Translate the authorization policies into expressions, Identify the resources you want to protect, Define the authorization policies ***You should perform all the listed steps and then use that information to determine what claim types, resource properties, and device claims you must create to deploy the desired policies.