The Azure shared responsibility model, made concrete

One of the most-tested Cloud Concepts ideas on the AZ-900 — and once you see where the line sits, it stops being intimidating. 2026 edition.

Here are 7 free shared-responsibility questions in the exam's own style, each tied to a real Azure situation and fully explained — no sign-up.

Straight to the 7 free questions ↓

The shared responsibility model is one of the ideas the AZ-900 comes back to again and again — and if it feels slippery right now, you are in good company. Almost everyone finds it fuzzy until they see it as a single picture. So start with the diagram above: a stack of seven layers, from the physical datacenter at the bottom to access management at the top, with three columns showing who owns each layer under IaaS, PaaS, and SaaS. Once that picture is in your head, most exam questions on this topic become a matter of pointing at the right layer.

The line moves — but only in the middle

Here is the whole model in one sentence: the more managed the service, the more of the stack Microsoft takes over — starting from the bottom. In IaaS (think Azure Virtual Machines) Microsoft owns the physical datacenter and the host and network infrastructure, while you own the operating system and everything above it. Move to PaaS (Azure App Service) and the operating system slides over to Microsoft too — you just bring your application and data. Move to SaaS (Microsoft 365) and the application itself becomes Microsoft’s, leaving you a thin, important strip at the top.

The key insight is that the boundary only ever moves through the middle of the stack. The bottom is always Microsoft’s. And the top — the highlighted band in the diagram — is always yours.

The four things that never leave your side

No matter which model you choose, four responsibilities stay with the customer: your data, your identities, your accounts, and access management. Learn these four words cold, because they answer a surprising share of the questions on this topic.

Data — you decide what is sensitive and who may read it. Microsoft secures the platform and hands you encryption and labels, but it never classifies your data for you.
Identities and accounts — you create users, you disable them when people leave, you decide how they authenticate.
Access management — you assign who may do what, and you enforce controls like multi-factor authentication.

This is why a question about switching on MFA in Microsoft 365 — a fully managed SaaS product — still lands on the customer. The application is Microsoft’s; the identity in front of it is yours.

Reading the layers Microsoft always owns

Just as the top never moves, the bottom never moves either. The physical datacenter — the building, the badge readers, the servers, the cabling — is Microsoft’s in every single model, IaaS included. This trips people up, because “full control of the operating system” in IaaS sounds like full control of everything. It is not: you manage the software from the OS up, never the hardware it runs on. The same goes for the host and physical network infrastructure. Watch for questions that hide two layers behind one word — “network” can mean the physical switches (always Microsoft) or your Network Security Group rules (always you).

Practise pointing at the right layer

Work through the seven questions below, and for each one, ask yourself which layer of the diagram it is really testing, and whether that layer is in the fixed top, the fixed bottom, or the moving middle. Read every explanation past the correct answer — the “Why not the others:” line is where this topic actually clicks, because the distractors are built from the exact confusions the exam wants to catch. The real test mixes multiple-choice, true/false, and drag-and-drop formats; our samples are standard multiple-choice, but the reasoning is identical. Get the layers straight here, and shared responsibility turns into one of the calmest, most predictable topics on your AZ-900.

A responsibility stack for the Microsoft Azure shared responsibility model, drawn as seven horizontal layers from bottom to top: physical datacenter, host and network infrastructure, operating system, application, then data, identities and accounts, and access management at the top. Three shaded columns to the right — IaaS, PaaS and SaaS — show who owns each layer. In IaaS, Microsoft owns the physical datacenter and host and network infrastructure while the customer owns the operating system, application, data, identities and access. In PaaS, the operating system also moves to Microsoft, leaving the customer the application, data, identities and access. In SaaS, the application too moves to Microsoft, so the customer owns only data, identities and accounts, and access management. The top three layers — data, identities and accounts, and access management — are highlighted with a bold border and a label reading always the customer, in every model, showing that these never transfer to Microsoft regardless of service model.

7 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 7

An auditor asks who is responsible for the physical security of the datacenter — the locked doors, badge access, and cameras — that houses the Azure Virtual Machines your company runs. Your VMs are IaaS, so you control the operating system. Who owns that physical security?

Answer: A — Microsoft, in every service model including IaaS.

The physical datacenter — the building, the badge readers, the cameras, the physical servers — is Microsoft's responsibility in every service model, IaaS included. 'Full control of the operating system' is not the same as owning the hardware it runs on; you never touch the physical layer. Why not the others: the customer never owns physical security, even in IaaS, because you have no physical access to Microsoft's facilities. It is not 'shared' at the physical layer — that layer is entirely Microsoft's. And there is no customer datacenter lease in the cloud; that is the on-premises model Azure replaces. Pro tip: the physical datacenter and its hardware are always Microsoft's, no matter how much of the software stack you manage.

AZ-900 Question 2 of 7

Your company uses Microsoft 365, a SaaS product. A security review finds that multi-factor authentication (MFA) has never been switched on for anyone. Who is responsible for configuring and enforcing MFA on those user accounts?

Answer: A — The customer — identities and access are yours even in SaaS.

Even when Microsoft runs the whole application, your identities and how they authenticate stay with you. Turning on MFA, choosing conditional access rules, and enforcing them is the customer's job in SaaS. Why not the others: 'Microsoft manages the whole app' is true of the software, but identity configuration is explicitly carved out as the customer's — SaaS shrinks your responsibility to a floor of data, identities, accounts, and access, and this is that floor. SaaS does not silently enable MFA for you; leaving it off is a customer misconfiguration. The ISP carries packets and has no role in your account security. Pro tip: if a question involves who signs in and how, it is an identity question — always yours.

AZ-900 Question 3 of 7

A team stores customer records in Azure. They ask whether Microsoft will classify which of those records are sensitive and decide who inside the company may read them. What is the correct answer under the shared responsibility model?

Answer: A — No — classifying data and deciding who may access it is always the customer's responsibility.

Data is the customer's responsibility in every model. Microsoft secures the platform the data sits on and offers tools such as encryption and sensitivity labels, but deciding what is sensitive and who may access it is yours to own — the data itself never becomes Microsoft's job. Why not the others: Microsoft does not classify or govern the meaning of your data by default; it cannot know which records are sensitive to your business. This does not change in SaaS — data responsibility is constant across IaaS, PaaS, and SaaS. Splitting it (Microsoft classifies, you set access) still hands Microsoft a responsibility it never holds. Pro tip: 'who should see this data' is a customer decision in all three models — the platform can enforce your rules, but it cannot write them.

AZ-900 Question 4 of 7

You are moving a web app off an Azure Virtual Machine (IaaS) and onto Azure App Service (PaaS). Which responsibility transfers from you to Microsoft as a result of that move?

Answer: A — Maintaining the underlying operating system and runtime.

Moving up from IaaS to PaaS hands Microsoft the layers below your code — the operating system and runtime it manages for you, which is exactly why PaaS means 'just deploy.' Why not the others: data, identities/accounts, and access management do not move — they stay the customer's responsibility in PaaS just as they were in IaaS and just as they will be in SaaS. That is the whole point of the highlighted band in the diagram: the top of the stack never transfers no matter which model you pick. Pro tip: when a workload moves toward more-managed services, the layers that shift to Microsoft are always at the bottom of the stack, never data or identity at the top.

AZ-900 Question 5 of 7

A network engineer configures Network Security Group (NSG) rules to control traffic to an Azure subnet, and asks whether they are also responsible for the physical network switches and cabling in the datacenter. Which statement is correct?

Answer: A — The customer owns the NSG rules; Microsoft owns the physical network hardware.

The host and physical network infrastructure — switches, cabling, the hypervisor — is Microsoft's in every model, while the virtual network controls you configure, like NSG rules, are yours. The word 'network' hides two different layers, and the exam tests whether you can split them. Why not the others: the customer never touches physical switches or cabling, so owning 'both' is wrong. Microsoft does not write your NSG rules — those are your configuration. And both are genuine security responsibilities, just owned by different parties. Pro tip: physical network = Microsoft; the virtual network settings you click to configure = customer. Same word, opposite sides of the line.

AZ-900 Question 6 of 7

An employee leaves the company. Under the shared responsibility model, who is responsible for removing that person's accounts and revoking their access across your Azure and Microsoft 365 environments?

Answer: A — The customer — managing accounts and access is your responsibility in every model.

Accounts and access management sit at the very top of the stack, and they are the customer's responsibility in IaaS, PaaS, and SaaS alike. Deprovisioning a departing employee — disabling accounts and revoking their access rights — is squarely your job. Why not the others: Microsoft secures the platform but does not know your org's joiners and leavers, so it cannot manage your accounts. The responsibility does not split by service model here; accounts and access never transfer to Microsoft. And returning a laptop does nothing to disable cloud identities. Pro tip: joiner/mover/leaver account tasks are always the customer's — the platform gives you the controls, but pressing the button is on you.

AZ-900 Question 7 of 7

Regardless of whether a workload runs on IaaS, PaaS, or SaaS, which set of responsibilities always remains the customer's?

Answer: A — Data, identities and accounts, and access management.

The shared responsibility model has a constant top and a shifting middle. Data, identities and accounts, and access management stay with the customer in all three models — that is the highlighted band in the diagram and the single most tested idea in this topic. Why not the others: the physical datacenter and host infrastructure are always Microsoft's, the opposite of the answer. The operating system is the customer's in IaaS but moves to Microsoft in PaaS and SaaS, so it is not constant. And you never patch a SaaS application's code — that is entirely Microsoft's. Pro tip: learn the four-word floor cold — data, identities, accounts, access — because those never leave your side of the line.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What is always the customer's responsibility in Azure, no matter the service model?

Four things stay with you in IaaS, PaaS, and SaaS alike: your data, your identities, your accounts, and access management. Microsoft secures the platform beneath them and gives you the tools — encryption, MFA, conditional access, role assignments — but deciding what your data means, who your users are, and who may do what is always your job. Everything below that band, from the operating system down to the physical building, shifts toward Microsoft as you move to more-managed services.

Does Microsoft ever take responsibility for securing my data?

No — not in the sense that matters for the exam. Microsoft protects the infrastructure your data sits on and provides encryption and access controls, but classifying which data is sensitive, deciding who may read it, and configuring those protections is always the customer's responsibility. The platform can enforce the rules you set; it cannot decide the rules for you. That is why 'data' sits in the band that never transfers to Microsoft, even in a fully managed SaaS product.

Are these real AZ-900 exam questions?

No. Every question here is written by us in the style and difficulty of the AZ-900, never copied from any question bank or the live exam. Reproducing real exam items breaks Microsoft's certification agreement and can cost a candidate their certification — and a crammed answer teaches you nothing about the one you have not seen. The value is in the reasoning behind each answer, which is what actually transfers to exam day.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.