- What authentication and authorization each decide
- How to split sign-in, share links and app permissions into the two
- Why you need both stronger sign-in and narrower permissions
The short answer
Authentication checks whether the person trying to use a service is really who they say they are. Authorization decides what that verified person is allowed to do. Being able to sign in is not the same as being allowed to do everything. To use a service safely, you need both: stronger authentication, and authorization (permissions) limited to what each person needs.
How the two differ
An office building makes a good comparison. Showing your staff badge at reception to get in is authentication. The badge only opening certain rooms is authorization.
| Authentication | Authorization | |
|---|---|---|
| What it checks | Whether you are who you claim to be | What you are allowed to do |
| Everyday examples | Password, verification code, fingerprint or face | View only, can edit, administrator |
| If it is weak | Someone else can pretend to be you | Even the real user can do more than they need to |
| Where to review it | Sign-in settings | Permission and sharing settings |
Authentication comes first and authorization second. But authorization is not decided by authentication alone. The same person may be allowed different things depending on the work they are responsible for.
Two checks that happen behind a sign-in
- Password
- Multi-factor authentication (two or more factors)
→ Confirms who you are
- What you can view or change
- Shared links and app permissions
→ Decides what you are allowed to do
Splitting everyday cases into the two
For example:
- Signing in: Entering your ID and password is authentication. Whether you can then see the accounting data is authorization.
- Two-step verification: Entering a code after your password strengthens authentication. It does not give you any extra permissions.
- Share links: A setting such as "anyone with the link can view" may, depending on the service, allow viewing without signing in. That is close to handing out authorization while skipping authentication, so check who receives the link and how long it stays valid.
- App permissions: A screen asking "Allow this app to view your calendar?" is mainly about authorization. Check what you allowed and whether you can revoke it later.
Stronger authentication: multi-factor authentication
The Cybersecurity Site for the Public, run by Japan's Ministry of Internal Affairs and Communications, describes multi-factor authentication as combining two or more of the three authentication factors: something you know, something you have, and something you are (biometrics). Adding a code sent to your phone (something you have) to your password (something you know) is one example. The same page encourages using it whenever the system you use offers it.
Setting names and steps differ by service. Check the help pages of the service you use.
Reviewing authorization: only the permissions people need
The site's page on access control says it is important not to give every user every permission, but to allow only the people who need it the minimum access they need. It also calls for reviewing access whenever people change roles or leave, and for regular audits of who has access.
However strong your authentication is, if everyone who signs in can do anything, a hijacked account can cause wide damage. And even with narrow permissions, weak password-only sign-in leaves the entrance poorly protected. The two measures do different jobs. Our related article on least privilege explains how to divide permissions by role.
In summary
Checklist
- Do you think about authentication (who you are) and authorization (what you may do) separately?
- Have you checked whether your important services let you turn on multi-factor authentication?
- Have you checked who can open your share links and until when?
- Have you reviewed what you have allowed apps to do?
- Do you have a step for reviewing permissions when people change roles or leave?
One thing to check today
Write down one service where you hold administrator rights, and ask yourself whether your current work really needs them.