Design security solutions for infrastructure · Topic 4 of 6
Securing SaaS, PaaS and IaaS Services
SC-100 services: shared responsibility, security baselines for SaaS, PaaS and IaaS, web and IoT workload requirements, private endpoints and WAF.
- 5 min
- You always own identity, data and endpoints, in every model. IaaS adds OS and runtime. PaaS adds configuration. SaaS is mostly identity, data and access.
- Each Azure service has an MCSB aligned security baseline. Enforce with Azure Policy and measure in Defender for Cloud.
- PaaS: private endpoints, managed identities, Entra auth, disable key based access, diagnostic logs.
What it is
Every cloud service model splits security work between the provider and you. The more the provider manages, the less you configure, but you are always responsible for identity, data and access. This topic is about specifying security baselines for SaaS, PaaS and IaaS, and the requirements for common workload types: web and IoT.
How it works
Shared responsibility
| Layer | On premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Physical datacenter and network | You | Provider | Provider | Provider |
| Host and virtualization | You | Provider | Provider | Provider |
| Operating system | You | You | Provider | Provider |
| Application runtime | You | You | Provider | Provider |
| Application | You | You | You | Provider |
| Identity and access | You | You | You | You |
| Data and its classification | You | You | You | You |
| Endpoints and clients | You | You | You | You |
Security baselines
A baseline is the minimum set of security settings every instance of a service must have. Microsoft publishes a security baseline for each Azure service, mapped to the Microsoft Cloud Security Benchmark, which lists the controls and how that service meets them. Use these as the starting point and enforce them with Azure Policy, measure them in Defender for Cloud, and handle exceptions through a documented process.
IaaS baseline (virtual machines, VM scale sets)
- Harden images from a trusted golden image, with Trusted Launch and encryption at host.
- Patch with Azure Update Manager. Run EDR (Defender for Servers).
- No public management ports. Use JIT access and Azure Bastion. Apply NSGs and restrict outbound traffic.
- Entra ID login and Azure RBAC rather than local accounts. Use LAPS for any local admin.
- Backup and monitoring (Azure Monitor Agent, Defender for Servers).
PaaS baseline (App Service, SQL, Storage, Key Vault, Cosmos DB)
- Private endpoints and disabled public network access wherever possible, with firewall rules or service endpoints otherwise.
- Managed identities and Microsoft Entra authentication instead of keys, passwords and connection strings. Disable local or key based authentication where supported.
- Encryption in transit (minimum TLS 1.2, HTTPS only) and at rest, with customer managed keys where required.
- Diagnostic logging to a central workspace.
- Defender plan for the service and Azure Policy to enforce configuration.
- Least privilege Azure RBAC and resource locks on critical resources.
SaaS baseline (Microsoft 365, Salesforce, Dropbox and similar)
- Single sign on through Entra ID and Conditional Access, with strong authentication and compliant device requirements.
- Provisioning and deprovisioning (SCIM) so leavers lose access.
- Defender for Cloud Apps for discovery, session control, anomaly detection and policies, including its SaaS security posture management that checks the configuration of connected apps.
- Data protection: sensitivity labels, DLP and encryption provided by the SaaS or Purview.
- App governance and consent controls, and tenant restrictions to stop corporate users signing into other tenants.
- Review admin roles and OAuth permissions regularly.
Web workloads
Web apps face the internet, so require:
| Control | Detail |
|---|---|
| HTTPS only and strong TLS | Redirect HTTP, minimum TLS 1.2, managed certificates |
| Web Application Firewall | Azure Application Gateway WAF (regional) or Azure Front Door WAF (global) to block OWASP style attacks and bots |
| DDoS protection | Azure DDoS Protection on public IP resources |
| Authentication | Entra ID, App Service authentication, managed identities to back ends |
| Network isolation | Private endpoints and VNet integration. Access restrictions on App Service |
| Secrets | Key Vault references instead of app settings with secrets |
| Disable unneeded surfaces | Turn off FTP and basic authentication on App Service |
| Monitoring | Application Insights, WAF logs to Sentinel, Defender for App Service |
IoT workloads
For cloud side IoT: IoT Hub with per device identity (X.509 or TPM) rather than shared keys, private endpoints to IoT Hub, role based access for operators, message routing to protected endpoints, Defender for IoT and Defender for Cloud for monitoring, and device update management. See the endpoint topic for the device side.
Choosing quickly
| Requirement | Answer |
|---|---|
| Remove credentials from an app calling Azure SQL | Managed identity with Entra authentication |
| Keep a storage account off the internet | Private endpoint and disabled public network access |
| Stop users signing in to unsanctioned SaaS tenants | Tenant restrictions |
| Protect a global web app against common exploits | Azure Front Door with WAF |
| Check configuration of connected SaaS apps | SaaS security posture management in Defender for Cloud Apps |
A worked scenario
A company runs a customer portal on App Service with Azure SQL, uses Salesforce and keeps legacy VMs. The architect specifies private endpoints and Entra authentication for SQL, managed identities for the app, Front Door WAF in front, and Key Vault references. For Salesforce, SSO with Conditional Access and SaaS posture checks. For the VMs, Trusted Launch, Update Manager, JIT access and Defender for Servers. All baselines are enforced with Azure Policy.
What to remember for the exam
- You always own identity, data and endpoints, in every model. IaaS adds OS and runtime. PaaS adds configuration. SaaS is mostly identity, data and access.
- Each Azure service has an MCSB aligned security baseline. Enforce with Azure Policy and measure in Defender for Cloud.
- PaaS: private endpoints, managed identities, Entra auth, disable key based access, diagnostic logs.
- SaaS: SSO, Conditional Access, Defender for Cloud Apps, SSPM, tenant restrictions.
- Web: WAF, DDoS, HTTPS, access restrictions. IoT: per device identity.
When a question says "remove the need for connection strings", the answer is a managed identity with Microsoft Entra authentication.
How the exam asks about this
- "Which party patches the operating system in IaaS?" The customer.
- "Disable access keys and require Entra ID for a data service." Disable local or key authentication and use RBAC.
- "Prevent a PaaS database from being reached from the internet." Private endpoint and no public network access.
- "Identify misconfigured settings in connected SaaS apps." SaaS security posture management.
Common mistakes
Assuming the provider secures data. Data and identity are always yours.
Public endpoints with firewalls only. Private endpoints remove the exposure.
Using shared keys for services. Keys leak and cannot be tied to a person or app.
No baseline enforcement. Documents do not stop drift. Policy does.
Check yourself
Who is always responsible for identity and data in IaaS, PaaS and SaaS?
The customer.
Which feature removes the need to store credentials in an Azure app?
Managed identities with Microsoft Entra authentication.
Where do you find the recommended settings for a specific Azure service?
The service's security baseline aligned to the Microsoft Cloud Security Benchmark.
Topic 4 of 6 in Design security solutions for infrastructure
Test yourself on Design security solutions for infrastructure
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.