Authentication versus authorization
Answer: Authentication proves which identity is making a request; authorization decides whether that identity may perform the requested action on the target resource.
Administrator playbook
Decide, verify, and document
Use the curated answer as a starting point, then prove the outcome against the target tenant or device.
What it means
- A valid token can authenticate a caller that is still unauthorized
- Authentication failures often produce 401-class behavior; authorization failures often produce 403-class behavior
- Conditional Access can affect token issuance before resource authorization occurs
What to check next
- Confirm token validity, tenant, issuer, and audience first
- Then inspect scopes, roles, resource ownership, and service-side policy
- Use correlation IDs and authoritative logs to locate the controlling decision
Verify success
- Confirm the object type and identifier in the authoritative tenant.
- Compare the portal value with Microsoft Graph or the local device state.
- Use IDs—not display names—when proving that two references point to the same object.
Escalate when
- Two portals or APIs return conflicting identifiers for the same expected object.
- The issue crosses tenant or cloud boundaries.
- A production authorization decision depends on the object relationship.
Copyable admin briefAnswer, next checks, source, and review date
Inspect Microsoft Graph context
Get-MgContext | Select-Object ClientId,TenantId,Account,AuthType,ScopesRead-only. Useful when a term or identifier is being interpreted in the wrong tenant.
Evidence to preserve
- Authentication
- Who are you?
- Authorization
- What may you do?
- Evidence
- Token plus resource logs
- Tenant ID and cloud
- Object type and object ID
- User, app, or device context
- Where the value was observed