What you'll learn
- AuthN vs AuthZ
- MFA and phishing resistance
- Federation and SSO
- Privileged access
Lessons
1AuthN vs AuthZ
Authentication proves who you are; authorization decides what you can do. Models: RBAC (roles), ABAC (attributes such as department, device, location), and ReBAC (relationships).
2MFA and phishing resistance
SMS and push codes can be phished or fatigued. FIDO2/passkeys and certificate-based auth bind the login to the real site, so a fake page cannot replay them. Use number matching on push, and Conditional Access to require compliant devices.
3Federation and SSO
- SAML 2.0: XML assertions, common in enterprise SaaS.
- OAuth 2.0: delegated authorization (access tokens).
- OpenID Connect: identity layer on OAuth (ID tokens).
- Watch for over-permissioned OAuth app consents and stolen session tokens.
4Privileged access
Use separate admin accounts, just-in-time elevation (PIM), a PAM vault with session recording, and tiering so domain admins never log into workstations. Remove standing access and review entitlements quarterly.
Hands-on lab: Audit sign-in hygiene in a test tenant
- Create a free Microsoft Entra or Google Workspace trial tenant.
- List all users and flag any without MFA registered.
- Create a Conditional Access policy requiring MFA for all admins.
- Enable a passkey for your own test account.
- Review enterprise app consents and remove any unused ones.
Outcome: A baseline identity posture checklist.
Practice questions
Which MFA method resists phishing best?
Answer: FIDO2 passkey. FIDO2 binds to the origin, so phishing sites can't relay it.
OIDC adds what to OAuth 2.0?
Answer: An identity layer (ID token). OIDC defines the ID token for authentication.
Just-in-time admin access reduces…
Answer: Standing privilege. Privilege exists only when needed.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Least privilege
- Granting only the minimum access needed to perform a task.
- MFA
- Multi-factor authentication: two or more of something you know, have or are.
- Passkey
- A FIDO2 credential bound to a site's origin, resistant to phishing.
- SAML
- XML-based standard for exchanging authentication assertions between IdP and service provider.
- OAuth 2.0
- Framework for delegated authorization using access tokens.
- OIDC
- OpenID Connect: identity layer on OAuth 2.0 using ID tokens.
- PAM
- Privileged Access Management: vaulting, brokering and recording admin access.
- JIT access
- Just-in-time elevation that grants privilege only when needed and for a limited time.
- Conditional Access
- Policy engine that grants access based on user, device, location and risk signals.
- RBAC
- Role-Based Access Control: permissions assigned to roles, roles to users.
See the full cyber security glossary →
Official references
Related courses
Network Security
Protocols, segmentation, firewalls, IDS/IPS and how to read traffic like an analyst.
Cloud Security
Shared responsibility, cloud identity, misconfigurations, CSPM and workload protection on Azure, AWS and GCP.
Cryptography & PKI
Symmetric vs asymmetric crypto, hashing, TLS, certificates and the move to post-quantum.