Definitions of Qlik Cloud terms used throughout this playbook. Where a term has a richer treatment in Qlik's own documentation, the canonical link is given.
Where things live
Location
What it is
How to reach it
Admin console
The web UI for tenant administration (users, content, gateways, automations, events, settings).
https://<tenant>.<region>.qlikcloud.com/console
Hub
The end-user landing page (activity-center launcher, app catalog, personal space). Distinct from the admin console—the hub is what regular users see, the admin console is the /console subpath for administrators.
https://<tenant>.<region>.qlikcloud.com
Home dashboard
Default landing screen of the admin console; shows value meters and recent activity.
Admin console → Home
Tenant settings
Subsection of the admin console holding feature toggles, entitlements toggles, and User Default permissions.
Admin console → Settings
My Qlik
Customer portal where the Service Account Owner manages subscriptions and region- / organization-level OAuth clients.
The unified data-integration subscription. The same product surfaces inside a Qlik Cloud tenant as Qlik Talend Data Integration—they refer to the same offering, just packaged differently. New Qlik Talend Cloud subscriptions purchased on or after July 22, 2025 automatically create and link the Qlik Cloud and Talend Cloud tenants.
Qlik Cloud Government (QCG)
FedRAMP Moderate authorized variant of Qlik Cloud, built on AWS GovCloud (US), for US public-sector workloads.
Qlik Anonymous Access
Subscription that allows publicly embedding Qlik content to users who aren't tenant members. Sold as two base packs—SMB (small-to-medium-sized business: 500 MB Anonymous Capacity / 25 concurrent sessions) and Standard (2 GB Anonymous Capacity / 100 concurrent sessions)—and typically purchased alongside another subscription (user-based or capacity-based).
Qlik Answers
Generative-AI assistant. The agentic experience (launched February 2026) combines structured analytics with unstructured knowledge bases and LLM reasoning. The earlier legacy Answers experience predates the agentic framework.
Qlik Predict (formerly Qlik AutoML)
Automated machine-learning capability. Available in Premium / Enterprise capacity-based, and a basic tier with Qlik Sense Enterprise SaaS.
Visual no-code automation runtime; the home of the Platform Operations connector and the monitoring-apps deployer.
Qlik Reporting Service
Metered service that generates and distributes reports.
Qlik Data Gateway—Direct Access
Customer-hosted agent that lets Qlik Cloud reach firewalled data sources for app reloads. Historically a Windows-only service; from v1.8.0 (Sept 2026) it can also run as a Docker container on Linux or Windows, alongside the existing Windows install.
Qlik Data Gateway—Data Movement
Customer-hosted Linux agent for Qlik Talend Data Integration (replication / ingestion).
Subscription model concepts
Term
Meaning
User-based subscription
Users are assigned Professional (creator) or Analyzer (consumer) entitlements; entitlements determine UI and built-in role auto-assignment.
Capacity-based subscription
Users are billed as a pool (Full Users) with capabilities controlled by roles / permissions; value meters bill data and AI usage. As of February 2, 2026 the predecessor Basic User tier was removed.
Professional / Analyzer / Analyzer Capacity
Three user-based entitlement types. Analyzer Capacity is a time-based minute pool, billed by minutes consumed rather than by named users.
Full User
Capacity-based equivalent of a named user; every authenticated user on a capacity-based tenant counts as one.
Basic User
Predecessor restricted-access tier on capacity-based tenants, retired February 2, 2026.
Value meter
A billable consumption metric: Data for Analysis, Data Moved, Anonymous Capacity, Anonymous Concurrent Sessions, monthly Qlik Answers questions, monthly indexed pages, monthly report counts.
Entitlement
What a user is licensed to do (Professional / Analyzer / Full User / Anonymous). Separate from role and from space role.
Security role
What a user is permissioned to do at the tenant scope (for example, Tenant Admin, custom roles, User Default).
Space role
What a user can do inside a given space (Owner, Can manage, Can edit, Can operate, Can view, etc.).
Signed License Key (SLK)
The license artifact attached to a tenant. Replacing the SLK is destructive: it removes all user entitlement assignments (Professional / Analyzer / Full / Basic) because those assignments are bound to the license, not the tenant. Security-role assignments (Tenant Admin, custom roles) aren't affected. (community)
Spaces
Qlik Cloud organizes content into four space types (Working in spaces):
Space type
Purpose
Personal space
Each user's private workspace for development and exploration. Tenant admins can manage apps in personal spaces (change owner, move, delete, manage schedules) per Managing applications; Analytics Admin and Data Admin cannot access personal spaces.
Shared space
Collaborative workspace for groups of users to co-develop apps and share data sources.
Managed space
Tightly controlled publication target. Apps are published into managed spaces from personal or shared spaces; consumers can't edit.
Data space
Qlik Talend Data Integration workspace for projects, connections, and Data Movement gateway access control.
Identity, access, and security
Term
Meaning
Tenant Admin (TA)
Full administrative role; Qlik requires at least one at all times.
Analytics Admin (AA)
Manages analytics content in shared and managed spaces.
Data Admin (DA)
Manages data spaces and data-integration resources.
Audit Admin (AuA)
Reviews application feedback and Natural Language / Qlik Answers conversation metrics.
Service Account Owner (SAO)
The user who originally created the tenant. Manages subscription in My Qlik and is the only path to recover an IdP misconfiguration.
User Default
The baseline role applied to every authenticated user; effectively what every user can do unless a more specific role grants more.
Custom role
An admin-defined role with a chosen set of permissions, optionally auto-assigned to a group or to "Anyone at <tenant>".
Identity Provider (IdP)
The external system that authenticates users (Azure AD / Entra, Okta, Auth0, etc.). Qlik Cloud allows one interactive IdP per tenant.
JIT provisioning
Just-in-time user provisioning: a user record is created on first login, rather than pre-provisioned via SCIM.
SCIM
System for Cross-domain Identity Management—the standard for pre-provisioning users / groups from an IdP.
Bot user
A non-interactive identity automatically created the first time an OAuth M2M (machine-to-machine) client requests a token. Has Tenant-Admin-equivalent privileges on the tenant where it lives. Must be added to spaces explicitly to read/write space-scoped content.
M2M (machine-to-machine)
OAuth2 grant for service-to-service calls; pairs with a bot user.
JWT
JSON Web Token—token format used for OAuth and for the JWT-anonymous-IdP / embedded-session flow.
Trusted vs Required consent
OAuth client setting controlling whether the user is shown a consent screen on first use. Trusted suppresses the screen and is appropriate for first-party server-to-server flows; publishing an OAuth client silently reverts its consent method to Required, so keep M2M clients unpublished.
CSRF / CSWSH
Cross-Site Request Forgery / Cross-Site WebSocket Hijacking—request-validation protections enforced by Qlik Cloud since November 2024 for WebSocket clients.
mTLS
Mutual TLS—both client and server present certificates. The Qlik Data Gateway tunnel uses mTLS.
Section Access
Script-based row- and column-level security inside a Qlik Sense app. Users are matched on USER.EMAIL (recommended for Qlik Cloud—USERID and NTNAME are also supported); after the match, Qlik Sense permanently hides all data excluded by the reduction-field selections from the user. (Managing data security with Section Access)
AI / Insight features
Qlik Cloud ships four AI surfaces that overlap in confusing ways. Insight Advisor (in-app natural-language search) and Insight Advisor Chat (chat across multiple apps) are the older, deterministic generation. Discovery Agent (push-mode insights when data changes) and Qlik Answers (agentic Q&A over apps plus unstructured knowledge bases) are the agentic generation, launched February 2026. Tenants on the agentic experience get Qlik Answers in place of Insight Advisor Chat; Insight Advisor itself continues to exist inside apps. Cross-region inference is the tenant setting that lets several of these features call models hosted in another AWS region.
Chat-based variant accessed from the activity centers (or from Microsoft Teams). Not available on tenants using the Qlik Answers agentic experience—Qlik Answers replaces it there.
Discovery Agent
AI agent that monitors app data continuously and proactively surfaces meaningful changes. (Discovery Agent)
Insight Feed
Scrollable per-user list of insights produced by Discovery Agent insight triggers. Accessed via the Insights or Analytics activity centers (Feed icon in the left menu), not from inside applications. (Analyzing Discovery Agent feeds)
Insight trigger
App-scoped rule evaluated when data changes; produces Insight Feed entries on discovery.
Agentic experience
Qlik's umbrella term for AI workflows that combine assistants (Qlik Answers) with autonomous agents (Discovery Agent) over structured + unstructured content. Launched February 2026.
Cross-region inference
Tenant setting that allows Qlik Answers, Discovery Agent, Pipelines AI SQL, API Designer Generate contract, AI data-quality descriptions, and Qlik Predict bias-detection to transiently send requests to another AWS region where the supporting model is hosted. Formerly cross-region data processing.
Data integration
Term
Meaning
Data product
A curated, governed, AI-ready data asset published to the Qlik Talend Cloud marketplace—bundles dataset, transformations, quality rules, contracts, and access patterns. (Working with data products)
Data product marketplace
The self-service catalog where analytics consumers shop for data products.
DSN
Data Source Name—the ODBC connection definition on a gateway host (per-driver, 64-bit System DSN).
NTP
Network Time Protocol—clock-sync service. Gateways need NTP because clock skew breaks the mTLS tunnel.
Networking and security
Term
Meaning
CORS
Cross-Origin Resource Sharing—browser security model. Qlik's web integrations entries are the CORS allowlist for embedded apps.
Web integration
The CORS allowlist record in tenant settings; one per allowed origin host.
IP policy / IP allowlist
Native tenant feature that restricts access to specific IPv4 addresses or ranges. When an allowlist is enabled, connections from any IP not on the list are blocked—this covers tenant access including UI login, not just API calls. Available across subscription models; enabled under IP allowlists in tenant settings or via the IP Policies API. IPv4-only.
