A developer is designing a web application and needs to verify that each person signing in is genuinely who they claim to be before any access decisions are made. Which identity concept describes this specific step, and which protocol does the Microsoft identity platform use to handle it?