Glossary
Terms used throughout the portal and this guide. Where a term has a dedicated guide page, the entry links to it.
| Term | Meaning |
|---|---|
| Organisation | The top-level administrative unit in the portal. It owns users, resources, connectors, policies, and billing. Administrators belong to an organisation. See Organisation overview. |
| Sub-organisation | A child organisation under a parent. Useful for separating departments, tenants, or partners while keeping central administration. See Sub-organisations. |
| User | A person (or service account) that can authenticate and access resources. See Users. |
| Group | A collection of users used to grant permissions and policies in bulk. See Groups. |
| Resource group | A grouping of resources, used with permissions and policies so you can control access to many resources at once. See Resource groups. |
| Service account | A non-human identity used by software, automation, or the API. See Service accounts. |
| Resource | Anything you expose through the platform: a web application, file share, desktop, database, SSH service, launcher, or network. See Resources. |
| Application | A web application exposed through the identity-aware proxy. See Applications. |
| Connector | Software at your site that links your local resources to the Agilicus cloud over an outbound-only connection. See Connectors. |
| Identity-aware proxy | The cloud component that authenticates users and forwards requests to the right connector. See Zero trust architecture. |
| Identity provider | An external service that authenticates your users (Google, Microsoft, Apple, Active Directory, Yahoo, or a custom OpenID Connect provider). See Identity and authentication. |
| Shared identity | A built-in identity provider shared across Agilicus organisations. |
| Custom identity | A custom identity provider you register with a third party (for example an Azure application registration). |
| Onsite identity | An identity provider you run on your own site, used when user credentials must not leave your network. |
| Application identity | An identity provider scoped to a specific application. |
| Authentication policy | Rules that control which identity providers may be used, and which authentication methods (including multi-factor authentication) are required. See Authentication policy. |
| Single sign-on | Users authenticate once with their existing corporate credentials and are recognised across resources. |
| Multi-factor authentication | An authentication method requiring more than one factor (for example a password plus a one-time code). |
| Policy | A set of rules (for example geolocation or firewall rules) applied to users or resources. See Policies. |
| Permission | A specific right granted to a user or group for a resource or application (for example read-only, read/write, or a named application role). See Permissions. |
| Label | A tag you can attach to resources and other objects to organise them and drive policies and permissions. See Labels. |
| API key | A credential for programmatic access to the Agilicus API. See API keys. |
| Launcher | A small application installed on a user’s desktop that enables access to resources (for example SSH, databases, or file shares) outside the browser. See Launchers. |
| Share | A directory exposed over HTTPS and WebDAV for browsers and desktops. See Shares. |
| Desktop | A remote desktop exposed through the platform as a remote desktop gateway. See Desktops. |
| Network | A global resource (usually a TCP service such as a database or an internal service) available to applications running on the platform. See Networks. |
| Audit | The record of authentication events, authorisation decisions, and sessions. See Audit and diagnostics. |
| Audit destination | Where audit events are delivered (for example a SIEM or a log service). See Audit destinations. |
| Session | An authenticated period of access by a user or token. See Sessions. |
| CNAME | A DNS record type used to point your own domain at the Agilicus service. |
| Outbound-only connection | A connection initiated by your connector to the cloud; nothing is initiated inbound. |
| SIEM | Security information and event management: a service that collects logs for security analysis. |