepage · Read 27 Sep 2026

RPA connector

A connector that uses robotic process automation to operate an application's admin screens when the application has no API.

Source: Palo Alto Networks: Idira Identity Governance · Read 27 Sep 2026

SCIM

System for Cross-domain Identity Management, the standard protocol for provisioning accounts, defined in RFC 7644.

Source: RFC 7644: SCIM Protocol · Read 27 Sep 2026

Service account

An account used by a system or scheduled job rather than a person. It needs a named owner and a credential lifetime.

Source: OWASP Non-Human Identities Top 10 · Read 29 Sep 2026

Shadow IT

Applications and services used without central approval or integration, often SaaS bought or signed up for by a team.

Source: C1: Shadow IT · Read 27 Sep 2026

Shared Signals Framework

An OpenID Foundation standard for exchanging security events, such as session revocation, between systems; CAEP and RISC define the event types.

Source: OpenID Foundation: Shared Signals Working Group · Read 27 Sep 2026

Single sign-on (SSO)

Signing in once through an identity provider to reach many applications. SSO controls the front door but not accounts the application creates itself.

Unmanaged application

An application whose accounts neither the identity provider nor the IGA platform controls.

Workload identity

An identity assigned to a software workload, such as an application or script running in a cloud, so it can authenticate without a person. Microsoft prices Entra Workload ID per workload identity.

Source: Microsoft Entra pricing · Read 27 Sep 2026

Zero trust

An approach that, in NIST's words, moves defenses from static, network-based perimeters to focus on users, assets and resources.

Source: NIST SP 800-207 Zero Trust Architecture · Read 29 Sep 2026