What Is Authorisation? Types, Examples, and How It Works

What Is Authorisation? Types, Examples, and How It Works 

In today's digital-first business environment, protecting sensitive information is more important than ever. Whether employees are accessing Microsoft 365, SharePoint, Teams, cloud applications, or customer data, organisations need to ensure users can only access information that is relevant to their role. 

This is where authorisation plays a critical role. 

While authorisation is often mentioned alongside authentication, the two serve different purposes. Authentication verifies who a user is, while authorisation determines what that user is allowed to access after successfully signing in. 

Understanding authorisation is essential for businesses looking to strengthen security, reduce data exposure, and implement effective access controls. 

What Is Authorisation? 

Authorisation is the process of determining whether an authenticated user, application, or device has permission to access a specific resource or perform a particular action. 

Put simply: 

• Authentication answers the question: Who are you? 
• Authorisation answers the question: What are you allowed to do? 

For example, after signing into Microsoft 365 with a username, password, and Multi-Factor Authentication (MFA), the system checks assigned permissions to determine whether the user can: 

• Access SharePoint sites 
• View confidential documents 
• Manage users 
• Access company financial records 
• Configure Microsoft 365 settings 
• Administer security policies 

Even though two users may successfully sign in, their access levels can be completely different based on their permissions. 

If you are unfamiliar with identity verification, you may find our article on Authentication helpful, as authentication and authorisation work together to secure business systems. 

How Authorisation Works 

Authorisation typically occurs immediately after authentication has been completed. 

The process usually follows these steps: 

• A user signs into an application. 
• The application verifies the user's identity through authentication. 
• The system evaluates assigned permissions, roles, or policies. 
• Access is granted or denied. 
• The user is allowed to perform only approved actions. 

Consider a Customer Relationship Management (CRM) system: 

• A Sales Representative may be permitted to view customer information. 
• A Sales Manager may be able to edit customer records. 
• An IT Administrator may be allowed to manage system settings and user accounts. 

Although all three users access the same application, authorisation controls what each individual can actually do within that system. 

Why Authorisation Is Important 

Without authorisation controls, any authenticated user could potentially access all information within a system. 

Effective authorisation helps organisations: 

• Protect sensitive business data 
• Prevent unauthorised access 
• Reduce insider threats 
• Minimise accidental data exposure 
• Meet compliance requirements 
• Enforce company security policies 

Authorisation also supports the Principle of Least Privilege, which states that users should only be granted the minimum level of access required to perform their responsibilities. 

This principle is one of the foundations of modern cybersecurity and Zero Trust security strategies. 

Common Types of Authorisation 

1. Role-Based Access Control (RBAC): is one of the most common authorisation models used by businesses. 

Users are assigned a role, and permissions are assigned to the role rather than directly to the user. 

2. Attribute-Based Access Control (ABAC): grants access based on attributes and conditions. These attributes may include: 

• Department 
• Job title 
• Device type 
• Geographic location 
• Time of day 
• User risk level 

For example: Allow access to financial records only if the user belongs to the Finance department and is accessing the application from a company-managed device. 

ABAC provides more granular control than traditional role-based models. 

3. Discretionary Access Control (DAC): With DAC, the owner of a resource determines who can access it. 

For example, within SharePoint or OneDrive, a document owner may: 

• Share a file with specific people 
• Grant editing permissions 
• Remove access when required 

This model offers flexibility but requires users to manage permissions responsibly. 

4. Mandatory Access Control (MAC): This is commonly used in highly regulated environments. 

Resources may be assigned classifications such as: 

• Public 
• Confidential 
• Restricted 
• Highly Restricted 

Users can only access information appropriate to their clearance level. 

Real-World Examples of Authorisation 

Small Business Example 

Imagine a local accountancy firm with 15 employees using Microsoft 365 to manage client information and internal documents. 

Different team members require different levels of access: 

• Accountants can access client financial records. 
• Administrative staff can manage appointments and correspondence. 
• The business owner can access all company information and settings. 
• Contractors can access only project-specific folders. 

Although everyone signs into the same Microsoft 365 tenant, authorisation ensures users can only access information necessary for their role. 

This significantly reduces the risk of accidental data exposure and helps protect confidential client data. 

Medium-Sized Business Example 

Now consider a manufacturing organisation with 300 employees spread across multiple departments. 

Using proper authorisation controls: 

• HR staff can access employee records. 
• Finance teams can access payroll and financial systems. 
• Sales teams can manage customer data. 
• Operations staff can access production information. 
• IT administrators can manage devices and security policies. 
• Executives can access company-wide reporting and analytics. 

By assigning permissions based on roles, the organisation maintains security while ensuring employees have the resources they need to perform their duties efficiently. 

Microsoft 365 Example 

Microsoft 365 relies heavily on authorisation. 

Permissions determine whether users can: 

• Access SharePoint sites 
• Join Teams channels 
• View confidential documents 
• Access shared mailboxes 
• Create Power Automate workflows 
• Manage Exchange Online settings 
• Access Microsoft Entra ID administration portals 

For example, a standard employee may be able to access departmental resources, while a Global Administrator can manage tenant-wide security configurations and user accounts. 

This separation of permissions helps protect business-critical systems while supporting collaboration and productivity. 

If your organisation uses Microsoft Entra ID, authorisation can be further enhanced through Conditional Access Policies, which evaluate factors such as device compliance, location, and sign-in risk before granting access. 

Authorisation Best Practices 

To strengthen access security, organisations should adopt the following best practices. 

Apply Least Privilege Access 

Only grant users access to the systems and resources required to perform their roles. 

Conduct Regular Access Reviews 

Review permissions regularly to identify: 

• Excessive privileges 
• Dormant accounts 
• Former employee accounts 
• Unused access rights 

Use Role-Based Access Control 

Managing permissions through groups and roles reduces complexity and improves consistency. 

Implement Conditional Access 

Microsoft Entra ID Conditional Access enables organisations to make intelligent authorisation decisions based on: 

• Device compliance 
• User risk 
• Location 
• Application sensitivity 

Monitor and Audit Permissions 

Regular auditing helps identify unusual access patterns and ensures permissions remain aligned with business requirements. 

Authorisation vs Authentication 

Many people confuse authentication and authorisation. 

Authorisation is a fundamental component of modern cybersecurity. It ensures authenticated users only have access to the resources and information required for their role. 

Whether you're a small business protecting client information or a growing organisation managing hundreds of employees, implementing strong authorisation controls can help: 

• Improve security 
• Reduce insider threats 
• Minimise accidental data exposure 
• Support compliance requirements 
• Protect sensitive business information 

As organisations continue to adopt cloud technologies, remote working, and digital transformation initiatives, effective authorisation becomes increasingly important for maintaining a secure and productive environment. 

Need Help Securing Your Business? 

At Dolphin IT Solutions, we help organisations implement secure access controls, Microsoft 365 security solutions, Microsoft Entra ID, Conditional Access policies, identity management, and cybersecurity best practices. 

Whether you're reviewing user permissions, securing Microsoft 365, or adopting a Zero Trust approach to security, our team can help strengthen your organisation's security posture. 

Contact us today to learn how we can help protect your users, data, and systems.