Microsoft 365 security glossary

A

ANSSI

Agence nationale de la sécurité des systèmes d'information, the French national cybersecurity agency. It publishes recommendations for securing information systems, including the IT hygiene guide used as a framework by the audit.

B

B2B

Business-to-Business: mechanism for inviting external users (guests) into a Microsoft 365 tenant.

Break-glass

Emergency access administrator account, excluded from Conditional Access policies, reserved for restoring access in the event of a widespread MFA or Conditional Access lockout.

C

CIS Benchmark

Internationally recognised secure configuration framework from the Center for Internet Security, with a version for Microsoft 365 in levels L1 and L2.

Conditional Access (CA)

Entra ID rules that allow, block or strengthen a sign-in depending on context: user, device, location, risk level.

Cross-tenant access

Entra ID settings that govern collaboration and trust (MFA, devices, consent) between your tenant and external tenants.

D

DKIM

DomainKeys Identified Mail: cryptographic signature of outgoing emails, whose key is published in DNS. It guarantees the integrity of the message and the authenticity of the sender.

DMARC

Domain-based Message Authentication, Reporting and Conformance: DNS policy (p=none, quarantine or reject) that tells receiving servers how to handle an email that fails SPF and DKIM. Test your domain's DMARC.

E

Entra ID

Microsoft 365's cloud identity and directory service, formerly Azure Active Directory.

Entra ID P1

Entra ID Premium P1 licence level, included in Microsoft 365 Business Premium and E3 among others. It is required for Conditional Access, named locations and MFA registration reports.

L

Legacy authentication

Older authentication protocols (IMAP, POP3, SMTP AUTH, EWS with basic authentication) that do not support MFA. They remain a prime target for password spraying.

M

MDO

Microsoft Defender for Office 365: advanced protection for email and collaboration (Safe Links, Safe Attachments, enhanced anti-phishing).

MFA

Multi-Factor Authentication: a password plus a second factor (app, physical key, SMS). It prevents an account from being compromised through password theft alone.

N

Named location

IP address range or list of countries defined in Entra ID, used as a condition in Conditional Access policies.

O

OAuth

Authorisation protocol that allows a third-party application to access Microsoft 365 data with the consent of a user or an administrator.

OneDrive

Microsoft 365's personal file storage service, built on SharePoint.

P

PHS

Password Hash Synchronization: synchronises a hash of the on-premises Active Directory password to Entra ID, to enable cloud authentication and leaked credential detection.

Q

Quarantine

Holding area for emails considered unwanted or dangerous, awaiting review or release by an administrator or the user.

R

ROPC

Resource Owner Password Credential: OAuth flow in which the password is sent directly to the authentication service. A classic vector for password spraying.

S

Safe Attachments

Defender for Office 365 feature that opens attachments in an isolated environment before delivery, to detect unknown malware.

Safe Links

Defender for Office 365 feature that checks links in emails and documents at the time of the click, including links that became malicious after delivery.

Secure Score

Microsoft security score (from 0 to 100%) that measures a tenant's posture against Microsoft's recommendations. See Secure Score or Sentinel Audit365.

Service account

Non-human account dedicated to an application or automation. A prime target, as it often has elevated rights and is rarely subject to MFA.

Shared mailbox

Exchange mailbox without a dedicated licence, accessible by several users (for example contact@ or support@). It should not allow interactive sign-in.

SharePoint Online

Microsoft 365's collaboration and document storage platform.

SMTP AUTH

Sending emails with password authentication, a legacy protocol that does not support MFA. To be disabled, unless there is a justified application need.

SPF

Sender Policy Framework: DNS record that lists the servers authorised to send email for a domain. It limits sender spoofing.

T

Tenant

An organisation's dedicated instance in Microsoft 365 and Entra ID, isolated from other organisations. It is the scope of the audit.

U

UPN

User Principal Name: a user's sign-in identifier, usually in the format of an email address (firstname.lastname@domain).