{"generated":"2026-10-18T01:50:41.425Z","source":"https://azureblog.co.uk","count":120,"terms":[{"term":"Conditional Access","definition":"Entra ID's policy engine. Each policy says: if these users sign in to these apps under these conditions, then require (or block) something, such as MFA or a compliant device.","post":"https://azureblog.co.uk/posts/conditional-access-report-only-and-what-if/"},{"term":"Report-only mode","definition":"A Conditional Access policy state that evaluates the policy at every sign-in and logs the result, without enforcing it. Used to test impact before switching a policy on.","post":"https://azureblog.co.uk/posts/conditional-access-report-only-and-what-if/"},{"term":"What If","definition":"A Conditional Access tool that shows which policies would apply to a given user, app and set of conditions, without anyone having to sign in.","post":"https://azureblog.co.uk/posts/conditional-access-report-only-and-what-if/"},{"term":"Named location","definition":"A set of IP ranges or countries saved in Entra ID so Conditional Access policies can include or exclude them.","post":"https://azureblog.co.uk/posts/named-locations-in-conditional-access/"},{"term":"Authentication strength","definition":"A Conditional Access grant control that requires specific sign-in methods, such as phishing-resistant MFA, rather than any MFA method.","post":"https://azureblog.co.uk/posts/authentication-strengths-explained/"},{"term":"Authentication context","definition":"A label (such as c1) that an app or service like PIM can request at a sensitive moment. A Conditional Access policy targeting the label sets what the user must prove.","post":"https://azureblog.co.uk/posts/pim-activation-conditional-access-context/"},{"term":"MFA","definition":"Multifactor authentication: proving who you are with more than one factor, such as something you know, something you have, or something you are.","post":null},{"term":"Phishing-resistant MFA","definition":"Sign-in methods bound to the real site, so they can't be relayed by a fake one: passkeys (FIDO2), Windows Hello for Business and multifactor certificate-based authentication.","post":"https://azureblog.co.uk/posts/authentication-strengths-explained/"},{"term":"Passkey","definition":"A FIDO2 credential made of a key pair. The private key stays on the device or in a password manager and only signs in to the site it was created for.","post":"https://azureblog.co.uk/posts/synced-passkeys-and-passkey-profiles/"},{"term":"FIDO2","definition":"The open standard behind passkeys and security keys, combining WebAuthn in the browser with CTAP for authenticators.","post":null},{"term":"Windows Hello for Business","definition":"Phishing-resistant sign-in to Windows using a PIN or biometrics, backed by a key held in the device's TPM.","post":null},{"term":"Temporary Access Pass","definition":"A time-limited passcode issued by an admin, used to sign in and register passwordless methods without ever having a password.","post":"https://azureblog.co.uk/posts/temporary-access-pass-onboarding/"},{"term":"Break-glass account","definition":"An emergency cloud-only Global Administrator account, excluded from normal policies and closely monitored, used only when normal admin access fails.","post":"https://azureblog.co.uk/posts/break-glass-accounts-done-right/"},{"term":"PIM","definition":"Privileged Identity Management: users are made eligible for admin roles and activate them only when needed, for a limited time, with justification and checks.","post":"https://azureblog.co.uk/posts/activate-pim-roles-with-powershell/"},{"term":"RBAC","definition":"Role-based access control: permissions granted by assigning roles to users, groups or identities at a scope.","post":null},{"term":"Service principal","definition":"An app's identity inside one tenant. An app registration is the global definition; the service principal is the local instance that gets permissions and signs in.","post":"https://azureblog.co.uk/posts/managed-identities-vs-service-principals/"},{"term":"App registration","definition":"The definition of an application in Entra ID: its ID, redirect URIs, credentials and the permissions it asks for.","post":null},{"term":"Managed identity","definition":"An identity for an Azure resource whose credentials Azure creates and rotates for you, so code can reach other services without any stored secret.","post":"https://azureblog.co.uk/posts/managed-identities-vs-service-principals/"},{"term":"Workload identity","definition":"Any non-human identity, such as an app, service principal or managed identity, that signs in to access resources.","post":null},{"term":"Federated credential","definition":"A trust that lets an app sign in with a token from an external identity provider, such as GitHub Actions, instead of a secret or certificate.","post":"https://azureblog.co.uk/posts/github-actions-to-azure-without-secrets/"},{"term":"SAML","definition":"Security Assertion Markup Language: an XML-based single sign-on standard where Entra ID sends a signed assertion about the user to the app.","post":"https://azureblog.co.uk/posts/saml-certificate-rollover/"},{"term":"OpenID Connect","definition":"An identity layer on top of OAuth 2.0 that adds sign-in, using JSON Web Tokens (ID tokens) to describe the user.","post":null},{"term":"JWT","definition":"JSON Web Token: a signed, base64url-encoded token carrying claims such as audience, issuer and permissions. Entra access and ID tokens are JWTs.","post":null},{"term":"SCIM","definition":"System for Cross-domain Identity Management: a standard API that Entra ID uses to create, update and remove users and groups in other apps.","post":"https://azureblog.co.uk/posts/scim-one-app-per-library/"},{"term":"SSO","definition":"Single sign-on: signing in once with your work account and getting into other apps without another password.","post":null},{"term":"B2B collaboration","definition":"Inviting people from other organisations as guest users, who sign in with their own home identity.","post":null},{"term":"Entra Cloud Sync","definition":"Microsoft's lightweight agent-based service for syncing users and groups from Active Directory to Entra ID, configured in the cloud.","post":"https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/"},{"term":"Entra Connect Sync","definition":"The traditional server-based tool that syncs Active Directory objects to Entra ID, with configuration held on the server.","post":"https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/"},{"term":"Source of Authority","definition":"Which directory owns an object's attributes. Converting a synced user's source of authority makes it managed in the cloud instead of in AD.","post":"https://azureblog.co.uk/posts/convert-synced-users-to-cloud-source-of-authority/"},{"term":"Hybrid join","definition":"A Windows device joined to on-premises Active Directory and also registered in Entra ID, so it can use device-based Conditional Access.","post":"https://azureblog.co.uk/posts/hybrid-join-with-entra-kerberos-preview/"},{"term":"Entra join","definition":"A corporate Windows device joined directly to Entra ID, with no on-premises domain membership needed.","post":null},{"term":"Entra registered","definition":"A personal device where the user has added a work account. The device gets an identity in the tenant, but the user keeps control of it.","post":"https://azureblog.co.uk/posts/byod-windows-entra-registration-ga/"},{"term":"Kerberos","definition":"The ticket-based authentication protocol used by Active Directory. Entra ID can issue Kerberos tickets for some on-premises scenarios.","post":null},{"term":"Windows Autopilot","definition":"A way to set up new Windows devices straight from the box: the device joins Entra ID, enrols in Intune and gets its apps and policies.","post":null},{"term":"Windows LAPS","definition":"Local Administrator Password Solution: Windows sets a unique, rotating local admin password on each device and backs it up to Entra ID or AD.","post":"https://azureblog.co.uk/posts/windows-laps-with-intune/"},{"term":"Compliance policy","definition":"Intune rules a device must meet, such as encryption or a minimum OS version. Conditional Access can require a compliant device.","post":"https://azureblog.co.uk/posts/rolling-out-require-compliant-device/"},{"term":"Win32 app","definition":"A traditional Windows app packaged as an .intunewin file so Intune can install it with detection rules, dependencies and return codes.","post":"https://azureblog.co.uk/posts/win32-app-packaging-detection-rules/"},{"term":"Remediations","definition":"Intune script packages: a detection script checks for a problem, and a remediation script fixes it when found.","post":"https://azureblog.co.uk/posts/intune-remediations-scripts/"},{"term":"MAM","definition":"Mobile application management: protecting work data inside apps (copy, save and PIN rules) without managing the whole device.","post":null},{"term":"MDM","definition":"Mobile device management: enrolling a device so policies, apps and settings can be managed on the whole device.","post":null},{"term":"DDM","definition":"Declarative device management: Apple's newer management model where the device applies and reports on declared settings itself.","post":null},{"term":"KQL","definition":"Kusto Query Language: the query language for Log Analytics, Microsoft Sentinel, Defender and Azure Resource Graph.","post":"https://azureblog.co.uk/posts/kql-queries-for-entra-sign-in-logs/"},{"term":"Log Analytics workspace","definition":"Azure Monitor's log store. Entra sign-in and audit logs can be sent there with diagnostic settings and queried with KQL.","post":null},{"term":"Microsoft Graph","definition":"The single API for Microsoft 365, Entra ID and Intune data, also used by the Microsoft Graph PowerShell SDK.","post":null},{"term":"Azure Policy","definition":"Rules that evaluate Azure resources and can audit, deny or automatically fix them, assigned at management group, subscription, resource group or resource scope.","post":"https://azureblog.co.uk/posts/azure-policy-allowed-locations-and-guardrails/"},{"term":"DeployIfNotExists","definition":"An Azure Policy effect that deploys a related resource or setting, such as diagnostic settings, when it's missing. Existing resources need a remediation task.","post":null},{"term":"Management group","definition":"A container above subscriptions, used to apply policy and access to many subscriptions at once.","post":null},{"term":"Resource lock","definition":"A CanNotDelete or ReadOnly setting on an Azure resource, resource group or subscription that applies to everyone, including Owners.","post":"https://azureblog.co.uk/posts/azure-resource-locks/"},{"term":"Private endpoint","definition":"A network interface with a private IP in your virtual network that connects to a PaaS service, such as Storage or Key Vault, over Azure's backbone.","post":"https://azureblog.co.uk/posts/private-endpoints-dns/"},{"term":"CSPM","definition":"Cloud security posture management: continuously assessing cloud resources for misconfigurations. Defender for Cloud includes a free and a paid CSPM plan.","post":"https://azureblog.co.uk/posts/defender-cspm-at-scale/"},{"term":"Key Vault","definition":"Azure's service for storing secrets, keys and certificates, with access controlled by Azure RBAC or legacy access policies.","post":"https://azureblog.co.uk/posts/key-vault-rbac-vs-access-policies/"},{"term":"Access review","definition":"An Entra ID P2 and ID Governance feature that asks reviewers to confirm whether people still need access to a group, app or role, and can remove them automatically.","post":"https://azureblog.co.uk/posts/guest-access-reviews/"},{"term":"Lifecycle Workflows","definition":"Entra ID Governance automation for joiner, mover and leaver tasks, such as issuing a Temporary Access Pass or removing group memberships.","post":null},{"term":"AADSTS error","definition":"The prefix for Entra ID sign-in error codes, such as AADSTS50105. Look them up with this site's AADSTS tool.","post":null},{"term":"Primary Refresh Token (PRT)","definition":"A long-lived token issued to a user on an Entra joined, hybrid joined or registered device. It gives single sign-on to apps and carries the device identity that Conditional Access checks.","post":null},{"term":"Continuous access evaluation (CAE)","definition":"Lets supporting apps, such as Exchange Online and SharePoint, reject an access token early when something important changes, for example the user is disabled or moves to an untrusted network.","post":null},{"term":"Access token","definition":"A short-lived token an app presents to an API, such as Microsoft Graph, to prove what it's allowed to do. Entra access tokens are JWTs, typically valid for around an hour.","post":"https://azureblog.co.uk/posts/configurable-token-lifetimes-ga/"},{"term":"Refresh token","definition":"A longer-lived token an app uses to get new access tokens without the user signing in again. Revoking sessions invalidates refresh tokens.","post":"https://azureblog.co.uk/posts/configurable-token-lifetimes-ga/"},{"term":"ID token","definition":"A token from OpenID Connect that tells an app who signed in. It's for the app itself, not for calling APIs.","post":null},{"term":"OAuth 2.0","definition":"The authorisation standard behind Entra's app permissions and tokens: an app asks for access, a user or admin consents, and the app receives tokens.","post":null},{"term":"Tenant","definition":"A dedicated instance of Entra ID for one organisation, with its own users, groups, apps and settings, identified by a tenant ID.","post":null},{"term":"User principal name (UPN)","definition":"A user's sign-in name in the format name@domain, such as jane.doe@contoso.com. Usually, but not always, the same as their email address.","post":null},{"term":"Hard match","definition":"Joining an on-premises AD user to an existing cloud user by matching the sync anchor (ImmutableId). Sync can no longer hard match to cloud users who hold Entra roles.","post":"https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/"},{"term":"Soft match","definition":"Joining an on-premises AD user to an existing cloud user by matching the user principal name or primary SMTP address.","post":"https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/"},{"term":"Password hash sync (PHS)","definition":"Entra Connect or Cloud Sync copies a hash of each user's on-premises password hash to Entra ID, so users sign in to the cloud with the same password.","post":null},{"term":"Pass-through authentication (PTA)","definition":"Cloud sign-ins are checked against on-premises Active Directory in real time by lightweight agents, so no password hashes are stored in the cloud.","post":null},{"term":"Federation (AD FS)","definition":"Entra ID hands sign-in for a domain to another identity provider, traditionally AD FS on-premises. Many organisations are moving away from it to cloud authentication.","post":null},{"term":"Seamless SSO","definition":"Signs users on domain-joined PCs into cloud apps automatically using Kerberos, without a password prompt, when they're on the corporate network.","post":null},{"term":"Cloud Kerberos trust","definition":"A Windows Hello for Business deployment model where Entra ID issues Kerberos tickets so users can reach on-premises resources without certificates.","post":null},{"term":"Self-service password reset (SSPR)","definition":"Lets users reset their own password after proving who they are with registered methods. With password writeback, the reset also reaches on-premises AD.","post":null},{"term":"Password writeback","definition":"Sends password changes and resets made in the cloud back to on-premises Active Directory. Needs Entra ID P1.","post":null},{"term":"Security defaults","definition":"A free, preconfigured set of protections: MFA registration for everyone, MFA when needed, and blocking legacy authentication. Turn it off when you move to Conditional Access.","post":null},{"term":"ID Protection","definition":"Entra's risk engine. It scores users and sign-ins for risk, such as leaked credentials or unfamiliar sign-in properties, so Conditional Access can respond. Needs P2.","post":null},{"term":"User risk","definition":"How likely it is that an account is compromised, for example because its credentials were found leaked. A common response is to require a secure password change.","post":null},{"term":"Sign-in risk","definition":"How likely it is that a particular sign-in isn't from the account owner, for example from an anonymous IP address. A common response is to require MFA.","post":null},{"term":"Entitlement management","definition":"Bundles groups, apps and sites into access packages that people request, get approved for and lose automatically when the assignment expires.","post":null},{"term":"Administrative unit","definition":"A container for users, groups or devices that lets you scope admin roles, for example letting a regional helpdesk reset passwords only for its own users.","post":null},{"term":"Custom security attributes","definition":"Business-specific attributes you define on users, apps and agents, with their own permissions. Conditional Access and app filters can target them.","post":null},{"term":"Role-assignable group","definition":"A group that can hold Entra roles. Its membership can only be managed by Global Administrators, Privileged Role Administrators and the group's owners.","post":"https://azureblog.co.uk/posts/entra-soc-identity-responder-role/"},{"term":"Dynamic group","definition":"A group whose membership is calculated from a rule on user or device properties, such as department or operating system. Needs Entra ID P1.","post":null},{"term":"Cross-tenant access settings","definition":"Controls for B2B collaboration and B2B direct connect with other Entra tenants, including whether to trust their MFA and device claims.","post":null},{"term":"Microsoft Entra External ID","definition":"Microsoft's identity platform for people outside your organisation: B2B collaboration with partners and customer identity for your apps.","post":null},{"term":"Microsoft Authenticator","definition":"Microsoft's sign-in app. It supports push notifications with number matching, passwordless phone sign-in, passkeys and one-time codes.","post":null},{"term":"Number matching","definition":"Authenticator push notifications ask the user to type the number shown on the sign-in screen, which stops accidental approvals of MFA fatigue attacks.","post":null},{"term":"OATH token","definition":"A one-time code generator, either an app or a hardware key fob, used as an MFA method. Not phishing-resistant.","post":null},{"term":"Certificate-based authentication (CBA)","definition":"Signing in with a certificate on a smart card or device. The multifactor form counts as phishing-resistant.","post":null},{"term":"Device code flow","definition":"A sign-in method for devices without a browser: the user enters a code on another device. Attackers abuse it for phishing, so block it where it isn't needed.","post":null},{"term":"Token protection","definition":"Binds sign-in session tokens to the device they were issued to, so a stolen token can't be replayed elsewhere.","post":null},{"term":"Global Administrator","definition":"The most powerful Entra role, with access to everything. Microsoft recommends having fewer than five, all managed through PIM, plus break-glass accounts.","post":"https://azureblog.co.uk/posts/break-glass-accounts-done-right/"},{"term":"Global Reader","definition":"A read-only role that can see everything a Global Administrator can, but change nothing. Ideal for audits and health checks.","post":null},{"term":"Enterprise application","definition":"The Entra portal's name for a service principal: the app as it exists in your tenant, where you set up SSO, assignments and consent.","post":"https://azureblog.co.uk/posts/saml-certificate-rollover/"},{"term":"Admin consent","definition":"An administrator approving an app's permission request for the whole organisation. Needed for application permissions and higher-risk delegated permissions.","post":"https://azureblog.co.uk/posts/admin-consent-workflow-and-user-consent/"},{"term":"Delegated permission","definition":"An app permission used on behalf of a signed-in user. The app can only do what both the permission and the user allow.","post":"https://azureblog.co.uk/posts/admin-consent-workflow-and-user-consent/"},{"term":"Application permission","definition":"An app permission used without a signed-in user, for example by a background script. It applies across the tenant, so grant it carefully.","post":"https://azureblog.co.uk/posts/graph-powershell-app-only-certificate/"},{"term":"Client secret","definition":"A password-like credential on an app registration. Certificates or federated credentials are safer, and secrets need tracking before they expire.","post":"https://azureblog.co.uk/posts/find-expiring-app-secrets-graph/"},{"term":"Company Portal","definition":"Intune's app for users: enrol devices, install available apps, check compliance and get help.","post":null},{"term":"Enrolment Status Page","definition":"The Windows setup screen that shows Intune apps and policies installing and can hold the user until required items are in place.","post":null},{"term":"Co-management","definition":"Managing Windows devices with Configuration Manager and Intune at the same time, moving workloads to Intune one by one.","post":null},{"term":"Settings Catalog","definition":"Intune's searchable list of thousands of device settings, used to build configuration profiles.","post":null},{"term":"Security baseline","definition":"A Microsoft-recommended group of security settings, such as the Windows baseline, deployed through Intune. New versions don't update existing profiles automatically.","post":"https://azureblog.co.uk/posts/intune-september-2026-roundup/"},{"term":"Assignment filter","definition":"A rule that narrows an Intune assignment to devices with certain properties, such as OS version or ownership, without making new groups.","post":null},{"term":"Scope tag","definition":"Limits which Intune objects an admin can see, used with Intune roles to delegate, for example, to a regional IT team.","post":null},{"term":"Endpoint Privilege Management","definition":"Lets standard users run approved tasks with admin rights, so they don't need to be local administrators.","post":"https://azureblog.co.uk/posts/intune-suite-in-m365-e3-e5/"},{"term":"Remote Help","definition":"Intune's remote assistance tool for helpdesk staff, with role-based access and session reporting.","post":"https://azureblog.co.uk/posts/intune-august-2026-roundup/"},{"term":"Microsoft Defender for Endpoint","definition":"Microsoft's endpoint detection and response platform. Its device risk score can feed Intune compliance.","post":null},{"term":"Azure subscription","definition":"A billing and management boundary for Azure resources. It sits under a management group and contains resource groups.","post":null},{"term":"Resource group","definition":"A container for Azure resources that share a lifecycle, such as an app and its database. Policy, locks and access can be applied at this level.","post":null},{"term":"Azure Resource Manager (ARM)","definition":"The management layer behind the portal, CLI, PowerShell and templates. Locks, policy and RBAC all apply to requests that go through it.","post":null},{"term":"Landing zone","definition":"A pre-built Azure environment, with networking, identity, policy and monitoring in place, that workloads are deployed into.","post":null},{"term":"Hub and spoke","definition":"A network design with shared services, such as firewalls, DNS and gateways, in a hub virtual network, and workloads in peered spokes.","post":"https://azureblog.co.uk/posts/private-endpoints-dns/"},{"term":"Virtual network (VNet)","definition":"An isolated private network in Azure, divided into subnets, where VMs and private endpoints live.","post":null},{"term":"Network security group (NSG)","definition":"Allow and deny rules for traffic to and from subnets or network interfaces.","post":null},{"term":"DNS Private Resolver","definition":"An Azure service that lets on-premises DNS resolve private DNS zones in Azure, and Azure resolve on-premises names, without running DNS servers.","post":"https://azureblog.co.uk/posts/private-endpoints-dns/"},{"term":"Azure Bastion","definition":"A managed service for RDP and SSH to VMs through the browser or native client, without public IP addresses on the VMs.","post":null},{"term":"Microsoft Sentinel","definition":"Microsoft's cloud SIEM, built on Log Analytics, for collecting logs, detecting threats and responding to incidents.","post":null},{"term":"Diagnostic settings","definition":"Configuration that sends a resource's or Entra ID's logs and metrics to Log Analytics, a storage account or an event hub.","post":null},{"term":"Azure Resource Graph","definition":"A fast query service for inventory across subscriptions, using KQL against tables such as resources and securityresources.","post":null},{"term":"Azure Arc","definition":"Extends Azure management, such as policy, monitoring and updates, to servers and Kubernetes clusters outside Azure.","post":null},{"term":"Policy initiative","definition":"A group of Azure Policy definitions assigned together, with shared parameters and a single compliance score.","post":"https://azureblog.co.uk/posts/azure-policy-allowed-locations-and-guardrails/"},{"term":"Remediation task","definition":"Applies a Modify or DeployIfNotExists policy to resources that already existed before the policy was assigned.","post":"https://azureblog.co.uk/posts/azure-policy-allowed-locations-and-guardrails/"}]}