update unit

Author: ceperezb

learn-pr/wwl-sci/describe-identity-principles-concepts/includes/2-define-authentication-authorization.md

@@ -1,82 +1,37 @@
-
-<!-- markdownlint-disable MD041 -->
-Authentication and authorization are two fundamental concepts in identity and access management. Together, they ensure that only the right people—and only what they need—can access organizational resources.
+Securing access to digital resources requires two distinct but related processes: confirming who is requesting access, and then deciding what that person, device, or application is allowed to do. These two processes—*authentication* and *authorization*—are fundamental to identity and access management. Understanding the difference between them is essential because every access decision in a modern organization depends on both.
 
 ## Authentication
 
-Authentication is the process of proving that you are who you say you are. Every time you sign in to an application, unlock your phone, or access a company system, authentication is happening. The system challenges you to provide proof of your identity, and then verifies that proof before deciding whether to allow access.
-
-Authentication is sometimes shortened to *AuthN*. The goal of authentication is to answer the question: *Who are you?*
-
-### How authentication works
-
-Authentication requires *credentials*—evidence that verifies your identity. Common types of credentials include:
-
-- A username and password
-- A fingerprint or facial scan (biometrics)
-- A one-time code sent to your phone
-- A hardware security key
+*Authentication* is the process of proving that you are who you say you are. Every time you sign in to an application, unlock your phone, or access a company system, authentication is happening. The system challenges you to provide proof of your identity, and then verifies that proof before deciding whether to allow access. Authentication answers the question: *Who are you?*
 
-A username alone doesn't prove identity—it can be known or guessed by others. Adding a password (something only the legitimate user should know) gives a system confidence that the right person is signing in. Adding a biometric or physical device raises that confidence further.
+Authentication requires *credentials*—evidence that verifies your identity. A username alone doesn't prove identity—it can be known or guessed by others. Adding a password provides a basic level of verification, but passwords can be stolen, guessed, or phished—making them one of the weakest forms of authentication on their own. Adding a stronger factor, such as a biometric or physical device, raises confidence significantly.
 
-Modern authentication systems also evaluate *contextual signals*: where the sign-in request originates, what device is being used, the time of day, and whether behavior matches typical patterns. These signals help systems detect suspicious sign-in attempts even when the correct credentials are presented.
+Authentication methods are built on three categories of proof, called *authentication factors*:
 
-### Passwordless authentication
+- **Something you know** — a password, PIN, or security question
+- **Something you have** — a mobile device, hardware security key, or smart card
+- **Something you are** — a biometric characteristic like a fingerprint or facial scan
 
-*Passwordless* authentication removes the reliance on passwords by using stronger alternatives—such as biometrics, hardware security keys, or device-based credentials—to verify identity. Because there's no password to steal, reuse, or guess, passwordless methods reduce many of the risks associated with traditional password-based sign-in.
+Using only one factor—such as a password alone—is called *single-factor authentication*. Single-factor authentication is common but vulnerable. If that single factor is compromised—a password stolen through phishing, for example—an attacker has everything they need to impersonate the user.
 
-### Multifactor authentication
+*Multifactor authentication (MFA)* strengthens authentication by requiring two or more factors from different categories. For example, signing in with a password (something you know) and then approving a notification on your phone (something you have). Because an attacker would need to compromise multiple independent credentials, MFA dramatically reduces the risk of account takeover.
 
-A username and password alone are often insufficient protection. Passwords are frequently stolen through phishing attacks, data breaches, and credential-stuffing attacks. *Multifactor authentication (MFA)* strengthens authentication by requiring more than one type of proof, drawn from different categories:
-
-- **Something you know**—a password or PIN
-- **Something you have**—a phone, a hardware security key, or a smart card
-- **Something you are**—a biometric, such as a fingerprint or facial scan
-
-When MFA is enabled, stealing a password alone isn't enough to compromise an account. An attacker would also need to physically possess the user's device or replicate their biometrics. This extra layer of verification dramatically reduces the risk of account takeover.
+After the system evaluates the credentials, authentication either succeeds or fails. Successful authentication confirms the identity and allows the process to continue. Failed authentication denies access before any resources are exposed. But authentication alone doesn't determine what you can do—it only confirms who you are. That's where authorization comes in.
 
 ## Authorization
 
-Once your identity is confirmed through authentication, the next question is: *What are you allowed to do?*
-
-Authorization is the process of determining what an authenticated user has permission to access and what actions they can perform. Knowing who you are isn't enough—the system also needs to determine what you're entitled to.
-
-Authorization is sometimes shortened to *AuthZ*.
-
-### The hotel analogy
-
-A useful way to think about authentication and authorization is to imagine checking into a hotel.
-
-When you arrive, you go to the reception desk and present your passport or driver's license. The receptionist checks your identification against your reservation to confirm who you are. That's *authentication*.
-
-Once verified, you're given a keycard programmed to open specific doors: your assigned room, the fitness center, or the pool—but not other guests' rooms, the staff areas, or the kitchen. When you use the keycard, the door sensor checks your permissions and grants or denies access accordingly. That's *authorization*.
-
-In digital systems:
-- The credentials you provide (username, password, biometrics) are like your passport—they prove who you are.
-- The permissions assigned to your account—which applications, files, and actions you can access—are like the keycard.
-
-### How authorization is managed
-
-Authorization is typically managed through *roles* and *permissions*. Rather than assigning access rights individually to every user, systems group permissions into named roles, and then assign users to those roles.
-
-For example:
-- A *help desk technician* role might allow viewing user account status but not resetting passwords.
-- A *security administrator* role might allow resetting passwords and reviewing sign-in logs.
-- A *global administrator* role might have full control over all settings and users.
-
-This model is called *role-based access control (RBAC)*. When the permissions of a role change, every user assigned to that role is automatically affected. RBAC makes managing access across large organizations scalable and consistent.
+*Authorization* is the process of determining what an authenticated identity is allowed to do. Once authentication confirms your identity, authorization evaluates your permissions and decides whether to grant or deny access to specific resources—applications, files, data, or system features. Authorization answers the question: *What are you allowed to do?*
 
-Authorization decisions can also be dynamic. A user might be authorized to access a sensitive application under normal circumstances—but if they sign in from an unexpected location or an unrecognized device, a risk-based policy might step up the authentication requirement or restrict access until the risk is resolved.
+Authorization decisions are typically based on roles (such as employee, manager, or administrator), permissions (read, write, or delete), and attributes (department, location, or job function). The system evaluates these rules for each access request and grants or restricts access accordingly.
 
-## Authentication and authorization work together
+A key authorization concept is the *principle of least privilege*: users should have only the minimum access they need to perform their job, and no more. Limiting access reduces the potential damage from a compromised account, minimizes the risk of accidental data loss, and helps organizations meet their security and compliance requirements.
 
-Authentication and authorization are distinct processes, but they work together to protect resources. They always occur in a specific order:
+## How authentication and authorization work together
 
-1. **Authentication**—the system verifies who you are.
-2. **Authorization**—the system determines what you're allowed to do.
+Authentication and authorization are distinct processes, but they work together to protect resources. They always occur in a specific order: authentication happens first—at sign-in—and establishes who you are. Authorization happens after authentication and determines what you can access.
 
-Authorization can only happen after successful authentication. You can't determine what someone is permitted to do without first confirming their identity. And confirming identity alone—without checking permissions—leaves resources exposed.
+Think of it like checking into a hotel. You present your ID at the front desk, and the receptionist verifies who you are—that's authentication. You're then given a keycard that opens your room and the fitness center, but not other guests' rooms or staff areas—that's authorization.
 
-Together, authentication and authorization form the foundation of access management across all Microsoft security, compliance, and identity solutions.
+Authorization can only happen after successful authentication. You can't determine what someone is permitted to do without first confirming their identity. And confirming identity alone—without checking permissions—leaves resources exposed. Together, authentication and authorization ensure that the right identities get the right access, and nothing more.