Customer Responsibilities in Azure SQL Database Shared Responsibility Model
A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?
Quick Answer
The answer is managing access controls and authentication for database users. This is correct because in the shared responsibility model for Azure SQL Database, Microsoft secures the physical infrastructure, operating system, and platform patches, while the customer retains ownership of all data and identity management. Specifically, tasks like configuring logins, users, and permissions via T-SQL or Azure Active Directory, as well as enforcing row-level security or dynamic data masking, fall entirely on the customer. On the SC-900 exam, this concept tests your understanding of the boundary between Microsoft’s “security of the cloud” and the customer’s “security in the cloud.” A common trap is assuming Microsoft handles all database security, but the key distinction is that the customer controls who gets in and what they can do. Remember it as: Microsoft locks the doors, but you decide who has the keys.
⚠ Common exam trap
Many candidates confuse PaaS with IaaS and assume the customer is responsible for patching or hypervisor security, but in Azure SQL Database (PaaS), Microsoft handles all infrastructure layers, leaving the customer only with data and access control responsibilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing access controls and authentication for database users
In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Azure Active Directory, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the physical servers hosting the database
Why it's wrong here
Physical server patching is the responsibility of the cloud provider (Microsoft) in a PaaS service like Azure SQL Database.
When this WOULD be correct
This would be correct in an on-premises scenario or an Infrastructure as a Service (IaaS) model where the customer manages the underlying infrastructure, such as patching physical servers hosting a SQL Server on a virtual machine.
- ✓
Managing access controls and authentication for database users
Why this is correct
The customer retains responsibility for managing user identities, permissions, and authentication to the database.
- ✗
Securing the hypervisor running the virtual machines
Why it's wrong here
Hypervisor security is provided by the cloud provider as part of the underlying infrastructure.
When this WOULD be correct
In a question about an on-premises or IaaS scenario where the customer manages the virtual machines, such as 'A company deploys SQL Server on a self-managed Azure VM. According to the shared responsibility model, which security task remains the customer's responsibility?'
- ✗
Hardening the network firewalls at the datacenter perimeter
Why it's wrong here
Physical network security is the responsibility of the cloud provider.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Managing access controls and authentication for database usersCorrect answer▾
Why this is correct
The customer retains responsibility for managing user identities, permissions, and authentication to the database.
✗Patching the physical servers hosting the databaseWrong answer — click to see why▾
Why this is wrong here
In Azure SQL Database, patching physical servers is the responsibility of Microsoft as the cloud provider, not the customer, because it is a Platform as a Service (PaaS) offering.
★ When this WOULD be the correct answer
This would be correct in an on-premises scenario or an Infrastructure as a Service (IaaS) model where the customer manages the underlying infrastructure, such as patching physical servers hosting a SQL Server on a virtual machine.
Why candidates choose this
Candidates may confuse PaaS with IaaS or on-premises responsibilities, assuming that all patching tasks remain with the customer regardless of the service model.
✗Securing the hypervisor running the virtual machinesWrong answer — click to see why▾
Why this is wrong here
In Azure SQL Database, the hypervisor is managed by Microsoft as part of the infrastructure layer, not the customer. The shared responsibility model assigns physical and hypervisor security to the cloud provider.
★ When this WOULD be the correct answer
In a question about an on-premises or IaaS scenario where the customer manages the virtual machines, such as 'A company deploys SQL Server on a self-managed Azure VM. According to the shared responsibility model, which security task remains the customer's responsibility?'
Why candidates choose this
Candidates may confuse PaaS (Azure SQL Database) with IaaS, where the customer is responsible for securing the guest OS and hypervisor-related configurations, or they may overestimate customer responsibility for virtualization security.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?
medium- A.Physical security of the data centers
- ✓ B.Patching the guest operating system and applications
- C.Ensuring the hypervisor is secured
- D.Maintaining the network infrastructure
Why B: In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.