# Analysis of Azure Zero Trust Architecture Implementation for Mid-Size Organizations
## Appendix A Glossary of Frequently Used Technical Terms and Abbreviations
Users can access various apps and systems without re-authenticating by signing in once. SSO simplifies login processes and reduces password fatigue. **Authentication Fatigue:** A phenomenon where users become frustrated with frequent prompts for login or re-authentication. This fatigue often leads to poor user experience and increased helpdesk requests--strategies like passwordless authentication and risk-based Conditional Access help to reduce authentication fatigue. **Phishing:** A social engineering attack where attackers trick users into providing sensitive information, such as usernames, passwords, or financial details, typically through fraudulent emails, messages, or websites. Phishing is one of the most common entry points for cyberattacks. **User Risk:** A measure of the likelihood that a specific user's credentials have been compromised or that they are engaging in risky behavior. Azure Conditional Access policies evaluate user risk in real-time and may prompt users to re-authenticate or complete MFA if abnormal activity is detected. **Device Health:** Measures a device's security posture, such as compliance with organizational security policies. Devices that fail to meet security criteria (e.g., unpatched systems or missing antivirus) may be denied access or subjected to stricter Conditional Access policies. **Administrative Privileges:** High-level permissions that allow users to configure, modify, or manage critical system components. Unrestricted administrative privileges are a security risk, which is why ZTA principles recommend using JIT access and PIM to limit administrator access to only what is needed for a limited time. **Security Posture:** The overall strength of an organization's cybersecurity defenses. It reflects the organization's readiness to detect, prevent, and respond to cyber threats. Security posture is assessed through continuous monitoring, risk assessment, and vulnerability scanning. **Data Governance:** A set of policies and procedures to ensure data are appropriately managed, stored, and protected. Data governance tools like Microsoft Purview help organizations manage sensitive data, ensure regulatory compliance, and enforce access controls across cloud and on-premises environments. **Security Incident:** Any event that may compromise information's confidentiality, integrity, or availability (CIA). Examples include malware infections, insider threats, privilege misuse, and breaches. Incident response plans are essential for mitigating the impact of such events. **Compliance:** Adhering to legal, regulatory, and organizational policies regarding security, privacy, and data protection. Common compliance standards include GDPR, ISO 27001, and NIST CSF. Adopting ZTA helps organizations demonstrate compliance with these standards. **Cloud-Native Applications:** These applications are designed to run on cloud infrastructure rather than traditional on-premises environments. They leverage microservices, containers, and dynamic scaling, requiring access controls and security policies that adapt to cloud-specific risks. **Attack surface:** The total number of points where an attacker could attempt to access a system. A smaller attack surface reduces the chances of successful exploitation. JIT access, least privilege, and Conditional Access are key strategies to reduce the attack surface in ZTA.