Your Account Has an Identity. Your Access Has Limits.

Every time you sign in to a Montclair system, more is happening than just entering a password. Behind the scenes, security controls are working to verify your identity and determine what information and systems you can access. Two key parts of that process are authentication and authorization.

Authentication vs. Authorization: What’s the Difference?

Authentication and authorization are two separate steps that work together every time you access a digital account or system. Authentication verifies your identity, while authorization determines what that verified identity is allowed to access or do.

Think of it this way: proving that you are a student, employee, or other member of the university community doesn't automatically give you access to every system or piece of information. Your identity must first be verified, and then the system checks your permissions to determine what you can access.

Understanding the difference can help you better understand why your login credentials, MFA, and access permissions all play an important role in protecting university systems and information.

Authentication: Proving Who You Are

Authentication is the process of confirming your identity. It answers the question: “Are you really you?”

When you log in to a university system, you may authenticate yourself by using:

• Your NetID and password
• A Duo Mobile approval
• A security key

Multi-factor authentication (MFA) adds another layer of protection by requiring more than one way to verify your identity. Even if someone gets your password, MFA can make it much harder for them to access your account.

At Montclair, Duo MFA helps verify your identity when you access university systems. Your password proves what you know, while Duo provides an additional way to verify that it is really you.

Authorization: Determining What You Can Access

Once your identity has been verified, authorization determines what you are allowed to do.

It answers the question: “What are you allowed to see or use?”

Your access is typically based on your role, responsibilities, or the permissions assigned to your account. For example:

• A student may be able to view their grades but not change them.
• An employee may have access to certain systems based on their job responsibilities.
• A manager may be authorized to approve requests that other employees cannot.

Authorization helps organizations follow the principle of least privilege, which means users should have only the access they need to perform their role.

Think of It Like a Campus Building

Imagine you're entering a campus building.

Authentication is showing your ID card at the door to prove who you are.

Authorization determines which rooms you're allowed to enter once you're inside.

You might be a verified member of the campus community, but that doesn't mean you automatically have access to every office, classroom, laboratory, or restricted area.

The same concept applies to your digital accounts.

Why Both Matter

You interact with authentication and authorization every time you use a Montclair system, even if you don't see these processes happening. When you sign in with your NetID and approve a Duo request, you're authenticating your identity. When that system determines which information, tools, or features you can access, that's authorization at work.

Understanding the difference can help you recognize why protecting your credentials and MFA approvals matters, and why you may have access to some university resources but not others.

Authentication verifies you. Authorization determines your access. Both help keep your digital campus experience secure.

Want to Learn More?

FTC | Use Two-Factor Authentication To Protect Your Accounts

FTC | Creating Strong Passwords and Other Ways To Protect Your Accounts

National Cybersecurity Alliance | What is Multifactor Authentication (MFA) and How Do You Enable It?

National Cybersecurity Alliance | Online Safety Basics