"In Microsoft 365, authorization decisions typically happen after a user or app is authenticated and determine which resources, data, or actions that…

The statement is a correct definition of authorization within the context of identity and access management. Authentication confirms an identity's credentials (who they are), while authorization determines what that authenticated identity is permitted to do. In Microsoft 365, this is managed through mechanisms like Role-Based Access Control (RBAC), access control lists (ACLs), and policies such as Conditional Access, which grant or deny access to specific resources and actions.

This is a true/false style question where the provided statement is factually correct. There are no other options to evaluate as incorrect. The statement accurately describes the security principle of authorization following authentication.

1. Microsoft Learn. "Authentication vs. authorization." Microsoft identity platform documentation. "Authentication (sometimes shortened to AuthN) is the process of proving you are who you say you are... Authorization (sometimes shortened to AuthZ) is the act of granting an authenticated party permission to do something. It specifies what data you're allowed to access and what you can do with it."

2. Microsoft Learn. "Microsoft Entra permissions and consent." Microsoft Entra documentation. "Authorization is the process of granting permission to an authenticated identity (a user

group

or service principal) to access a resource."