Definitions for the terms used across the Dockli docs, in plain language.
Microsoft Entra ID
Microsoft’s cloud identity and access service (formerly Azure Active Directory). It’s where your organization’s user accounts, sign-in and groups live. Dockli signs users in against Entra ID and reads the security group that maps to seats. See Access groups and seats.
WAM broker
The Web Account Manager, a Windows component that brokers sign-ins for apps using accounts already known to Windows. Dockli uses the WAM broker so authentication happens through Windows rather than a browser, keeping tokens out of the app’s interface. See Security architecture.
MSAL
The Microsoft Authentication Library — Microsoft’s official library for acquiring and refreshing tokens against Entra ID. Dockli uses MSAL (with the WAM broker) to sign users in and obtain the access tokens it needs to call Microsoft Graph.
Microsoft Graph
Microsoft’s unified API for Microsoft 365. Dockli calls Graph (graph.microsoft.com) to list sites, browse files, read and write metadata, fetch version history and more — always with the signed-in user’s own permissions.
Hub Site
A SharePoint site that associates and organizes a family of related sites under one navigation and search umbrella. Dockli surfaces Hub Sites in the File Explorer navigation pane alongside your other workloads.
Tenant
Your organization’s dedicated instance of Microsoft 365 / Entra ID. All of your SharePoint sites, Teams, OneDrive and user accounts belong to your tenant. Dockli connects to your tenant’s hosts (for example *.sharepoint.com).
Seat
One licensed user of Dockli. You buy a number of seats and assign them by adding people to the Entra access group. See Per-seat licensing.
Entitlement token
The short-lived proof that a user is licensed for a plan. Dockli’s entitlement token is valid for 24 hours and refreshed when it’s more than 1 hour old, so a licensed user stays entitled without re-checking on every action. See Licensing and entitlement.
APIM
Azure API Management — the secure gateway (dockli-api-gateway.azure-api.net) through which Spark’s Ask Dockli reaches Azure OpenAI. APIM sits in front of the AI service so requests are governed and the model endpoint isn’t called directly.
DPAPI
The Windows Data Protection API, which encrypts data tied to the current user and machine. Dockli uses DPAPI to protect its local sign-in cache at rest, so cached credentials can’t be read by another user or moved to another machine.
Velopack
The installer and update framework Dockli uses to install per-user (no admin rights) and apply silent background updates. See Installing Dockli.
Shell namespace extension
The Windows mechanism that lets an app add its own entry to the File Explorer navigation pane and host content there. Dockli’s shell namespace extension is what puts the Dockli node below This PC and renders your Microsoft 365 files inside Explorer.
WebView2
The Microsoft Edge–based control that lets a Windows app host web-based UI. Dockli renders its interface in WebView2, which ships with current Windows 10/11 — so there’s usually nothing to install.
Essential
Dockli’s base plan: the full Microsoft 365 file experience in File Explorer, without the AI assistant. See Plans.
Spark
Dockli’s higher plan: everything in Essential plus Ask Dockli, the AI assistant, and priority support. See Plans.
Delegated permission
A Microsoft Graph permission that an app exercises on behalf of the signed-in user, never beyond what that user can already do. Dockli uses delegated permissions, so it can never see or touch anything the user couldn’t access directly.
Admin consent
A one-time approval by a tenant administrator that grants an app its requested permissions for the whole organization. An admin consents to Dockli once, tenant-wide, so individual users don’t each get a consent prompt. See Deployment overview.
Access group
The Microsoft Entra security group whose membership determines who has a Dockli seat. Add a user to grant a seat; remove them to reclaim it. See Access groups and seats.
Reconciliation
The periodic process — roughly every 4 hours — where Dockli compares access group membership against your purchased seat count, keeps seat assignments current, and raises an over-capacity alert to the admin if membership exceeds the seats you own.
Grace window
A 10-day period during which Dockli keeps a licensed user working if entitlement can’t be confirmed (for example a transient outage), before licensed features stand down. It prevents brief connectivity problems from locking out valid users. See Licensing and entitlement.
Where to go next
- Licensing details → Licensing and entitlement
- Security model → Security architecture
- Common questions → FAQ