Checking who is requesting access
Authentication is the identity check performed when a person or application signs in. Microsoft’s authentication overview describes this role in access to services and devices. Authorisation is the separate decision about what that identity is allowed to do. A customer may successfully sign in to a portal without having permission to see another customer’s documents. Both checks matter: a working login screen does not demonstrate that the records behind it are correctly protected.
Example: a customer document portal
A portal might identify a customer through an established identity provider and then apply account-specific permissions to each document request. Staff accounts need their own access rules, including who can upload, approve or remove files. Shared logins make it difficult to identify who performed an action and complicate access removal when someone leaves. During development, test a normal customer account and a limited staff account, rather than viewing everything only through an administrator account with unrestricted permissions.
Manage access throughout its lifecycle
Plan enrolment, multi-factor authentication where appropriate, recovery and offboarding together. A strong sign-in method is undermined if account recovery is easy to misuse or former staff keep access. For software integrations, use the provider’s supported authentication approach and keep credentials out of public page code. Refined IT can help map identities and permissions across websites, portals and business applications. The handover should record account ownership and how access is reviewed, so the business is not dependent on one person remembering which accounts were created.
Common questions about authentication
Are authentication and authorisation interchangeable?
No. Authentication checks identity; authorisation determines permitted actions and resources. Applications need appropriate checks for both.
Does multi-factor authentication remove every risk?
No. It adds protection, but account recovery, device security, permissions and staff processes still need attention. Choose methods appropriate to the systems involved.
Related definitions
- Multi-factor authentication — An identity check that uses more than one type of evidence, reducing dependence on a password alone.
- Portal — A controlled online space where customers, members or suppliers can access relevant information, submit requests or complete tasks.
- API integration — A connection that uses software interfaces to exchange information or coordinate actions between systems, with authentication, validation and error handling.
- HTTPS — HTTP delivered over an encrypted TLS connection. It protects information in transit and authenticates the connection to the server; it does not by itself make an application secure.
Related SEO guides
Keep customer accounts protected while making the public pages intended for search accessible without a login.
For help connecting these decisions with your website, explore our SEO services or start with an SEO audit.
Put it into practice
Explore our cyber security services service or talk with Refined IT about applying this to your website or business systems.