1.3. Authentication vs. Authorization
💡 First Principle: Access control is two different questions asked in sequence: who are you? (authentication) and what are you allowed to do? (authorization). Systems separate them because they change independently — how you prove identity can strengthen (password → MFA → passkey) without altering what you're permitted to touch, and your permissions can change without you re-proving who you are.
Keep the two questions separate and the entire SC-300 blueprint sorts itself: Phase 2's methods and MFA are authentication; roles, app permissions, and PIM are authorization; and Conditional Access is the checkpoint between them — after Entra knows who you are, it decides whether (and under what conditions) you may proceed. Exam stems exploit the boundary constantly: "users must approve a prompt on their phone" is authentication; "users must not be able to delete groups" is authorization.
The airport analogy carries the distinction: your passport check proves who you are (authentication); your boarding pass determines which plane and seat you may take (authorization). A perfect passport with no boarding pass gets you nowhere — and vice versa.
⚠️ Common Misconception: "Authentication and authorization are the same thing — logging in." They happen within the same seconds, but they are separate stages with separate tooling, and nearly every SC-300 troubleshooting question depends on identifying which stage failed: a wrong password fails authentication; a "you don't have permission" error after a successful sign-in fails authorization.
