Define authentication and authorization

Securing access to digital resources requires two distinct but related processes: confirming who is requesting access, and then deciding what that person, device, or application is allowed to do. These two processes—authentication and authorization—are fundamental to identity and access management. Understanding the difference between them is essential because every access decision in a modern organization depends on both.

Watch the video that follows to learn about authentication and authorization.

Authentication

Authentication is the process of proving that you are who you say you are. Every time you sign in to an application, unlock your phone, or access a company system, authentication is happening. The system challenges you to provide proof of your identity, and then verifies that proof before deciding whether to allow access. Authentication answers the question: Who are you?

Authentication requires credentials—evidence that verifies your identity. A username alone doesn't prove identity—it can be known or guessed by others. Adding a password provides a basic level of verification, but passwords can be stolen, guessed, or phished—making them one of the weakest forms of authentication on their own. Adding a stronger factor, such as a biometric or physical device, raises confidence significantly.

Authentication methods are built on three categories of proof, called authentication factors:

• **Something you know—a password, PIN, or security question
• **Something you have—a mobile device, hardware security key, or smart card
• **Something you are—a biometric characteristic like a fingerprint or facial scan

Using only one factor—such as a password alone—is called single-factor authentication. Single-factor authentication is common but vulnerable. If that single factor is compromised—a password stolen through phishing, for example—an attacker has everything they need to impersonate the user.

Multifactor authentication (MFA) strengthens authentication by requiring two or more factors from different categories. For example, signing in with a password (something you know) and then approving a notification on your phone (something you have). Because an attacker would need to compromise multiple independent credentials, MFA dramatically reduces the risk of account takeover.

After the system evaluates the credentials, authentication either succeeds or fails. Successful authentication confirms the identity and allows the process to continue. Failed authentication denies access before any resources are exposed. But authentication alone doesn't determine what you can do—it only confirms who you are. That's where authorization comes in.

Authorization

Authorization is the process of determining what an authenticated identity is allowed to do. Once authentication confirms your identity, authorization evaluates your permissions and decides whether to grant or deny access to specific resources—applications, files, data, or system features. Authorization answers the question: What are you allowed to do?

Authorization decisions are typically based on roles (such as employee, manager, or administrator), permissions (read, write, or delete), and attributes (department, location, or job function). The system evaluates these rules for each access request and grants or restricts access accordingly.

A key authorization concept is the principle of least privilege: users should have only the minimum access they need to perform their job, and no more. Limiting access reduces the potential damage from a compromised account, minimizes the risk of accidental data loss, and helps organizations meet their security and compliance requirements.

How authentication and authorization work together

Authentication and authorization are distinct processes, but they work together to protect resources. They always occur in a specific order: authentication happens first—at sign-in—and establishes who you are. Authorization happens after authentication and determines what you can access.

Think of it like checking into a hotel. You present your ID at the front desk, and the receptionist verifies who you are—that's authentication. You're then given a keycard that opens your room and the fitness center, but not other guests' rooms or staff areas—that's authorization.

Authorization can only happen after successful authentication. You can't determine what someone is permitted to do without first confirming their identity. And confirming identity alone—without checking permissions—leaves resources exposed. Together, authentication and authorization ensure that the right identities get the right access, and nothing more.