Security, Compliance and Identity Concepts · Topic 1 of 3
Shared Responsibility and Defense in Depth
SC-900 shared responsibility model and defense in depth: what the customer and Microsoft each secure in IaaS, PaaS and SaaS, and the seven layers of protection.
- 5 min
- Includes a diagram
- Microsoft always secures the physical datacenter, network and hosts.
- The customer always owns its data, its identities and users, and its configurations and settings.
- The more managed the service, the more responsibility passes to Microsoft.
What it is
When you use a cloud service, security is a partnership. The shared responsibility model says which duties belong to the cloud provider and which stay with you.
Defense in depth is the idea that no single control is enough, so protection is built in several layers. If one layer fails, the next one still stands in the attacker's way.
How it works
The responsibility split
Some duties never move. Microsoft always secures the physical datacenter, the physical network and the physical hosts. The customer always remains responsible for its information and data, its identities and users and its configurations and settings, whatever service type it uses.
The duties in between change with the type of service. As you move from running everything yourself toward software as a service, more of them pass to Microsoft.
| Responsibility | On premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Information and data | Customer | Customer | Customer | Customer |
| Identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts, network and datacenter | Customer | Microsoft | Microsoft | Microsoft |
On premises, you own every layer. With infrastructure as a service, such as a virtual machine, Microsoft runs the hardware but you patch the operating system. With platform as a service, Microsoft also looks after the operating system. With software as a service, such as Microsoft 365, you mostly manage your data, users and settings.
The cloud service types
- Infrastructure as a service (IaaS) gives you virtual machines and networks to manage yourself.
- Platform as a service (PaaS) gives you a managed platform on which to run your own code or database.
- Software as a service (SaaS) gives you a finished application that you configure and use.
Defense in depth
Security is arranged in seven layers, from the outside in.
| Layer | Example protection |
|---|---|
| Physical security | Locked datacenters, badge access |
| Identity and access | Multifactor authentication, Conditional Access |
| Perimeter | Protection against distributed denial of service attacks |
| Network | Segmentation and firewalls that limit traffic |
| Compute | Patched virtual machines and endpoint protection |
| Application | Secure code, no exposed secrets |
| Data | Encryption of stored and transmitted data |
The layers work together. An attacker who steals a password still meets the multifactor prompt, the network controls and finally encrypted data.
A worked scenario
A company runs its order system on Azure virtual machines and uses Microsoft 365 for email. For the virtual machines, the company patches the operating system, configures the network rules and protects the data, while Microsoft secures the datacenter and the physical hosts. For Microsoft 365, Microsoft runs the application and the operating system, and the company still decides who has accounts, how they sign in, and who can open which data. In both cases, the data and the identities remain the company's job.
Walking one service through the model
Take Azure SQL Database, a platform as a service. Microsoft patches the database engine and the operating system underneath it, and runs the physical datacenter. The customer still decides who may connect, creates the accounts, chooses the encryption settings, and is responsible for the information stored in the tables. If the customer leaves a firewall rule open to the whole internet, that is the customer's mistake, not Microsoft's.
Now take Microsoft 365, a software as a service. Microsoft runs the application, the servers and the network. The customer chooses who has a mailbox, requires multifactor authentication, labels sensitive files and manages the devices that open them.
Which Microsoft tool belongs to which layer?
| Layer | Example Microsoft tool |
|---|---|
| Physical security | Microsoft datacenter controls |
| Identity and access | Microsoft Entra ID and Conditional Access |
| Perimeter | Azure DDoS Protection |
| Network | Network security groups and Azure Firewall |
| Compute | Microsoft Defender for Servers and Defender for Endpoint |
| Application | Web Application Firewall and secure code practices |
| Data | Encryption, sensitivity labels and Azure Key Vault |
Compliance and the shared model
Microsoft's audits cover Microsoft's part of the model. They do not cover the choices the customer makes in its own subscription. That is why an organisation reads Microsoft's audit reports, but still has to show that it configured its own part correctly.
What to remember for the exam
- Microsoft always secures the physical datacenter, network and hosts.
- The customer always owns its data, its identities and users, and its configurations and settings.
- The more managed the service, the more responsibility passes to Microsoft.
- The service types are IaaS, PaaS and SaaS.
- Defense in depth has seven layers, and the point is that layers back each other up.
When a question asks what is the customer's responsibility "in every deployment type", answer information and data, or identities and users.
How the exam asks about this
- "Which responsibility always stays with the customer?" Information and data.
- "Who patches the operating system on a virtual machine?" The customer, in IaaS.
- "Which layer of defense in depth includes multifactor authentication?" Identity and access.
- "Why use several layers of protection?" So one failure does not expose everything.
Common mistakes
Thinking the cloud provider secures everything. Data, identities and configuration remain yours in every model.
Assuming SaaS removes all customer duties. You still manage users, permissions and data.
Confusing the perimeter with the network layer. The perimeter handles attacks from outside, such as denial of service. The network layer limits movement inside, with segmentation.
Treating defense in depth as one product. It is a strategy of many controls, not a tool.
Check yourself
Which responsibilities always belong to the customer?
Information and data, identities and users, and configurations and settings.
Who is responsible for the operating system in IaaS?
The customer.
What is defense in depth?
Protecting resources with several layers so that a failure in one layer does not expose everything.
Topic 1 of 3 in Security, Compliance and Identity Concepts
Test yourself on Security, Compliance and Identity Concepts
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.