# Tenancy and Identity Glossary

> 39 terms from the Workplace & Collaboration book's Tenancy and Identity part, each defined in a line and linked to the chapter that explains it.

- **Access review:** A periodic check, often scoped to guests or external users, of whether each person still needs the access they hold ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#three-models-for-an-outsider)).
- **Administrative unit:** A Microsoft Entra container that scopes an admin role to a subset of users, groups or devices, for regional or departmental admins ([Admin Consoles & Policies](https://www.syntaqx.com/books/workplace-and-collaboration/admin-consoles-and-policies#microsoft-entra-id)).
- **Advanced Data Residency:** A Microsoft 365 add-on that commits data at rest to a single-country local region geography and extends residency to more services, covering all paid licenses in the tenant ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#microsoft-s-eu-data-boundary-multi-geo-and-advanced-data-residency)).
- **Anyone-with-the-link sharing:** A share link that grants access to whoever holds the URL, without signing in, acting as a bearer credential ([Permissions & Sharing](https://www.syntaqx.com/books/workplace-and-collaboration/permissions-and-sharing#link-sharing)).
- **Approved domains:** A Slack setting that lets anyone with an email address on listed domains join a workspace without an invitation ([Tenants, Workspaces & Organizations](https://www.syntaqx.com/books/workplace-and-collaboration/tenants-and-workspaces#finding-and-joining-a-workspace)).
- **B2B direct connect:** A Microsoft Entra mutual trust between two tenants that lets each side's users join Teams shared channels with their home accounts, without guest objects ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#trust-between-two-admins)).
- **Break-glass account:** An emergency admin account that can sign in when the identity provider or normal admin paths fail, kept few, protected by a phishing-resistant factor and alarmed ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#who-can-still-sign-in-when-the-identity-provider-is-down)).
- **Claiming accounts:** Moving accounts on a verified domain from personal control to an organization's management, as a step separate from verifying the domain ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#managed-versus-personal-accounts)).
- **CLOUD Act:** The US law (18 U.S.C. 2713) requiring providers to disclose data in their possession, custody or control regardless of where it is stored ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#sovereignty-beyond-location)).
- **Conditional Access:** Microsoft Entra's policy engine that evaluates user, location, device, app and risk signals at sign-in and blocks or grants access with requirements such as MFA ([Admin Consoles & Policies](https://www.syntaqx.com/books/workplace-and-collaboration/admin-consoles-and-policies#signals-and-conditions)).
- **Conflicting account:** A personal Google account created with a company address that collides with the managed account an admin wants to create ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#managed-versus-personal-accounts)).
- **Context-aware access:** Google Workspace policies that limit app access by IP range, device state, operating system and geographic origin ([Admin Consoles & Policies](https://www.syntaqx.com/books/workplace-and-collaboration/admin-consoles-and-policies#signals-and-conditions)).
- **Cross-tenant access settings:** Microsoft Entra's inbound, outbound and trust settings that govern how users of another tenant may collaborate with yours ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#trust-between-two-admins)).
- **Data Privacy Framework:** The EU-US framework whose July 10, 2023 adequacy decision allows personal data transfers to US organizations, upheld by the General Court in Latombe in September 2025 ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#the-transfer-law)).
- **Data residency:** A vendor commitment to store specified categories of customer data at rest in a chosen region, with other categories explicitly excluded ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#what-residency-covers)).
- **Deactivation:** Reversibly stopping a member's access (sessions, tokens, channels) while keeping their account, roles and authored content ([Provisioning, SCIM & Offboarding](https://www.syntaqx.com/books/workplace-and-collaboration/provisioning-and-scim#deactivation-versus-deletion)).
- **Domain capture:** Figma's automatic addition of people with a company email, existing accounts and new sign-ups, to the organization as members ([Tenants, Workspaces & Organizations](https://www.syntaqx.com/books/workplace-and-collaboration/tenants-and-workspaces#notion-and-figma-organizations-over-workspaces-and-teams)).
- **Domain verification:** Proving control of an email domain, usually with a DNS TXT record, as the root of trust for claiming and capturing accounts ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#proving-the-domain)).
- **EU Data Boundary:** Microsoft's commitment, completed February 2025, to store and process customer data, pseudonymized personal data and support data for its enterprise cloud services in the EU and EFTA ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#microsoft-s-eu-data-boundary-multi-geo-and-advanced-data-residency)).
- **External access:** Teams federation that lets users find, chat with and call people in other organizations without guest accounts ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#three-models-for-an-outsider)).
- **External user:** In Atlassian, any account the organization doesn't manage, including unclaimed accounts on its own domain ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#sharing-files-and-pages-with-outsiders)).
- **Guest:** An outsider given an account or access inside the host's tenant under the host's rules, often limited to one container and set to expire ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#three-models-for-an-outsider)).
- **Joiner-mover-leaver:** The HR-driven identity life cycle of hires, transfers and terminations that provisioning carries from the HR system to every app ([Provisioning, SCIM & Offboarding](https://www.syntaqx.com/books/workplace-and-collaboration/provisioning-and-scim#joiner-mover-leaver)).
- **Just-in-time provisioning:** Creating an account the first time a person signs in through SSO, which admits people but never removes them ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#enforcing-single-sign-on)).
- **Managed account:** An account an organization controls (edits, deactivates, applies sign-in policy to) after verifying its domain and claiming it ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#managed-versus-personal-accounts)).
- **Multi-Geo:** A Microsoft 365 add-on that stores each user's data in a chosen geography within one tenant, through a preferred data location ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#microsoft-s-eu-data-boundary-multi-geo-and-advanced-data-residency)).
- **Multitenant organization:** A Microsoft Entra grouping of up to 100 tenants one company owns, joined by each tenant's admin as equals ([Tenants, Workspaces & Organizations](https://www.syntaqx.com/books/workplace-and-collaboration/tenants-and-workspaces#microsoft-365-one-tenant-and-then-several)).
- **Organizational unit:** A node in Google Workspace's settings tree; each user belongs to one, and settings inherit from parent to child unless overridden ([Tenants, Workspaces & Organizations](https://www.syntaqx.com/books/workplace-and-collaboration/tenants-and-workspaces#google-workspace-one-customer-organizational-units)).
- **Privileged Identity Management:** Microsoft Entra's just-in-time elevation, where admins hold eligible roles and activate them for a limited time, optionally with approval ([Admin Consoles & Policies](https://www.syntaqx.com/books/workplace-and-collaboration/admin-consoles-and-policies#just-in-time-elevation)).
- **Profile source:** In Okta, the one system authoritative for a user's identity attributes, such as an HR system ([Provisioning, SCIM & Offboarding](https://www.syntaqx.com/books/workplace-and-collaboration/provisioning-and-scim#okta)).
- **Relationship-based access control (ReBAC):** Authorization stored as relationship tuples between users and objects, with inheritance expressed as schema rules, as in Zanzibar, OpenFGA and SpiceDB ([Permissions & Sharing](https://www.syntaqx.com/books/workplace-and-collaboration/permissions-and-sharing#zanzibar-and-relationship-based-access-control)).
- **Schrems II:** The July 16, 2020 Court of Justice judgment (C-311/18) that invalidated the EU-US Privacy Shield and kept standard contractual clauses valid with verification duties ([Data Residency & Sovereignty](https://www.syntaqx.com/books/workplace-and-collaboration/data-residency-and-sovereignty#the-transfer-law)).
- **SCIM:** The IETF standard (RFC 7643 and 7644) through which identity providers create, update, deactivate and group users in apps ([Provisioning, SCIM & Offboarding](https://www.syntaqx.com/books/workplace-and-collaboration/provisioning-and-scim#scim-2-0)).
- **Security defaults:** Microsoft Entra's free baseline that requires MFA registration, MFA for admins and blocks legacy authentication ([SSO, Domains & Managed Accounts](https://www.syntaqx.com/books/workplace-and-collaboration/sso-and-managed-accounts#mfa-policy)).
- **Shared channel:** One channel hosted by two or more organizations at once, such as Slack Connect channels and Teams shared channels ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#three-models-for-an-outsider)).
- **Slack Connect:** Slack's shared channels and DMs between organizations, with each organization's settings governing its own members' messages ([Guests & Cross-Org Collaboration](https://www.syntaqx.com/books/workplace-and-collaboration/guests-and-external-collaboration#who-owns-shared-content)).
- **System role:** A Slack admin role carved out for one job, such as Legal Holds Admin, Export Admin or Users Admin ([Admin Consoles & Policies](https://www.syntaqx.com/books/workplace-and-collaboration/admin-consoles-and-policies#slack)).
- **Tenant isolation:** Guaranteeing one customer's data can't reach another's, across primary stores, indexes, caches and exports ([Tenants, Workspaces & Organizations](https://www.syntaqx.com/books/workplace-and-collaboration/tenants-and-workspaces#tenant-isolation)).
- **Zookie:** Zanzibar's opaque consistency token encoding a timestamp, stored with a content version so later permission checks for it run on a snapshot at least that fresh ([Permissions & Sharing](https://www.syntaqx.com/books/workplace-and-collaboration/permissions-and-sharing#zanzibar-and-relationship-based-access-control)).

---

Canonical URL: https://www.syntaqx.com/books/workplace-and-collaboration/glossary/tenancy-and-identity