Watch the explanation. Practice the skill.
Identity, authorization, privacy, and data protection
Enforce the same access rule on every route to data.
Captions appear here during playback.
Identity, authorization, privacy, and data protection
Enforce the same access rule on every route to data.
Video playback is unavailable. Read the descriptive transcript below, go directly to practice, or open the video file.
Source-based teaching example · Fictional data · Reviewed 2026-10-03. Microsoft Mark · locally synthesized. On a small screen, use fullscreen for diagram details or read the transcript.
Read the descriptive transcript
0:00 · What you will learn
Enforce the same access rule on every route to data.
What appears on screen
Enforce the same access rule on every route to data.
0:06 · The idea
Check identity and permission before revealing records. Apply that rule to search, caches, exports and logs. If required identity information is missing, deny rather than guess.
What appears on screen
Check identity and permission before revealing records. Apply that rule to search, caches, exports and logs. If required identity information is missing, deny rather than guess.
0:21 · One useful term
Tenant. An organization or user group whose data must remain separated from others.
What appears on screen
An organization or user group whose data must remain separated from others.
0:30 · A worked example
The two-tenant exercise tests direct reads, cached reads, export and log access. Missing tenant information leads to denial with a limited audit record.
What appears on screen
The two-tenant exercise tests direct reads, cached reads, export and log access. Missing tenant information leads to denial with a limited audit record.
0:44 · Your turn to think
Is a prompt instruction enough to repair a leaking cache path? Pause and decide before continuing.
What appears on screen
Is a prompt instruction enough to repair a leaking cache path? Pause the video if you need more time.
1:01 · Why this answer works
No. Repair shared access enforcement and every caller. Deleted resources and unknown identity must stay blocked.
What appears on screen
No. Repair shared access enforcement and every caller. Deleted resources and unknown identity must stay blocked.
1:12 · Check 1
Test every path to the record.
What appears on screen
Test every path to the record.
1:17 · Check 2
Deny missing or invalid identity.
What appears on screen
Deny missing or invalid identity.
1:22 · Check 3
Keep audit records limited to allowed metadata.
What appears on screen
Keep audit records limited to allowed metadata.
1:28 · Now try a different case
Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.
What appears on screen
Open the lesson Try the new case Check and revise The full task and its requirements are in the linked lesson.
Watching explains the example. Complete the lesson practice to check what you can do. Explore all visual lessons →