Describe cloud concepts →easyMultiple ChoiceObjective-mapped

MS-900 Describe cloud concepts Practice Question

In a Software as a Service (SaaS) model, which of the following responsibilities is typically handled by the cloud provider?

⚠ Common exam trap

Many exam-takers confuse 'backing up customer data' (Option D) as a provider responsibility, but in SaaS, the provider ensures infrastructure redundancy, while the customer must configure and verify their own backup and recovery policies, such as using Microsoft 365 Backup or third-party tools.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Patching the underlying operating system and application

In a SaaS model, the cloud provider is responsible for managing the underlying infrastructure, including patching the operating system and the application itself. This is a core tenet of the shared responsibility model, where the provider handles the security and maintenance of the software stack, while the customer is responsible for data and user access. For example, in Microsoft 365, Microsoft automatically applies security updates to Exchange Online and SharePoint without customer intervention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Managing user passwords and accounts
Why it's wrong here
In a SaaS model, identity administration is a customer-side control: Microsoft Entra ID (Azure AD) is the directory service, but your admins manage user objects, password policy, MFA, self-service password reset, and access reviews. Microsoft provides and patches the directory service itself, but it does not create your accounts or reset user credentials. Therefore, this is a customer responsibility, not a provider-owned patch/update duty.
✓
Patching the underlying operating system and application
Why this is correct
For Microsoft 365, Microsoft handles patching the underlying Windows Server operating systems, the hypervisor/fabric, Exchange Online mailboxes, SharePoint servers, and Teams services because the customer never has administrative access to the VM or host OS. The provider applies security and feature updates on a continuous deployment schedule to maintain service availability and protection. This is exactly the kind of infrastructure maintenance that remains with the SaaS vendor, unlike tenant configuration or user administration.
✗
Configuring application settings for the organization
Why it's wrong here
Application settings that determine how a tenant behaves—such as SharePoint external sharing, Teams meeting policies, Exchange transport rules, and user role assignments—are configured by customer administrators in the Microsoft 365 admin center, PowerShell, or Microsoft Graph. Microsoft's responsibility is to expose those management interfaces and keep the service running; it does not set organizational policies for each customer. Because this work is done per tenant with customer-chosen values, it falls on the customer, not the provider.
✗
Backing up customer data
Why it's wrong here
Customer-created data is subject to a shared-responsibility data protection model: Microsoft maintains infrastructure redundancy and service SLAs, but it does not guarantee point-in-time recovery of user content after accidental deletion, malware, or insider threat. Native Microsoft 365 capabilities such as SharePoint versioning, OneDrive recycle bin, and Exchange litigation hold are retention/recovery aids, not a substitute for a customer backup strategy. To meet their own RPO/RTO targets, tenants typically use Microsoft Purview eDiscovery/exports or third-party backup services.

Go deeper

MS-900 Describe cloud concepts Practice Question

Why each option matters

Option-by-option breakdown

Related to this question