|
1 | 1 |
|
2 | | -### Authentication |
3 | | -Authentication is the process of proving that a person is who they say they are. When someone purchases an item with a credit card, they might be required to show another form of identification. This proves that they are the person whose name appears on the card. In this example, the user might show a driver’s license that serves as a form of authentication and proves their ID. |
| 2 | +<!-- markdownlint-disable MD041 --> |
| 3 | +Authentication and authorization are two fundamental concepts in identity and access management. Together, they ensure that only the right people—and only what they need—can access organizational resources. |
4 | 4 |
|
5 | | -When you want to access a computer or device, you encounter a similar type of authentication. You might get asked to enter a username and password. The username states who you are, but by itself isn't enough to grant you access. When combined with the password, which only that user should know, it allows access to your systems. The username and password, together, are a form of authentication. Authentication is sometimes shortened to AuthN. |
| 5 | +## Authentication |
6 | 6 |
|
7 | | -### Authorization |
8 | | -Once you authenticate a user, you need to decide where they can go, and what they're allowed to see and touch. This process is called authorization. |
| 7 | +Authentication is the process of proving that you are who you say you are. Every time you sign in to an application, unlock your phone, or access a company system, authentication is happening. The system challenges you to provide proof of your identity, and then verifies that proof before deciding whether to allow access. |
9 | 8 |
|
10 | | -Suppose you want to spend the night in a hotel. The first thing you do is go to reception to start the "authentication process." After the receptionist has verified who you are, you're given a keycard and can go to your room. Think of the keycard as the authorization process. The keycard lets you open only the doors and elevators you're permitted to access, such as for your hotel room. |
| 9 | +Authentication is sometimes shortened to *AuthN*. The goal of authentication is to answer the question: *Who are you?* |
11 | 10 |
|
12 | | -In cybersecurity terms, authorization determines the level of access or the permissions an authenticated person has to your data and resources. Authorization is sometimes shortened to AuthZ. |
| 11 | +### How authentication works |
13 | 12 |
|
14 | | -### Multifactor authentication (MFA) and passwordless |
15 | | -Using a username and password is a common way to authenticate, but passwords are a frequent target for attackers. |
| 13 | +Authentication requires *credentials*—evidence that verifies your identity. Common types of credentials include: |
16 | 14 |
|
17 | | -**Multifactor authentication (MFA)** strengthens authentication by requiring more than one proof, such as: |
| 15 | +- A username and password |
| 16 | +- A fingerprint or facial scan (biometrics) |
| 17 | +- A one-time code sent to your phone |
| 18 | +- A hardware security key |
| 19 | + |
| 20 | +A username alone doesn't prove identity—it can be known or guessed by others. Adding a password (something only the legitimate user should know) gives a system confidence that the right person is signing in. Adding a biometric or physical device raises that confidence further. |
| 21 | + |
| 22 | +Modern authentication systems also evaluate *contextual signals*: where the sign-in request originates, what device is being used, the time of day, and whether behavior matches typical patterns. These signals help systems detect suspicious sign-in attempts even when the correct credentials are presented. |
| 23 | + |
| 24 | +### Passwordless authentication |
| 25 | + |
| 26 | +*Passwordless* authentication removes the reliance on passwords by using stronger alternatives—such as biometrics, hardware security keys, or device-based credentials—to verify identity. Because there's no password to steal, reuse, or guess, passwordless methods reduce many of the risks associated with traditional password-based sign-in. |
| 27 | + |
| 28 | +### Multifactor authentication |
| 29 | + |
| 30 | +A username and password alone are often insufficient protection. Passwords are frequently stolen through phishing attacks, data breaches, and credential-stuffing attacks. *Multifactor authentication (MFA)* strengthens authentication by requiring more than one type of proof, drawn from different categories: |
| 31 | + |
| 32 | +- **Something you know**—a password or PIN |
| 33 | +- **Something you have**—a phone, a hardware security key, or a smart card |
| 34 | +- **Something you are**—a biometric, such as a fingerprint or facial scan |
| 35 | + |
| 36 | +When MFA is enabled, stealing a password alone isn't enough to compromise an account. An attacker would also need to physically possess the user's device or replicate their biometrics. This extra layer of verification dramatically reduces the risk of account takeover. |
| 37 | + |
| 38 | +## Authorization |
| 39 | + |
| 40 | +Once your identity is confirmed through authentication, the next question is: *What are you allowed to do?* |
| 41 | + |
| 42 | +Authorization is the process of determining what an authenticated user has permission to access and what actions they can perform. Knowing who you are isn't enough—the system also needs to determine what you're entitled to. |
| 43 | + |
| 44 | +Authorization is sometimes shortened to *AuthZ*. |
| 45 | + |
| 46 | +### The hotel analogy |
| 47 | + |
| 48 | +A useful way to think about authentication and authorization is to imagine checking into a hotel. |
| 49 | + |
| 50 | +When you arrive, you go to the reception desk and present your passport or driver's license. The receptionist checks your identification against your reservation to confirm who you are. That's *authentication*. |
| 51 | + |
| 52 | +Once verified, you're given a keycard programmed to open specific doors: your assigned room, the fitness center, or the pool—but not other guests' rooms, the staff areas, or the kitchen. When you use the keycard, the door sensor checks your permissions and grants or denies access accordingly. That's *authorization*. |
| 53 | + |
| 54 | +In digital systems: |
| 55 | +- The credentials you provide (username, password, biometrics) are like your passport—they prove who you are. |
| 56 | +- The permissions assigned to your account—which applications, files, and actions you can access—are like the keycard. |
| 57 | + |
| 58 | +### How authorization is managed |
| 59 | + |
| 60 | +Authorization is typically managed through *roles* and *permissions*. Rather than assigning access rights individually to every user, systems group permissions into named roles, and then assign users to those roles. |
| 61 | + |
| 62 | +For example: |
| 63 | +- A *help desk technician* role might allow viewing user account status but not resetting passwords. |
| 64 | +- A *security administrator* role might allow resetting passwords and reviewing sign-in logs. |
| 65 | +- A *global administrator* role might have full control over all settings and users. |
| 66 | + |
| 67 | +This model is called *role-based access control (RBAC)*. When the permissions of a role change, every user assigned to that role is automatically affected. RBAC makes managing access across large organizations scalable and consistent. |
| 68 | + |
| 69 | +Authorization decisions can also be dynamic. A user might be authorized to access a sensitive application under normal circumstances—but if they sign in from an unexpected location or an unrecognized device, a risk-based policy might step up the authentication requirement or restrict access until the risk is resolved. |
| 70 | + |
| 71 | +## Authentication and authorization work together |
| 72 | + |
| 73 | +Authentication and authorization are distinct processes, but they work together to protect resources. They always occur in a specific order: |
| 74 | + |
| 75 | +1. **Authentication**—the system verifies who you are. |
| 76 | +2. **Authorization**—the system determines what you're allowed to do. |
| 77 | + |
| 78 | +Authorization can only happen after successful authentication. You can't determine what someone is permitted to do without first confirming their identity. And confirming identity alone—without checking permissions—leaves resources exposed. |
| 79 | + |
| 80 | +Together, authentication and authorization form the foundation of access management across all Microsoft security, compliance, and identity solutions. |
18 | 81 |
|
19 | | -- Something you know (password or PIN) |
20 | | -- Something you have (phone, security key) |
21 | | -- Something you are (biometrics) |
22 | 82 |
|
23 | | -**Passwordless** authentication reduces reliance on passwords by using stronger alternatives (for example, passkeys or Windows Hello for Business). Many passwordless methods are **phishing-resistant**, meaning they help protect users even if they're tricked into visiting a fake sign-in page. |
|
0 commit comments