The product platform.

SAML term. The endpoint that receives the IdP's SAML response. ABR's endpoint SSO ACS URL is https://sso.adminbyrequest.com/saml.

Microsoft's on-premises directory service. Native to ABR - no connector required.

Microsoft's on-premises SAML federation server. Supported as a portal SSO IdP (via ADFS / SAML SSO) and as an endpoint SSO IdP.

XML-based Group Policy template format. ABR provides an ADMX template for enterprise policy deployment. Registry path: HKLM\Software\FastTrack Software\Admin By Request\Policies.

A document recording a significant design choice and its rationale.

ABR Windows agent supports ARM64 from v8.5+. Single MSI installer covers x86 32-bit, x86 64-bit, and ARM64. Minimum recommended version for ARM64 deployments is v8.5.1.

Microsoft's cloud-hosted desktop service. Authenticate mode has known issues in AVD; use Confirm or SSO/MFA mode instead.

A file sanitization technique that strips potentially malicious embedded content from documents. A capability of OPSWAT MetaDefender, though not directly exposed through ABR's integration.

UK government-backed cybersecurity certification. Requires MFA for privileged access. See also: Single Sign-On / MFA mode, Account Separation.

Cybersecurity category focused on protecting essential services and infrastructure. OPSWAT describes itself as a CIP specialist.

A method of securing endpoints that focuses on detecting and responding to threats that are present. Works in conjunction with EPP.

Microsoft licensing suite that includes Intune, Entra ID, and related services. EMS E3 is the standard licensing tier that qualifies Windows devices for Intune MDM enrollment and Win32 app deployment. Required for Microsoft Intune - Windows deployments of ABR.

The core ABR product (as distinct from SRA and WAM). Sometimes used as a namespace in portal navigation paths.

A method of securing endpoints that focuses on preventing threats from arriving. Combines analysis, monitoring and management, anti-malware software, EDR capabilities, and other security features into a comprehensive endpoint security platform.

A macOS MDM configuration profile that installs and configures an SSO extension at the OS level, allowing the macOS login dialog to authenticate against a corporate IdP (Entra ID or Okta) via Apple's Platform SSO mechanism. Deployed via Intune or Jamf. ABR requires the com.fasttracksoftware. prefix in the profile's AppPrefixAllowList to access the Platform SSO identity token.

macOS permission required by the ABR agent to function.

The umbrella authentication standard family from the FIDO Alliance. Users sign in with phishing-resistant credentials called passkeys, which can be synced across devices or bound to a platform or security key, replacing password-only logins with secure and fast sign-in experiences. More secure than passwords and SMS OTPs; FIDO2 is the current generation.

Hardware security key standard (e.g., YubiKey). A valid MFA second factor for CE+ compliance when used with an IdP. When a FIDO2 key is enrolled in Entra ID, Microsoft prioritizes phishing-resistant auth methods - causing Windows Hello to appear as the default option in the ABR SSO/MFA WebView2 browser flow. Without a FIDO2 key, the MFA flow defaults to Authenticator push.

A Microsoft Azure sovereign cloud environment for US government agencies and their contractors operating at higher data sensitivity levels. Supported as a National Cloud option in the Entra ID Connector.

A Microsoft-compatible credential provider from Google that allows Windows users to sign into Windows with their Google Workspace credentials. Required on managed Windows endpoints for the Google Identity Connector to function - without GCPW, the endpoint has no Google identity for ABR to resolve group memberships against.

Windows Active Directory policy container. ABR supports deployment via GPO/ADMX templates.

A Windows Group Policy extension that allows administrators to configure and manage settings that standard Group Policy cannot, including local users and groups membership.

Splunk's ingestion endpoint. ABR integrates with Splunk via HEC + webhooks.

The external system that authenticates users via SSO/MFA (e.g., Entra ID, Okta, ADFS, Google, JumpCloud).

Windows security concept. Medium IL = standard user privilege. High IL = elevated/admin privilege.

The camera hardware used by Windows Hello face recognition. Uses near-infrared imaging to resist photo spoofing. Required for the face recognition method within Windows Hello biometric support.

Category of tools (e.g., ServiceNow, Jira Service Management) that can receive ABR elevation requests via integration.

Atlassian's cloud-based IT service desk product. ABR integrates with JSM (Cloud only) via the Jira Service Management integration approval channel.

A signed token format used in OAuth 2.0 authentication flows. The ABR Google Identity Connector constructs a JWT signed with the service account's private key, then exchanges it with Google's OAuth server for a short-lived access token.

Microsoft's query language used in Azure Monitor, Log Analytics, and Microsoft Sentinel to query log data. ABR elevation and event data ingested via the Microsoft Sentinel integration is queryable using KQL.

Microsoft tool for rotating local admin passwords. Break Glass Account is positioned as a more secure alternative.

Software and processes that secure and enable IT control over enterprise applications on end users' corporate and personal devices.

Platforms (Intune, Jamf, Kandji, SCCM) used to deploy and manage the ABR agent (among other things).

The current Microsoft branding for SCCM (System Center Configuration Manager). The product is the same; the name changed in 2019 to reflect integration with Intune under the Microsoft Endpoint Manager umbrella. In support tickets and customer environments, both names are used interchangeably.

Authentication using two or more independent factors. Required for CE+ compliance.

The Windows host application for administrative snap-ins. .msc files (e.g., diskmgmt.msc, virtmgmt.msc, services.msc) are MMC configuration files that launch via mmc.exe <file.msc>. Relevant to ABR because .msc files cannot be configured as Force Elevate targets - they are not standalone executables. The workaround is a Tray Tool launching mmc.exe with the .msc path as an argument.

Shorthand for Machine Learning Auto-Approval within ABR context.

Protocol used by ABR [v8.4+] for real-time Break Glass account provisioning to endpoints.

A company that manages ABR tenants on behalf of multiple customers via a dedicated parent-level portal. MSP accounts use a separate login URL and see a consolidated tenant overview. Distinct from multi-tenant user invitation, which is a per-user cross-tenant access mechanism available to any portal administrator.

SAML claim field. ABR uses email address as the NameID. Must be correctly mapped in the IdP's SAML configuration.

A Linux configuration mechanism and runtime subsystem that specifies how the OS resolves names - user accounts, group memberships, hostnames, and other identity data - from different sources (local files, LDAP, DNS, etc.). Controlled by /etc/nsswitch.conf. ABR integrates with NSS via the NSS plugin [v4.0+] on Linux.

An Active Directory container used to organize users, computers, and groups within a domain. ABR supports OU-based scoping for Sub-Settings and Global Scope, using backslash-delimited paths (e.g., \Users\Finance_Staff). OUs do not exist in Entra ID.

The product category ABR belongs to. Covers control, monitoring, and audit of privileged accounts and actions.

The domain controller holding the PDC Emulator FSMO role in an Active Directory domain. ABR endpoints need network line-of-sight to the PDC to resolve AD group memberships at login. The nltest /dclist:[domain] command confirms whether the endpoint can reach the PDC.

The standard macOS installer package format (.pkg). ABR distributes the macOS agent as a PKG file downloaded from the ABR portal. The PKG is tenant-specific - signed with the tenant's license - and must not be shared across organizations. Deployed at scale via MDM (Jamf, Intune, Kandji).

The idea that users, applications, programs, and processes should be allowed only the bare minimum privileges necessary to perform their respective functions. Underpins Just-In-Time Access and ABR's elevation model.

A Linux system component that provides an organized way for non-privileged processes to communicate with privileged processes. Used primarily to authorize GUI applications to perform administrator-level actions without running the entire application as root. ABR integrates with Polkit via the Polkit plugin on Linux, intercepting GUI-originated privilege requests and routing them through ABR's elevation workflow. Also written as "PolicyKit."

Shorthand used in ABR support tickets and diagnostics for the Platform SSO feature. Refers to macOS OS-level identity binding via an MDM-pushed Extensible SSO configuration profile (Entra ID or Okta).

A transport protocol that runs over UDP, offering lower latency than TCP. Used by ABR SRA for the Cloudflare tunnel leg of Remote Support and Unattended Access sessions (UDP port 7844 to region1.v2.argotunnel.com / region2.v2.argotunnel.com). Firewalls that block UDP 7844 prevent SRA sessions from establishing.

Postmortem document genre. A methodical process used for determining what caused a problem.

A Windows Server role that allows multiple users to connect to and share a single server via remote desktop sessions. ABR recommends configuring Global Scope in RDS environments to restrict which connecting users can request elevation.

Supported Linux distribution for the ABR agent (v9+).

Federation protocol used by ABR for endpoint SSO. ABR implements SAML 2.0.

Microsoft endpoint management platform (also referred to as MECM - Microsoft Endpoint Configuration Manager). Supported for ABR Windows agent deployment.

Provisioning protocol. ABR uses SCIM for portal administrator account provisioning from Entra ID and Okta.

A cryptographic hash function that produces a unique 256-bit fingerprint of a file's binary content. Used by ABR to identify files submitted for malware scanning without transmitting the file itself.

Category of tools (e.g., Splunk, Microsoft Sentinel) that consume ABR event data for security monitoring.

Category of platform capability (alongside SIEM) for automating security workflows in response to detected threats. Microsoft Sentinel is described by Microsoft as both a SIEM and SOAR.

SAML term for the application requesting authentication (ABR, in this context). The IdP authenticates the user; the SP consumes the result.

Splunk's native query language for searching, filtering, and aggregating indexed event data. Used to write detection rules, build dashboards, and extract specific fields from ABR event payloads in Splunk integration.

ABR's remote access product (screen sharing, unattended access, vendor access). Separate SKU from EPM. Available on Windows v8.4+ and macOS Mac v5.2+ (requires macOS 14 Sonoma or later). Linux not yet supported as an agent target.

Authentication through a centrally managed identity provider.

Linux service used to connect the OS to Active Directory and other identity stores. Required for Linux AD/IdP integration with ABR.

Microsoft's web console for managing the Teams environment (admin.teams.microsoft.com). Required to upload custom apps and configure app permissions for the Microsoft Teams integration.

Introduced by Apple from macOS 10.14 to improve data protection for users. Enables a macOS device user to retain control over endpoint components such as camera and microphone. Works closely with PPPC.

MFA method that generates a rotating 6-digit code (e.g., Microsoft Authenticator, Google Authenticator). A valid CE+ MFA factor.

Hardware security chip used by Windows Hello to bind PINs to a specific device. ABR inventory reports TPM version [v8.0+].

Windows mechanism that prompts for confirmation or credentials when a process requests elevated privileges. ABR intercepts and replaces the UAC dialog.

A way to securely manage all the endpoints in an enterprise or an organization from a central location. Includes platforms such as Intune, Jamf, and Kandji.

The user's identity in Active Directory or Entra ID, typically in user@domain.com format. Used by ABR's Email match setting for SSO identity verification.

App packaging model used by Microsoft Store apps (e.g., Windows Terminal / wt.exe). UWP apps have no traditional file path or certificate accessible via right-click Properties.

Technology that hosts desktop environments on centralized servers and streams them to end-user devices. In ABR licensing terms, persistent VDI (each VM has a fixed hardware identity) behaves like a physical machine (one license per instance). Non-persistent (pooled) VDI can cause license sprawl: each rebuilt session host may register as a new device if its MAC address or hardware serial number changes, and old records persist until the 60-day passive expiry.

A screen-sharing protocol that transmits keyboard/mouse input and screen updates over a network connection. ABR's Remote Support creates a just-in-time VNC server on the endpoint when a session starts, and destroys it when the session ends. Not the same as RDP (which is used by Unattended Access).

ABR's browser-activity control product (download and browsing permissions). Separate SKU from EPM and SRA. Windows only [v8.8+].

The enterprise-managed variant of Windows Hello, bound to Entra ID or on-premises AD via Intune/GPO. See Windows Hello for Business entry in Feature Terms.