Data protection in the cloud isn't just about locking the door; it's about knowing who owns the door, who holds the keys, and who is responsible for the walls. For the SC-100 exam, you must understand how this responsibility splits between you and your cloud provider for Platform as a Service (PaaS) and Software as a Service (SaaS) solutions. Getting this wrong is why companies get breached, and the exam will test your ability to draw these lines correctly.
Jump to a section
A simple way to picture Data Protection Strategies for PaaS and SaaS Solutions
A safety deposit box at a bank holds your most valuable physical items: your passport, a house deed, or a pile of cash. The bank provides the box, the vault, the guards, and the alarm system. You provide the key and decide who gets to unlock it. This is your Platform as a Service (PaaS) data protection strategy. You control the keys and the access permissions, but the bank handles the physical security of the vault walls and the floor.
Now consider a digital filing cabinet from a company like Dropbox or Google Drive. You rent space in their massive, shared storage facility. They manage the entire building: the locks on the doors, the fire suppression system, the guards at the entrance, and the backbone of the building. You just put your files in the drawer and trust the company to keep the whole building safe. This is your Software as a Service (SaaS) data protection strategy. You rely on the provider's overall security posture, but you are responsible for managing your own access keys and not leaving a window open in your own office.
The critical difference mirrors your life: with the safety deposit box (PaaS), you are actively responsible for locking and unlocking it. With the digital filing cabinet (SaaS), you are responsible for choosing a good provider and not sharing your password, but the building's security is their problem.
When you move your data to the cloud, you don't stop being responsible for it. You just share that responsibility with a provider. This is called the Shared Responsibility Model. It is the single most important concept for understanding cloud security.
Think of it like a house. If you own the house (on-premises IT), you are responsible for everything: the roof, the locks, the wiring, and the security cameras. If you move into a rented apartment, the landlord (cloud provider) is responsible for the building's structure and the main entrance lock, but you are responsible for locking your own door and not leaving your laptop on the front step.
In the cloud, there are three main service models, which change who is responsible for what:
Infrastructure as a Service (IaaS): You get access to virtualised hardware (servers, storage, networking). You manage the operating system, applications, and data. The provider manages the physical data centre, power, and network cabling.
Platform as a Service (PaaS): You get a platform to deploy your applications. You manage the data and the application code. The provider manages the runtime, operating system, and underlying hardware. Think of it like a pizza delivery service that provides the base, sauce, and cheese; you add your own toppings and bake it.
Software as a Service (SaaS): You use the provider's finished application (like Microsoft 365 or Salesforce). You manage the data you put into it and user access. The provider manages everything else: the application, the database, the servers, and the data centre. This is like eating at a restaurant: you don't manage the kitchen; you just eat the meal they provide.
Your responsibility for data protection shrinks dramatically as you move from IaaS to SaaS. With IaaS, you encrypt your own disks. With PaaS, you encrypt the data you send to the database. With SaaS, you rely on the provider's encryption, but you must still configure user permissions correctly.
There are three main strategies for protecting your data in PaaS and SaaS:
Encryption at rest: This means scrambling your data when it is stored on a disk. The provider handles this for many PaaS and SaaS services, but you may need to supply your own encryption key. If you do not use your own key, the provider can decrypt your data. That is poor security.
Encryption in transit: This means scrambling your data as it travels between your computer and the cloud, or between two cloud services. This is usually done with TLS (Transport Layer Security), which is the 'S' in HTTPS.
Access control: This means deciding exactly who can read, write, or delete your data. This is done through Identity and Access Management (IAM). You use Microsoft Entra ID to grant a user 'Reader' or 'Contributor' or 'Owner' permissions to a specific storage container.
For PaaS, a popular strategy is to use a service like Azure Key Vault. This is a secure locker where you store your secrets (like database passwords and encryption keys). Your application requests permission from Key Vault to access a key. The key never leaves the vault. This prevents developers from hardcoding passwords into their code, which is a massive security risk.
For SaaS, the most important strategy is to enforce Conditional Access policies. This is a rule in Microsoft Entra ID that says: 'Only allow access to this SaaS application if the user is on a company-managed device and is located in a trusted country.' If a user tries to log in from an internet café in a foreign country, the access is blocked. This protects your data inside the SaaS app even if the user's password is stolen.
Another key concept is Data Loss Prevention (DLP). This is a set of tools that scan your data flowing through SaaS apps (like email and SharePoint) and block sensitive information (like credit card numbers) from being sent outside the organisation. You configure policies that say, 'If someone tries to email a file containing a social security number, block it and alert the security team.'
Finally, you must consider backup and recovery. In PaaS, you are often responsible for backing up your database. Many PaaS services offer automated backups, but you need to configure them and test a restore. In SaaS, the provider usually retains deleted data for a limited time (e.g., 30 days for emails in Exchange Online). If you need longer retention, you must use a third-party backup tool or a retention policy within the service.
For the exam, you need to remember that the cloud provider is always responsible for the security of the cloud (the physical data centre). You are responsible for security in the cloud (configuring your services correctly). This line shifts depending on whether you are using IaaS, PaaS, or SaaS.
Classify Your Data
You first identify which data is sensitive (e.g., credit cards, health records). This classification determines which protection strategies to apply. In the SC-100 exam, this is the foundational step before any control is chosen.
Choose the Right Key for Encryption
You decide whether to use platform-managed keys (default, easier) or customer-managed keys (stronger compliance). For PaaS, you store your key in Azure Key Vault. This step is critical because the exam tests your decision based on a compliance requirement like 'your organisation must control its own encryption keys.'
Configure Identity and Access Control
You use Microsoft Entra ID to grant specific roles (e.g., Reader, Contributor, Owner) to users or applications that need access to the data in PaaS or SaaS. You never use a single master password. This directly prevents the 'stolen credential' attack.
Enforce Conditional Access for SaaS
You create a policy in Microsoft Entra ID that only allows access to the SaaS app (like Exchange Online) if the user is on a managed device and from a trusted location. This blocks attackers even if they have a valid password.
Set Up Data Loss Prevention (DLP) Policies
You define rules in Microsoft Purview that scan all data flowing through SaaS apps for patterns like credit cards. If a match is found, the system blocks the action and notifies the security team. This step protects against accidental data leaks by authorised users.
Configure Backup and Retention
For PaaS databases, you enable automated backups and define a retention period. For SaaS data, you apply retention labels (e.g., 'Keep for 7 years'). You also perform a test restore to ensure the data can be recovered. This step prevents permanent data loss from accidental deletion or ransomware.
An IT professional at a mid-sized retail company needs to protect customer data stored in a cloud-based e-commerce platform. The company uses a custom-built application running on Azure App Service (PaaS). They also use Microsoft 365 (SaaS) for email and file storage.
Step one: The architect performs a data classification exercise. They identify which data is 'Confidential' (customer credit card numbers, home addresses) and which is 'Public' (product descriptions). This classification drives the security controls. The customer credit card data must be encrypted at rest and in transit, and access must be tightly restricted.
Step two: For the PaaS application (Azure App Service), the architect configures a key vault. They generate a new encryption key and store it in Azure Key Vault. The application is configured to authenticate to Key Vault using a Managed Identity (a virtual identity for the service that does not require a password). When the application saves customer data to the database, it requests the encryption key from Key Vault, encrypts the data, and then stores the encrypted data. The database itself also has Transparent Data Encryption (TDE) enabled, which encrypts the entire database files at the disk level. This is a double layer of protection.
Step three: For the SaaS platform (Microsoft 365), the architect first ensures that all users accessing the tenant must use multi-factor authentication (MFA). They then create a Conditional Access policy in Microsoft Entra ID that blocks access to Microsoft 365 from any device that is not registered in the company's device management system (Microsoft Intune). This means a contractor's personal laptop cannot access company email, even if the contractor knows a valid password.
Step four: The architect configures a Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal. The policy scans all emails and files stored in SharePoint Online. If a user tries to share a file containing a credit card number with an external partner, the system blocks it and sends an automated notification to the security team. The policy also prevents users from copying sensitive data into a personal OneDrive account.
Step five: The architect sets up retention labels for the SaaS data. Emails from the finance department must be kept for seven years. A policy is created in Microsoft 365 that automatically applies the 'Retain for 7 years' label to all emails sent to or from the 'Finance' department. After seven years, the emails are automatically deleted. This satisfies legal requirements and prevents the company from hoarding unnecessary data (which reduces risk).
Step six: Finally, the architect tests the whole system. They simulate a security incident where an attacker gains access to an admin account in Microsoft 365. They confirm that the Conditional Access policy blocked the attacker because the attacker's device was not registered. They also confirm that even if the attacker had accessed an email, the DLP policy would have prevented them from exfiltrating credit card numbers.
The IT professional's daily work involves monitoring the logs from all these services using Microsoft Sentinel (a Security Information and Event Management tool). They watch for failed authentications, blocked DLP actions, and alerts from the key vault. If a failed attempt is detected, they investigate whether it is a legitimate mistake or an attack in progress.
The SC-100 exam will test your ability to design a strategy that assigns the correct security controls to the correct service model. You must not confuse which party is responsible for what. The exam loves to set traps by describing a scenario where the company is using PaaS for a database, and then asking who is responsible for patching the operating system. The answer is always the cloud provider for PaaS.
Key topics the exam tests:
Shared Responsibility Model: The exam will present a matrix of responsibilities (physical security, OS patching, application code, data). You must correctly place the responsibility for each layer for each service model (IaaS, PaaS, SaaS). This is a common drag-and-drop or multiple-select question.
Encryption key management: The exam tests whether you know the difference between 'Platform-managed keys' (default, provider holds the key) and 'Customer-managed keys' (you generate and store the key in a key vault). The correct answer for high-security environments is always 'Customer-managed keys' or 'BYOK (Bring Your Own Key)'. The exam will use scenarios where the organisation has a compliance requirement to control its own encryption keys.
Data classification and labelling: The exam will test how to protect data in SaaS services. You must know that Microsoft Purview Information Protection (formerly Azure Information Protection) is used to classify and label data. The exam will ask, 'What do you use to automatically apply a 'Confidential' label to documents containing a specific pattern (e.g., a credit card number)?' The answer is 'Auto-labelling policies in Microsoft Purview'.
Conditional Access: The exam will present a scenario where a user is working from a public Wi-Fi. It will ask, 'What policy should be applied to the SaaS app to ensure only trusted locations can access it?' The correct answer is 'Conditional Access' with a 'Location' condition.
Data Loss Prevention (DLP): The exam loves to ask about policies that prevent users from sharing sensitive data externally. You must know that DLP policies evaluate the content of data (using built-in sensitive information types like 'Credit Card Number' or 'Social Security Number') and can block the action or alert the user.
Retention and deletion: The exam will test the difference between 'Retention policy' (keeps data for a specified time) and 'Deletion policy' (removes data after a specified time). The trap is when an exam question says, 'We need to keep data for 10 years but also delete it after 10 years.' The correct answer is a 'Retention policy' that marks it as retained for 10 years and then deletes it.
Common exam traps:
Trap 1: The question asks, 'Who is responsible for securing the application code in a PaaS deployment?' The trap offers 'Cloud provider' as an option. The correct answer is 'Customer'. You control the app code; the provider only secures the platform it runs on.
Trap 2: The question says, 'You use SaaS for your email. You want to ensure emails are encrypted at rest. What do you do?' The trap is to suggest 'Enable BitLocker on your computer'. The correct answer is to 'Enable Microsoft-managed encryption for Exchange Online' or 'Use Customer Key' (a Microsoft 365 feature that lets you provide your own encryption key).
Trap 3: The question describes a hybrid scenario where a company uses both on-premises and cloud data storage. It asks, 'Which tool can discover and classify sensitive data across both environments?' The correct answer is 'Microsoft Purview Data Map' (a unified data governance service), not a tool that only works in one environment.
To pass, focus on memorising the responsibility boundaries for each service model and the names of the key Microsoft tools: Microsoft Entra ID (for identity), Microsoft Purview (for compliance and DLP), Azure Key Vault (for secrets), and Conditional Access (for access policies).
The Shared Responsibility Model dictates that you are always responsible for your data and who accesses it, regardless of whether you use IaaS, PaaS, or SaaS.
Encryption at rest protects data stored on a disk, but it does not protect you from an attacker with valid credentials who can decrypt and read the data.
For high-security environments, always use Customer-managed keys (CMK) stored in a key vault like Azure Key Vault, not the provider's default keys.
Data Loss Prevention (DLP) policies are your primary defence against accidental or malicious data leaks by authorised users from within your organisation.
Conditional Access policies in Microsoft Entra ID allow you to block access to SaaS applications based on user location, device health, and sign-in risk.
Retention policies in SaaS platforms automatically keep data for a required time and then delete it, helping you comply with legal regulations and reduce data risk.
In a PaaS model, you are responsible for the security of your application code and data; the provider manages the underlying operating system and runtime.
You must configure and test backups for your PaaS databases and SaaS data, as the provider is not responsible for restoring accidentally deleted data.
These come up on the exam all the time. Here's how to tell them apart.
Platform-managed keys
The cloud provider generates and stores the encryption key automatically.
You have minimal control over the key lifecycle and rotation schedule.
Simpler to set up but does not meet strict compliance requirements for key control.
Customer-managed keys (CMK)
You generate and store the key in your own key vault (e.g., Azure Key Vault).
You control when the key is rotated, revoked, or disabled.
More complex to configure but required for environments needing separation of duties.
Encryption at rest
Scrambles data when it is stored on a disk (in a database, on a server).
Protects against physical theft of the storage medium.
Does not protect data while it is being sent between services or users.
Encryption in transit
Scrambles data as it travels over a network (e.g., between a user's laptop and a cloud server).
Protects against eavesdropping on the network (e.g., Wi-Fi sniffing).
Does not protect data once it arrives at the destination and is stored.
Data Loss Prevention (DLP)
Scans the content of emails and files for sensitive patterns.
Blocks or alerts on the action of sharing sensitive data externally.
Operates after a user is already authenticated and authorised.
Conditional Access
Controls whether a user can even attempt to access an application.
Blocks access based on conditions like location, device, or sign-in risk.
Operates before a user is authenticated to the application.
Backup (point-in-time restore)
Restores a single database or file to a point in time (e.g., 30 minutes ago).
Protects against accidental deletion or corruption of a specific resource.
Usually within the same region or close to it.
Disaster Recovery (full site failover)
Recovers the entire application stack (whole virtual network, all servers) to a different region.
Protects against a regional outage (e.g., an earthquake taking out a data centre).
Requires a separate, fully provisioned environment in another region.
Role-Based Access Control (RBAC)
Defines roles (e.g., Reader, Contributor, Owner) that grant specific permissions to resources.
It is about what a user can do with data after they are inside.
Requires static assignment of roles to users or groups.
Conditional Access
Defines conditions (e.g., 'Only from a managed device') under which a user can sign in.
It is about whether a user is allowed to enter the application at all.
Evaluated dynamically at every sign-in attempt based on current conditions.
Mistake
If I use a SaaS service like Office 365, Microsoft automatically protects all my data from everything, including employee mistakes.
Correct
Microsoft secures the underlying service and infrastructure, but you are responsible for configuring access controls, enforcing password policies, and setting up Data Loss Prevention policies to protect your data from internal threats and user error.
People see the word 'Software as a Service' and wrongly assume that absolves them of all responsibility, like a tenant assuming the landlord vacuums their carpets.
Mistake
Encryption at rest is enough protection for data in PaaS. I do not need to worry about access control.
Correct
Encryption at rest protects data if the hard drive is stolen, but it does nothing if an authorised user’s account is compromised. An attacker with valid credentials can still read the decrypted data. Access control (who can read or write) is equally critical.
This mistake comes from over-focusing on the physical security of the hard drive and forgetting that the main attack vector is stolen credentials, not a stolen disk.
Mistake
Because I am using a cloud provider, I do not need to back up my data. The provider handles that automatically and indefinitely.
Correct
The provider offers tools for backup and redundancy, but they are often optional and charge additional fees. You are responsible for configuring backups and testing restores. The provider will delete your data if you stop paying or if you delete the resource manually.
People confuse high availability (the service staying online) with disaster recovery (restoring lost or corrupted data). A provider ensures uptime, not your ability to recover from a mistaken deletion at 2 AM.
Mistake
If I use Customer-managed keys (CMK) for encryption, the cloud provider cannot read my data under any circumstances.
Correct
CMK gives you control over the key lifecycle and who can decrypt your data, but if the provider’s infrastructure is compromised, they could still access the key in memory while the data is being decrypted. CMK significantly raises the bar for an attacker but is not a guarantee of absolute immunity.
This stems from a misunderstanding of how encryption works in the cloud. The key is stored in a hardware security module (HSM), but the decryption operation happens on the provider’s servers. A determined attacker with full control of the server could intercept the decrypted data briefly.
Mistake
Data Loss Prevention (DLP) is only for stopping hackers from stealing data from outside the company.
Correct
DLP’s primary purpose is to prevent accidental or malicious data leaks from inside the organisation by monitoring user behaviour. It blocks an employee from emailing a customer list to a personal email address or uploading a confidential file to an unapproved cloud service.
The word 'Loss' suggests theft by outsiders, but most data breaches involve a negligent or malicious insider. DLP is the tool that catches the insider, not the hacker at the firewall.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
It is a framework that defines which security tasks belong to you (the customer) and which belong to the cloud provider. For example, the provider is always responsible for the physical data centre, but you are always responsible for your data and who has access to it.
IaaS gives you virtual servers to manage yourself. PaaS gives you a platform to run your code without managing the servers. SaaS gives you access to a finished application like email. Your security responsibility decreases as you move from IaaS to SaaS.
A CMK is an encryption key that you generate and control, stored in a key vault like Azure Key Vault. You use it when you have a compliance requirement to control your own encryption keys or when you want to ensure the cloud provider cannot decrypt your data.
DLP is a set of policies that scan emails and files for sensitive information like credit card numbers. If a user tries to share that data externally, the policy can block the action, warn the user, or alert the security team.
It is a policy that controls access to cloud applications based on conditions like the user's location, the health of their device, or the sign-in risk. For example, you can block access to your SaaS email from any device that is not registered in your company.
The provider offers backup tools, but you must configure them and pay for them. They are not automatic by default. You are responsible for setting up a backup schedule and testing a restore to ensure your data is safe from accidental deletion or ransomware.
It is a secure, cloud-based locker that stores secrets like database passwords, API keys, and encryption keys. Your applications can securely request access to these secrets without having them hardcoded in the source code, reducing the risk of theft.
You've finished Data Protection Strategies for PaaS and SaaS Solutions. Continue through the SC-100 study guide to build a complete picture of the exam.
Done with this chapter?