Identity, authorization, privacy, and data protection
Enforce the same access rule on every route to data.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Enforce the same access rule on every route to data.

Visual description:
Enforce the same access rule on every route to data.

00:00:06.000 — The idea

Check identity and permission before revealing records. Apply that rule to search, caches, exports and logs. If required identity information is missing, deny rather than guess.

Visual description:
Check identity and permission before revealing records. Apply that rule to search, caches, exports and logs. If required identity information is missing, deny rather than guess.

00:00:21.833 — One useful term

Tenant. An organization or user group whose data must remain separated from others.

Visual description:
An organization or user group whose data must remain separated from others.

00:00:30.583 — A worked example

The two-tenant exercise tests direct reads, cached reads, export and log access. Missing tenant information leads to denial with a limited audit record.

Visual description:
The two-tenant exercise tests direct reads, cached reads, export and log access. Missing tenant information leads to denial with a limited audit record.

00:00:44.250 — Your turn to think

Is a prompt instruction enough to repair a leaking cache path? Pause and decide before continuing.

Visual description:
Is a prompt instruction enough to repair a leaking cache path?
Pause the video if you need more time.

00:01:01.458 — Why this answer works

No. Repair shared access enforcement and every caller. Deleted resources and unknown identity must stay blocked.

Visual description:
No. Repair shared access enforcement and every caller. Deleted resources and unknown identity must stay blocked.

00:01:12.333 — Check 1

Test every path to the record.

Visual description:
Test every path to the record.

00:01:17.208 — Check 2

Deny missing or invalid identity.

Visual description:
Deny missing or invalid identity.

00:01:22.375 — Check 3

Keep audit records limited to allowed metadata.

Visual description:
Keep audit records limited to allowed metadata.

00:01:28.208 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.