Glossary

Control tenant The dedicated issuer whose operator accounts and OAuth grants authorize global Identity administration.

External ID A source-owned stable account identifier supplied during migration and mapped to Identity’s generated subject.

Issuer The exact tenant URL placed in token iss claims and exposed in discovery.

Managed issuer An issuer generated by Identity under the configured managed-domain base.

Principal Identity’s internal account identity. A tenant subject exposes its tenant-local OAuth sub.

Resource An API audience for which a client may request an access token.

Subject The opaque tenant-local sub value. Consumers identify an account by (issuer, subject).

Tenant federation Directional trust allowing verified authentication evidence from one Identity tenant to another.