L7 · IDENTITY FUNDAMENTALS
Grant one thing, deny another
Create a role with one permission, assign it to a test user, and see one action allowed and one denied.
Planned
Steps
In your test tenant, create a role with a single permission.
What the server will check: Your tenant's Audit shows the role being created.
Assign the role to a test user that the lab creates.
What the server will check: Audit shows the assignment.
Sign in as the test user and try one allowed action and one that needs another permission.
What the server will check: One permitted and one rejected operation for that user.
The server decides each request from the user's current roles, not from what the screen shows.
When it opens
This lab is planned. It opens when these are in place:
- Lab setup and cleanup in your test tenant
- Custom roles for tenant users
The server checks your test tenant's history for this attempt. You can review the events yourself in your tenant's Audit and Logs.