Knowledge reference · Terminology
Clear language is the foundation of defensible security architecture. This glossary defines core Identity and Access Management (IAM), Microsoft Entra, access governance and digital trust terminology as applied in modern enterprise and government environments across New Zealand, Australia and the Pacific.
Security failures frequently stem from ambiguous definitions—confusing authentication with authorization, treating access management as identity governance, or conflating basic push MFA with phishing-resistant credentials.
Use these definitions to establish consistent architecture language across your executive, engineering and audit teams.
Terminology reference
Explore definitions, architectural boundaries and links to relevant MAITS consulting services.
The business processes, policies and technologies that manage digital identities and govern user access to an organisation’s applications, data and infrastructure throughout the employment lifecycle.
Explore IAM Strategy & ArchitectureThe capability to govern the complete identity lifecycle (Joiner, Mover, Leaver), manage entitlement assignment, enforce segregation of duties and run recurring access certification reviews for compliance.
Explore Identity Governance (IGA)The specialised cybersecurity discipline focused on safeguarding, controlling, elevating and auditing identities with elevated rights (such as administrators, domain controllers, cloud subscription owners and service accounts).
Explore Privileged Access (PAM)The systems governing external user authentication, self-service registration, privacy consent and account security for citizens, consumers and business customers interacting with public digital services.
Explore Customer Identity (CIAM)Cryptographic credentials based on public-key cryptography that replace passwords with phishing-resistant authentication. Passkeys can be device-bound (stored in hardware security keys or TPM chips) or synchronized across trusted ecosystem devices.
Explore Passkeys & AuthenticationThe zero-trust policy evaluation engine (prominently in Microsoft Entra) that analyzes contextual signals—such as user identity, device compliance, IP location, application sensitivity and real-time risk—before deciding whether to grant, block or challenge access.
Explore Microsoft Entra ConsultingA service in Microsoft Entra that provides time-bound and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access rights on important resources, eliminating standing administrative privilege.
Explore Privileged Access ArchitectureRole-Based Access Control (RBAC) assigns access according to defined job functions. Attribute-Based Access Control (ABAC) evaluates dynamic attributes (such as department, security clearance, location or project) at access time to make granular, contextual authorization decisions.
Explore RBAC & ABAC ArchitectureThe fundamental HR-to-IT identity lifecycle workflows that provision accounts when an employee joins, modify entitlements when they change roles or departments, and reliably deprovision access immediately when they leave the organisation.
Explore Identity Lifecycle ManagementThe foundational security principle stipulating that any user, program, or system process must be granted only the minimum necessary privileges required to complete its legitimate business function, and for no longer than needed.
Explore Security Uplift ConsultingA security model based on the principle of "never trust, always verify". It assumes that threats exist inside and outside the perimeter, requiring explicit verification of every access request, least-privilege enforcement, and assumption of breach.
Explore Zero Trust Security ArchitectureMFA methods (such as FIDO2 passkeys, WebAuthn and Certificate-Based Authentication) where the authentication exchange is cryptographically bound to the specific server origin, making them immune to attacker-in-the-middle (AiTM) relay attacks, SMS interception and prompt bombing.
Explore Phishing-Resistant PasskeysMandatory and recommended guidelines established in Chapter 16 of the New Zealand Information Security Manual, detailing requirements for identification, authentication, multi-factor authentication, privileged account segregation and session management for NZ government and crown entities.
Explore New Zealand Identity ArchitectureThe Australian Cyber Security Centre (ACSC) multi-factor authentication maturity model. Level 1 requires standard MFA for remote access; Level 2 mandates MFA for all users accessing sensitive data; Level 3 mandates phishing-resistant MFA across all corporate systems.
Explore Australian Identity ArchitectureAn open IETF standard protocol (RFC 7643 and RFC 7644) that automates the provisioning, updating and deprovisioning of user accounts and group memberships between identity providers (like Microsoft Entra ID) and downstream SaaS applications.
Explore Identity Integration & ProvisioningA modern token-revocation protocol in Microsoft Entra where applications receive real-time security events (e.g. account termination, password change, user risk increase) and revoke sessions immediately, rather than waiting for OAuth token expiration.
Explore Microsoft Entra ArchitectureStart a conversation
MAITS translates identity concepts into concrete architectures, security controls and governance lifecycles.
