A municipal HR and payroll team wants clerks to prove who they are before anyone grants SharePoint edit rights on employee files. Which distinction best describes that separation?

Authentication verifies that a municipal HR or payroll clerk is the claimed identity before Microsoft 365 trusts the session. Authorization is a separate decision that grants or denies SharePoint edit rights on employee files after that identity is known. The municipal HR and payroll scenario needs both layers: identity proof first, then least-privilege library permissions so clerks can update only the payroll folders they are entitled to change. Treating authorization as the identity-proof step and authentication as the rights-granting step is how over-permissioned employee libraries happen in city tenants.

Claiming authorization verifies identity at sign-in while authentication assigns SharePoint edit rights fails because authentication is the identity-proof step, and authorization is the entitlement step that grants or denies rights. Reversing the order—authorization with a password first, authentication later deciding folders—fails because credentials and MFA prove who you are, while SharePoint roles and ACLs decide what that identity may edit after sign-in. Swapping the domains so authentication manages SharePoint permission levels and authorization manages Entra password policies fails because authentication governs identity proof and credential rules, while authorization governs access rights and SharePoint permissions.

Exam caveat: AB-900 tests the conceptual split, not deep Entra Conditional Access authoring or SharePoint permission-inheritance labs. Do not equate MFA success with Owner rights, and do not confuse authentication with SharePoint permission management or authorization with Entra password policies. Municipal payroll content remains subject to both strong sign-in and explicit authorization.

Operational check: Confirm clerks must authenticate (including any required MFA), then verify SharePoint permissions separately—Member/Edit only on the payroll libraries they need, Visitors or no access elsewhere. Attempt edit with an authenticated account that lacks site permissions and confirm the change is denied. Review group-based SharePoint access so HR membership changes add or remove edit rights without blurring identity proof and entitlement.