For authorization, Azure Active Directory delivers many methods. As we already discussed in Chapter 2, Planing and Designing Cloud Identities groups are a preferred way of providing users with the correct permissions and access to their applications. It's good practice that users work with the Access Control Panel UI and access their applications, change the password, and add verification options. With this option, you can also allow the user to build his own preferred workplace. For example he can add his own applications and leave the passwords secure in Azure Active Directory, benefitting from SSO.
Generally, Azure Active Directory provides three main concepts for authorization:
Direct: The user will be directly authorized
Group-based: Rule based or Delegated
Role-based: The developer can publish his own application roles
The following figure shows the complete context:
The following section describes the different methods for these...