Authorization decision

As explained in Azure Security

Authorization is the process of determining whether an authenticated identity has permission to perform a requested action on a system or resource.

Authorization determines whether an authenticated user or application may access a system or resource and perform a requested action. In Azure, the decision is based on permissions associated with an assigned role. section 2.3

Authorization answers two operational questions:

• What can the identity access? section 2.1
• What actions can the identity perform on specific resources? section 2.1
• Which permissions should be grouped into a role rather than assigned individually? section 2.3

Azure role-based access control (Azure RBAC) provides the platform authorization mechanism. Assigning roles to users or groups supports granular access management and avoids the tedious, error-prone process of maintaining custom permissions for every user. section 2.3.1 section 2.3

Different duties, different roles

Azure RBAC can allow one administrator group to manage virtual machines, one user to manage virtual machines, another to manage SQL databases, or application developers to manage resources within a resource group. section 2.3.1

Figure 2.1 Understanding the four pillars of identity on which the IAM system is usually built

Use the four-pillar model to distinguish authorization from authentication, administration, and auditing. section 2.1

How Azure Security covers it

How deep it goes

Defines role-based permission decisions and introduces Azure RBAC, but does not detail configuration procedures.

Examples

Uses virtual machine administration, SQL database management, and resource-group management to illustrate differentiated roles.

What it assumes

Assumes understanding of authenticated identities and distinguishes authorization from identity verification.

What you can do after

Apply Azure RBAC by assigning appropriate permission sets to users or groups for Azure resource tasks.

How it connects

Connects authorization with authentication, administration, auditing, identity governance, and role-based access control.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionAn authorization decision is the determination of whether a principal is allowed to perform an action on a resource.
• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreAuthorization is the process of determining whether an authenticated or anonymous caller is permitted to access a resource or perform an operation.
• 

  liveBookmanning.com
  Grokking Web Application SecurityAn authorization decision is a determination of whether an authenticated principal may access a resource or perform an action.
• 

  liveBookmanning.com
  Pro ASP.NET Core 7, Tenth EditionAuthorization is the process of determining whether an authenticated principal may access a resource or perform an operation.
• 

  liveBookmanning.com
  Google Anthos in ActionAuthorization is the process of determining which actions or resources an authenticated actor is permitted to access.
• 

  liveBookmanning.com
  The Well-Grounded Python Developer: How the pros use Python and FlaskAuthorization is the process of determining which actions or resources an authenticated user or system is permitted to access.

Compare how 7 books explain authorization decision →

Related concepts

• policy engineproduced by · A policy engine is a software component that evaluates policies against requests, resources, actions, or other inputs and produces decisions or enforcement outcomes.
• authenticationcontrasts with · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• identityuses · Identity is the property or representation by which an entity is distinguished and recognized as that particular entity.
• role-based access controlimplemented by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
• authorize attributeconfigured by · The ASP.NET Core Authorize attribute declares that an endpoint or application component requires authentication or satisfaction of specified authorization requirements.
• authorizationpart of · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.