A “User” is an identity which has a set of authorisations, a set of permissions. A user may be identified by one or more Identity Providers (e.g. Azure Active Directory, Google, Apple, etc.)

Typically a “User” is a person, but it may also be a service account (e.g. for machine to machine connectivity).

A “Group” is a collection of Users or Groups. It behaves the same way as a user: you can assign permissions to it.

An Identity Provider authenticates a user. It may do this with a password, with biometric, or with any trustworthy means. When configuring Agilicus AnyX, you will select one or more Identity Providers (e.g. Microsoft Entra, Google Workspace, Okta, etc). We refer to this as an Upstream Issuer.

Agilicus acts as an Identity Provider for your applications.

A user can be identified and authenticated by an upstream Identity Provider, and then in turn be required to present a second-factor within Agilicus AnyX. This is useful when you have users who are externally managed and you cannot rely on their company to match your own multi-factor compliance needs. You can read more about the rationale and strengths of multi-factor authentication.