Glossary
Product-related Terms
| Terminology | Explanation |
|---|---|
| SHIELD DRM | A cloud-native DRM service that provides document security optimized for the Microsoft 365 environment. Automatically converts DRM documents to MIP documents. |
| Document Security (DS) | Solution for managing and protecting DRM encrypted documents on local PC. Based on DS6 (version 6). |
| Document Security 365 (DS365) | Service integrated with Document Security in the Microsoft 365 environment |
| Security365 Portal | Integrated Management Portal for SHIELD DRM Usage |
| SHIELDrive | Service that supports file upload/download related to SHIELD DRM |
Terms related to Microsoft 365
| Terminology | Explanation |
|---|---|
| MIP (Microsoft Information Protection) | Microsoft's information protection solution. Protect organizational data through labels, classification, and security policies. SHIELD DRM automatically converts DRM documents to MIP documents. |
| Sensitivity Label (Sensitivity Label) | Information classification and protection labels created in Microsoft Compliance Center |
| Microsoft Entra ID | Old Azure AD. SHIELD DRM is the authentication system used in the MSAL authentication flow. |
| Compliance Center | Microsoft 365 Information Protection and Label Management Center |
| Tenant | Unique identifier unit of a Microsoft 365 organization..onmicrosoft.comDomain Criteria |
| Multi-GEO | With SharePoint's multi-region configuration, it supports site management for each region. |
| Microsoft Graph | Microsoft 365 Data Access API. Throttling limits applied to API requests |
| E3, E5 | Types of Microsoft 365 Subscription Licenses. E3 or higher is recommended when using SHIELD DRM. |
Authentication and Authorization Terms
| Terminology | Explanation |
|---|---|
| Global Administrator | Global Administrator of Microsoft 365 Tenant |
| Compliance Manager | Role with MIP label creation and publishing permissions |
| MSAL (Microsoft Authentication Library) | Authentication Library Based on Microsoft Entra ID |
| Client Credential Flow | Authentication method to obtain a token using the app's Client ID/Client Secret |
| App ID / App Secret | Secure token pair for SHIELD DRM service authentication |
| ACS (Azure Access Control Service) | Legacy app authentication service. Scheduled to end in April 2026. |
Terms Related to DRM Encryption
| Terminology | Explanation |
|---|---|
| DAC (Document Access Control) | DRM Document Permission Control Method. Fine-grained control of permissions by user. |
| MAC (Mandatory Access Control) | Document Classification-Based Mandatory Access Control Method |
| GRADE | Access Control Methods Based on Document Classification (Confidential, Internal Use, etc.) |
| BYOK (Bring Your Own Key) | The method by which the client provides its own encryption key to protect the document. |
| HYOK (Hold Your Own Key) | How the customer’s key management server holds encryption keys |
| SCI Server | External server managing encryption keys and permission policies |
| DRM Document Conversion | Process of Converting DRM Encrypted Documents to MIP Labeled Documents |
Policy-related terms
| Terminology | Explanation |
|---|---|
| Conditional Policy | A policy that automatically applies encryption based on conditions such as user, location, time, and document type. |
| Endpoint Policy | Conditional policies set in Document Security of Local PC |
| Cloud Storage Policy | Conditional policies applied to documents created/uploaded in OneDrive, SharePoint, and Teams |
| SDF (Sensitive Docs Flow) | A framework that provides fine-grained control for document security (encryption, decryption, export, and application of hidden information) |
| Policy Priorities | Determine the execution order when multiple policies conflict. Higher priority policies are executed first. |
| Non-Retry Keywords | Specific Keywords and Phrases Exempted During MIP Conversion/Release |
Event Handling and Synchronization Terms
| Terminology | Explanation |
|---|---|
| Event Receiver | Mechanism for detecting and receiving file events in SharePoint/OneDrive. Replacing the existing Add-In method. |
| Add-In | Existing SharePoint integration method requires individual installation for each site. Scheduled for deprecation with the end of ACS. |
| Webhook | Asynchronous method in which SharePoint sends an HTTP POST request to the server endpoint when an event occurs. |
| Subscription | Registering a Webhook or Event Receiver to a specific resource |
Performance-related terms
| Terminology | Explanation |
|---|---|
| Throttling (Throttling) | Microsoft's mechanism for applying rate limits to API requests |
| Rate Limiting | Technology to limit the number of API requests within a specific time frame |
| Token Bucket | Rate Limiting method that issues tokens at a constant rate and consumes tokens during request processing. |
| Retry Logic | A mechanism that automatically retries the task in case of a temporary error. |
| Queue | A structure that manages documents waiting for conversion to be processed in order. |
Storage-related terms
| Terminology | Explanation |
|---|---|
| OneDrive | Microsoft 365 Personal Cloud Storage. SHIELD DRM Event Detection Target |
| SharePoint | Document library and collaboration platform of Microsoft 365. Event Receiver installation target |
| Teams | Microsoft 365's team collaboration platform. Supports document upload within the Files tab. |
| Site Collection (Site Collection) | A top-level unit of SharePoint that includes multiple sites |
| Document Library | Library for managing documents in SharePoint |
Log and Monitoring Terms
| Terminology | Explanation |
|---|---|
| Dashboard | Admin screen for real-time monitoring of conditional policy operation status and document status |
| User Log | User's document conversion status record |
| Admin Log | Action Log in the Admin Page |
| Audit Log | Detailed Activity Log for Security Audit |
| Integrated Log | Integrate and manage logs such as file conversion, decryption, and call blocking. |
Infrastructure Terms
| Terminology | Explanation |
|---|---|
| Kubernetes (K8s) | Container orchestration platform. SHIELD DRM deployment environment |
| RabbitMQ | Message Broker. Used for event reception and asynchronous processing. |
| ConfigMap | Object that manages application settings in Kubernetes |
| Event Hub | Central Receiving and Processing System of Event-Driven Architecture |
Security-related Terms
| Terminology | Explanation |
|---|---|
| Document-Centric Security | Document-centric security approach that applies encryption and policies to the document itself |
| Permission Rights (Rights) | Access permissions for the document. Reading, editing, output, export, release, permission changes, print marking, validity period, etc. |
| Print Marking | A security feature that marks specific marks on the document during printing to ensure traceability. |
| DLP (Data Loss Prevention) | Policy to Prevent Sensitive Data from Leaking Outside the Organization |