Authentication and Authorization
Accessing resources is based on a two-stage concept of first authenticating and then authorizing; identifying “who you are” and determining “what you can do.”
Authentication, also referred to as AuthN, is the process of establishing and proving the identity of a person (or service). This can be done by validating provided access credentials information against stored or known identifying information.
Authorization, also referred to as AuthZ, is the process of establishing what level of access the authenticated person (or service) has to the resources, that is, what they can access and what actions they may perform.
Figure 5.1 visualizes the concepts of authentication and authorization.
Figure 5.1 – The concepts of authentication and authorization
In this section, you looked at the concepts of authentication and authorization. The following section looks at Microsoft Entra ID.
