Define authorization

Authorization is a crucial concept in the domain of security, especially when it comes to understanding the various aspects covered by the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam. In the context of information technology and cybersecurity, authorization is the process of determining whether a user, program, or device is allowed to access, modify, or execute a particular resource within a computer system or network.

To delineate this concept further, authorization comes into play after the authentication process. While authentication verifies the identity of a user, device, or entity, authorization specifies what that identity is permitted to do within a system. This process is governed by policies and rules that are enforced by the system and designed to protect sensitive data and resources from unauthorized access or modification.

Examples of Authorization:

• File Permissions:

  In an operating system, file permissions dictate what actions a user can perform on a file (read, write, execute, or delete). For instance, a user might be authorized to read a file but not to modify it.

• Database Access Controls:

  Database systems often use role-based access control (RBAC) to determine which users can view or manipulate data within a database. For example, a database administrator may have full access while a guest account could be restricted to read-only access.

• Network Services:

  A network firewall may allow or block traffic based on authorization policies, such as permitting only certain IP addresses to access an internal service.

• Application-level Authorization:

  Within applications, certain features may be locked down to specific roles or users. For example, a financial application may authorize only managers to view all user transaction logs.

• Cloud Services:

  When using cloud services like those provided by Microsoft Azure, authorization determines what services and resources a user can manage. Azure uses Azure Role-Based Access Control (Azure RBAC) to manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.

Authorization Mechanisms:

• Role-Based Access Control (RBAC):

  RBAC is a widely used authorization mechanism that assigns permissions to roles rather than to individual users. Users are then assigned roles based on their job functions, and through those roles, they inherit permissions.

• Attribute-Based Access Control (ABAC):

  ABAC uses various attributes (user attributes, resource attributes, and environment conditions) to determine authorization. This model provides more granular control and flexibility than RBAC but is also more complex.

• Mandatory Access Control (MAC):

  MAC is a model where access to resource objects is constrained based on the sensitivity (as represented in the classification label) of the information contained in the objects and the formal authorization (i.e., clearance) of subjects to access information of such sensitivity.

• Discretionary Access Control (DAC):

  DAC allows the owner of the resource to specify which users can access it, which is in contrast to MAC, where access control policies are centrally controlled.

Authorization in Microsoft Security Context:

In the Microsoft security ecosystem, particularly within Microsoft 365 and Azure, authorization is managed through various tools and services. Some of the key services include:

• Azure Active Directory (Azure AD): Azure AD is Microsoft’s cloud-based identity and access management service, which helps employees sign in and access resources.
• Azure RBAC: As mentioned earlier, Azure RBAC is a specific implementation of RBAC applied to Azure resources.

Common Authorization Scenarios in Microsoft Security:

• A user in Microsoft Teams might be authorized to create channels but not delete them based on their role.
• In SharePoint Online, a user might be authorized to edit documents in one library but only read documents in another.

Key Takeaways for SC-900 Exam:

• Understand the difference between authentication and authorization.
• Recognize the common authorization models, such as RBAC, ABAC, MAC, and DAC.
• Be familiar with how authorization is managed within Microsoft’s security platform, including Azure AD and Azure RBAC.

Understanding these concepts not only is essential for passing the SC-900 exam but also plays a vital role in designing and maintaining secure systems within the Microsoft security framework.