Authentication (AuthN) proves that a person or service is who they claim to be, for example with a password, MFA, or a passkey. Authorization (AuthZ) happens afterward and defines what that authenticated identity can do or access.
In SC-900 it is a concept question: "the system checks whether the user has read permission on the folder" is authorization. With identity as the primary security perimeter, both processes are centralized in an identity provider such as Microsoft Entra ID.
Authentication vs. authorization is a concept that can show up on the exam. Check the full guide to see it in context.