IAM concepts

Identity and access management (IAM) is the set of practices and tools that make sure the right people have the right access to the right systems, and nobody else does. BreezeAuth is an IAM product. This page explains the terms you will meet in the admin console and in the rest of this documentation.

The three big questions

Every IAM system answers three questions:

Authentication and authorization are often confused. A simple way to remember: authentication is showing your badge at the building entrance; authorization is which doors that badge opens.

Identity and sign-in

Identity provider (IdP)

A service that stores identities and confirms them for other applications. BreezeAuth is your identity provider: your applications trust BreezeAuth to tell them who is signing in.

Single sign-on (SSO)

Signing in once, with BreezeAuth, and then opening every connected application without typing another password. BreezeAuth supports the two industry standards for this, SAML 2.0 and OpenID Connect (OIDC).

Multi-factor authentication (MFA)

Requiring a second proof besides the password, such as a code from an authenticator app (TOTP) or a passkey. It stops most attacks that rely on stolen passwords.

Passkey

A modern replacement for passwords, built on the WebAuthn standard. The secret never leaves the person's device, so it cannot be phished.

Your organization and its people

Organization

Your company's space in BreezeAuth. Everything else (users, groups, applications, domains, webhooks) belongs to exactly one organization. Each organization has a unique identifier, which appears as organizationsUuid in technical contexts such as webhook messages.

User

A person who belongs to your organization, with their profile (name, job title, department…), administrative role and status. The same person may belong to more than one organization, with a separate user record in each. Users are listed under Users in the admin console. See Users.

Managed and guest users

Users whose e-mail address is on a domain your organization has verified are managed: they follow your organization's policies. Others, such as partners and vendors, are guests and keep more autonomy over their accounts. See Managed and guest users.

Service user

An identity for a system rather than a person, such as a back-end job that calls the BreezeAuth API. Service users authenticate with credentials (a client ID and secret) instead of a password, and are managed under Users › Service Users. See Service users.

Domain

An internet domain your company owns, such as example.com. You verify ownership by adding a DNS record. Verified domains determine which users are managed. See Domain verification.

Network zone

A named list of IP address ranges representing a network you trust, such as your office or the servers of an integration. Network zones are used to restrict access to the organization or to an application. See Network zones.

Access to applications

Application

A system your people sign in to through BreezeAuth, such as an ERP, a CRM or an internal tool, connected using SAML 2.0 or OIDC.

Group

A named set of users, such as "Finance" or "Engineering". Groups make access easier to manage: instead of granting access person by person, you grant it to the group. Groups can also contain other groups. See Groups.

Group assignment

The link that makes a user, or another group, a member of a group. Adding someone to a group creates a group assignment; removing them deletes it.

Application assignment

The link that gives a user or a group access to an application, optionally with roles and attributes that are sent to the application at sign-in. Removing an assignment removes that access.

Role

A label that tells an application what someone may do inside it, such as "viewer" or "admin". BreezeAuth sends roles to the application; the application decides what each role allows.

Keeping other systems informed

Audit log

A chronological record of what happened in your organization and who did it: sign-ins, configuration changes, users added or removed. Available under Audit Logs. See Audit logs.

Webhook

A notification that BreezeAuth sends to one of your systems, over the internet, as soon as something changes, for example when a user is created or removed from a group. See the webhooks overview.

Event

A single change that BreezeAuth can notify you about, such as membership.created or group_assignment.deleted. The full list is in the event catalog.

API

The programmatic interface to BreezeAuth, available at https://api.breezeauth.com. Developers use it to read and change data from their own systems.