Workplace & CollaborationWorkplace & Collaboration GlossaryPart 2 of 11
Tenancy and Identity Glossary
39 terms from the Workplace & Collaboration book's Tenancy and Identity part, each defined in a line and linked to the chapter that explains it.
- Access review: A periodic check, often scoped to guests or external users, of whether each person still needs the access they hold (Guests & Cross-Org Collaboration).
- Administrative unit: A Microsoft Entra container that scopes an admin role to a subset of users, groups or devices, for regional or departmental admins (Admin Consoles & Policies).
- Advanced Data Residency: A Microsoft 365 add-on that commits data at rest to a single-country local region geography and extends residency to more services, covering all paid licenses in the tenant (Data Residency & Sovereignty).
- Anyone-with-the-link sharing: A share link that grants access to whoever holds the URL, without signing in, acting as a bearer credential (Permissions & Sharing).
- Approved domains: A Slack setting that lets anyone with an email address on listed domains join a workspace without an invitation (Tenants, Workspaces & Organizations).
- B2B direct connect: A Microsoft Entra mutual trust between two tenants that lets each side's users join Teams shared channels with their home accounts, without guest objects (Guests & Cross-Org Collaboration).
- Break-glass account: An emergency admin account that can sign in when the identity provider or normal admin paths fail, kept few, protected by a phishing-resistant factor and alarmed (SSO, Domains & Managed Accounts).
- Claiming accounts: Moving accounts on a verified domain from personal control to an organization's management, as a step separate from verifying the domain (SSO, Domains & Managed Accounts).
- CLOUD Act: The US law (18 U.S.C. 2713) requiring providers to disclose data in their possession, custody or control regardless of where it is stored (Data Residency & Sovereignty).
- Conditional Access: Microsoft Entra's policy engine that evaluates user, location, device, app and risk signals at sign-in and blocks or grants access with requirements such as MFA (Admin Consoles & Policies).
- Conflicting account: A personal Google account created with a company address that collides with the managed account an admin wants to create (SSO, Domains & Managed Accounts).
- Context-aware access: Google Workspace policies that limit app access by IP range, device state, operating system and geographic origin (Admin Consoles & Policies).
- Cross-tenant access settings: Microsoft Entra's inbound, outbound and trust settings that govern how users of another tenant may collaborate with yours (Guests & Cross-Org Collaboration).
- Data Privacy Framework: The EU-US framework whose July 10, 2023 adequacy decision allows personal data transfers to US organizations, upheld by the General Court in Latombe in September 2025 (Data Residency & Sovereignty).
- Data residency: A vendor commitment to store specified categories of customer data at rest in a chosen region, with other categories explicitly excluded (Data Residency & Sovereignty).
- Deactivation: Reversibly stopping a member's access (sessions, tokens, channels) while keeping their account, roles and authored content (Provisioning, SCIM & Offboarding).
- Domain capture: Figma's automatic addition of people with a company email, existing accounts and new sign-ups, to the organization as members (Tenants, Workspaces & Organizations).
- Domain verification: Proving control of an email domain, usually with a DNS TXT record, as the root of trust for claiming and capturing accounts (SSO, Domains & Managed Accounts).
- EU Data Boundary: Microsoft's commitment, completed February 2025, to store and process customer data, pseudonymized personal data and support data for its enterprise cloud services in the EU and EFTA (Data Residency & Sovereignty).
- External access: Teams federation that lets users find, chat with and call people in other organizations without guest accounts (Guests & Cross-Org Collaboration).
- External user: In Atlassian, any account the organization doesn't manage, including unclaimed accounts on its own domain (Guests & Cross-Org Collaboration).
- Guest: An outsider given an account or access inside the host's tenant under the host's rules, often limited to one container and set to expire (Guests & Cross-Org Collaboration).
- Joiner-mover-leaver: The HR-driven identity life cycle of hires, transfers and terminations that provisioning carries from the HR system to every app (Provisioning, SCIM & Offboarding).
- Just-in-time provisioning: Creating an account the first time a person signs in through SSO, which admits people but never removes them (SSO, Domains & Managed Accounts).
- Managed account: An account an organization controls (edits, deactivates, applies sign-in policy to) after verifying its domain and claiming it (SSO, Domains & Managed Accounts).
- Multi-Geo: A Microsoft 365 add-on that stores each user's data in a chosen geography within one tenant, through a preferred data location (Data Residency & Sovereignty).
- Multitenant organization: A Microsoft Entra grouping of up to 100 tenants one company owns, joined by each tenant's admin as equals (Tenants, Workspaces & Organizations).
- Organizational unit: A node in Google Workspace's settings tree; each user belongs to one, and settings inherit from parent to child unless overridden (Tenants, Workspaces & Organizations).
- Privileged Identity Management: Microsoft Entra's just-in-time elevation, where admins hold eligible roles and activate them for a limited time, optionally with approval (Admin Consoles & Policies).
- Profile source: In Okta, the one system authoritative for a user's identity attributes, such as an HR system (Provisioning, SCIM & Offboarding).
- Relationship-based access control (ReBAC): Authorization stored as relationship tuples between users and objects, with inheritance expressed as schema rules, as in Zanzibar, OpenFGA and SpiceDB (Permissions & Sharing).
- Schrems II: The July 16, 2020 Court of Justice judgment (C-311/18) that invalidated the EU-US Privacy Shield and kept standard contractual clauses valid with verification duties (Data Residency & Sovereignty).
- SCIM: The IETF standard (RFC 7643 and 7644) through which identity providers create, update, deactivate and group users in apps (Provisioning, SCIM & Offboarding).
- Security defaults: Microsoft Entra's free baseline that requires MFA registration, MFA for admins and blocks legacy authentication (SSO, Domains & Managed Accounts).
- Shared channel: One channel hosted by two or more organizations at once, such as Slack Connect channels and Teams shared channels (Guests & Cross-Org Collaboration).
- Slack Connect: Slack's shared channels and DMs between organizations, with each organization's settings governing its own members' messages (Guests & Cross-Org Collaboration).
- System role: A Slack admin role carved out for one job, such as Legal Holds Admin, Export Admin or Users Admin (Admin Consoles & Policies).
- Tenant isolation: Guaranteeing one customer's data can't reach another's, across primary stores, indexes, caches and exports (Tenants, Workspaces & Organizations).
- Zookie: Zanzibar's opaque consistency token encoding a timestamp, stored with a content version so later permission checks for it run on a snapshot at least that fresh (Permissions & Sharing).