The last post was all about proving who you are. This one is about the next question that follows straight after: now that we know who you are, what are you actually allowed to do? That’s authorization, and this unit is where roles, groups, and permissions all click into place for me.
Authentication vs authorization: the distinction that matters
I want to nail this down early because the exam almost certainly will too. Authentication confirms identity — are you really you? Authorization decides what you’re allowed to do once that’s settled — what can you see, open, or change? Microsoft 365 leans hard on the principle of least privilege here: give people access to exactly what they need for their job, nothing more.
There are really three layers to how this gets enforced:
- Roles — broad administrative capabilities across the tenant.
- Resource-specific permissions — access to one particular thing, like a SharePoint document or a Teams channel.
- Conditional Access — dynamic, context-aware rules layered on top of both.
Role-based access control (RBAC)
RBAC is the backbone of admin-level authorization. Roles are built into Entra ID and are service-specific:
- Global Administrator — full control over everything, deliberately limited to a small number of trusted people.
- Exchange Administrator, SharePoint Administrator, Teams Administrator, User Administrator, and more — each scoped to their own service.
- Custom roles — for when the built-in roles don’t quite fit.
The exam-relevant point here: RBAC roles are about administrative capability, not everyday resource access. That’s a separate mechanism entirely.
Resource-specific access: where most users actually live
For non-admin users, access usually comes from group membership or permissions on a specific resource, not from any global role. SharePoint is the textbook example, because permissions can be set at the site, library, folder, or even individual file level, using built-in roles:
- Visitor — read-only
- Member — can edit
- Owner — full control
The unit’s example with Sarah stuck with me: she’s a Member of the “Marketing Team” group, so she can edit content on the team site — but she’s also temporarily added as a Visitor to a separate “Event Planning” site, where she can only view, not edit. Same person, two completely different permission levels, depending entirely on which resource and which role applies there.
Advanced authorization: beyond simple allow/deny
A few tools push authorization from a static yes/no into something dynamic and time-bound:
- Conditional Access — access rules based on risk, device compliance, location, or app sensitivity. Example: require MFA for financial data on a personal device, or block SharePoint entirely from outside the corporate network.
- Privileged Identity Management (PIM) — just-in-time elevation for admin roles, so an Exchange Administrator role might only be active for the specific window a task requires, then it’s automatically revoked.
- Access Packages — bundles of permissions across multiple resources, assigned through approval workflows. Great for onboarding a new hire or an external collaborator who needs a defined set of access for a limited time.
- Sensitivity labels — these follow the document, not just the access point. Even after someone has legitimate access, a label can still block printing, copying, or forwarding. Authorization travels with the content itself, wherever it ends up.
Put together, these tools move Microsoft 365 authorization from a single gate at the front door to something closer to Zero Trust’s “verify explicitly” applied continuously, at the resource level.
Users and groups: the objects doing the work
Users are individual identities in Entra ID, each with a unique username (User Principal Name), credentials, licenses, and role or group memberships. They might be employees, external guests, or even service accounts for automation.
Groups are how permissions scale — instead of granting access user by user, you assign the group, and membership does the rest. There are five types, and this is the part I really needed to drill into, since the names sound similar but behave quite differently:
| Group type | Grants resource access? | Sends email? | Notes |
|---|---|---|---|
| Security group | Yes | No | Pure access control — no mailbox, no calendar |
| Microsoft 365 group | Yes | Yes (shared mailbox) | Full collaboration bundle: mailbox, calendar, SharePoint library, Planner, optional Teams |
| Mail-enabled security group | Yes | Yes | Security group that can also act as a distribution list |
| Distribution group | No | Yes | Pure email list, no resource access at all |
| Dynamic group | Depends (Security or M365 type) | Depends | Membership is automatic, based on attributes like Department — no manual add/remove |
The one that trips people up: a Distribution group looks similar to a Mail-enabled security group, but only the mail-enabled security group can actually grant access to resources. A Distribution group is email-only — it can’t touch SharePoint, Teams, or Exchange permissions at all.
Dynamic groups are the other standout for me. Instead of an admin manually adding and removing people, membership updates automatically based on attributes — “Department = Sales” means anyone who moves into or out of Sales gets added or removed without any admin action. That’s a big deal in an organisation where people change roles often. The catch: because membership is rule-based, you can’t manually add or remove individuals from a dynamic group — the attribute is the only lever.
Where group administration happens
- Microsoft 365 admin center — everyday tasks: create a group, add/remove members. Good for smaller environments.
- Microsoft Entra admin center — more advanced work: configuring dynamic group rules, tying Conditional Access to group membership, reviewing sign-in and audit logs.
- PowerShell and Microsoft Graph API — for scale and automation, like bulk-adding users to a group, or syncing group membership automatically from an HR system when someone joins or changes department.
My takeaway
The theme running through this whole unit is that groups aren’t just an organisational convenience — they’re a security control. Assigning access to individuals one by one is exactly the kind of inconsistency Zero Trust is trying to eliminate. Get someone into the right group on day one, and both their access and their eventual offboarding become automatic instead of something someone has to remember to clean up later.
Practice quiz: managing access and permissions
Q1. What is the key difference between authentication and authorization?
- A) Authentication decides what you can do; authorization confirms who you are
- B) Authentication confirms who you are; authorization decides what you’re allowed to do
- C) They are the same process performed twice for redundancy
- D) Authorization always happens before authentication
Q2. Which role grants full control over all Microsoft 365 settings and services, and is typically limited to a small number of trusted individuals?
- A) SharePoint Administrator
- B) Teams Administrator
- C) Global Administrator
- D) User Administrator
Q3. A user is a Member of one SharePoint site (can edit) and a Visitor on a different site (view only). What does this demonstrate?
- A) RBAC roles override resource-specific permissions
- B) Permissions can be assigned independently at the resource level, separate from any admin role
- C) The user must be a Global Administrator to have two different permission levels
- D) SharePoint doesn’t support different permission levels per site
Q4. Which tool provides just-in-time elevation to an administrative role, automatically revoking access once an approved time window ends?
- A) Access Packages
- B) Privileged Identity Management (PIM)
- C) Dynamic groups
- D) Sensitivity labels
Q5. A sensitivity label restricts printing and forwarding of a document, even after a user has legitimate access to open it. What does this illustrate?
- A) Sensitivity labels only apply before access is granted, not after
- B) Authorization can travel with the content itself, not just control the initial access point
- C) Sensitivity labels replace the need for RBAC
- D) Sensitivity labels only work within SharePoint, not other apps
Q6. Which group type grants access to resources like SharePoint or Exchange, but does NOT come with its own mailbox or calendar?
- A) Microsoft 365 group
- B) Security group
- C) Distribution group
- D) Dynamic group (Microsoft 365 type)
Q7. Which group type automatically provisions a shared mailbox, calendar, SharePoint library, Planner board, and optional Teams workspace when created?
- A) Security group
- B) Distribution group
- C) Microsoft 365 group
- D) Mail-enabled security group
Q8. What is the key limitation of a standard Distribution group compared to a Mail-enabled security group?
- A) A Distribution group cannot be used to send email at all
- B) A Distribution group cannot be used to assign permissions to Microsoft 365 resources
- C) A Distribution group requires PIM to function
- D) A Distribution group can only be created via PowerShell
Q9. A dynamic group is configured with the rule “Department = Sales.” What happens when an employee moves from Sales to Marketing?
- A) An admin must manually remove them from the group
- B) They are automatically removed from the group without admin action
- C) They remain in the group permanently regardless of department changes
- D) The entire group must be recreated
Q10. Can an administrator manually add an individual user to a dynamic group?
- A) Yes, at any time, in addition to the automatic rule
- B) No, membership in a dynamic group is based only on user attributes, not manual assignment
- C) Yes, but only for Microsoft 365-type dynamic groups
- D) Yes, but only during initial group creation
Q11. Which tool would an organisation use to configure dynamic group membership rules and review group-based sign-in audit logs?
- A) Microsoft 365 admin center
- B) Microsoft Entra admin center
- C) Microsoft Planner
- D) Microsoft Viva Learning
Q12. An organisation wants to bulk-add hundreds of users to a security group in a single automated operation. Which tool is best suited to this?
- A) Microsoft 365 admin center (manual entry)
- B) PowerShell or Microsoft Graph API
- C) SharePoint site permissions page
- D) Access Packages only
Answers
- B — Authentication proves identity; authorization determines what that identity is permitted to do afterward. They’re sequential, not interchangeable.
- C — Global Administrator has full tenant-wide control and is deliberately restricted to very few accounts due to its scope.
- B — Resource-specific permissions (like SharePoint site roles) operate independently of any tenant-wide admin role, allowing different access levels per resource for the same person.
- B — PIM provides time-bound, just-in-time elevation with automatic expiry, reducing standing privileged access.
- B — Sensitivity labels enforce restrictions at the content level, so protection follows the document regardless of where it’s stored or opened.
- B — Security groups control access only — no mailbox, calendar, or other shared collaboration tools attached.
- C — Microsoft 365 groups automatically provision the full collaboration bundle: mailbox, calendar, SharePoint library, Planner, and optional Teams.
- B — Distribution groups are email-only; they cannot be used to assign resource permissions, unlike Mail-enabled security groups.
- B — Dynamic group membership updates automatically based on the attribute rule — no manual admin action required when the attribute changes.
- B — Dynamic group membership is entirely rule-based; individuals can’t be manually added or removed.
- B — The Microsoft Entra admin center provides advanced identity controls, including dynamic group rule configuration and audit/sign-in log visibility.
- B — PowerShell and Microsoft Graph API are built for bulk, automated operations at scale, unlike the admin center’s manual interface.
That’s it for this one — wait until the next post!
