# Analysis of Azure Zero Trust Architecture Implementation for Mid-Size Organizations
## Appendix A Glossary of Frequently Used Technical Terms and Abbreviations  
* A security model that assumes no user, device, or system can be trusted by default. Access is granted based on identity verification, continuous authentication, and adherence to the principle of least privilege. ZTA requires strict access controls, continuous monitoring, and dynamic risk assessment. * A security control mechanism that provides elevated privileges only for a limited, pre-defined period. After completing the task, elevated permissions are automatically revoked, reducing the risk of privilege misuse or abuse. JIT access follows the Zero Trust principle of least privilege. * A tool Azure provides to manage and control elevated or privileged access to critical resources. PIM allows for JIT access, time-based role assignments, and auditing of privileged access activities to reduce insider threats and ensure least-privilege access. * A security feature in Azure that dynamically enforces access policies based on contextual signals such as user location, device health, user risk, and application sensitivity. Conditional Access requires users to pass additional security checks (like Multi-Factor Authentication) when certain risk conditions are met. * A security process that requires users to verify their identity using two or more factors. These factors typically include something the user knows (password), something they have (hardware token, smartphone app), or something they are (biometrics, such as fingerprints). MFA provides an extra layer of security to prevent unauthorized access. * A user authentication method that eliminates the need for traditional passwords. It relies on biometrics (fingerprint, facial recognition), hardware tokens, or one-time passcodes (OTP) sent to a trusted device. This approach reduces the risk of phishing, password reuse, and password-related support requests. * A process that ensures user permissions and access rights align with the least privilege principle. Organizations can detect and remove unnecessary permissions by periodically reviewing user access, reducing the attack surface, and minimizing insider threats. Azure Access Reviews allow automated role and access validation. * A security approach in which users are assigned roles, and their role within the organization determines access to resources. Each role has pre-defined permissions, and users are granted access to only the resources necessary to perform their duties. RBAC supports the least-privilege access model. * A service that authenticates users and verifies their identity before granting access to applications or services. Examples include Azure Entra ID (formerly Azure AD), Google Identity, and Okta. IdPs enable Single Sign-On (SSO) and support MFA and passwordless authentication. * A key security principle where users, devices, and systems are granted the minimum access necessary to complete their tasks. That minimizes the attack surface and limits potential damage in a breach. JIT access and PIM are examples of tools used to enforce this principle. * A record of user actions and changes made within an IT system. Audit trails provide accountability and transparency for system access and administrative activities. They are key in compliance, forensic investigations, and access reviews. * A cloud computing environment that combines on-premises infrastructure with cloud services (like Azure or AWS). Hybrid cloud models enable organizationsto maintain sensitive data on-site while leveraging the flexibility of the cloud for less sensitive workloads. **On-Premises (On-Prem) Environment:** Refers to IT infrastructure hosted on-site at the organization's physical location, as opposed to cloud environments. On-premises systems often require direct control and management of hardware, software, and security, making them familiar in sectors with strict compliance requirements. **Single Sign-On (SSO):** An authentication process that allows users to access multiple applications with a single set of login credentials.