Domain 1 is only 10–15% of the exam, but it is the vocabulary that the other 85% is written in. If you're fuzzy on "authentication vs authorization" or "who owns the OS in PaaS," you will lose points in domains 2 and 3 without realizing why.
This post covers it in four blocks, then gives you a lab and 12 questions.
This series follows the SC-900 objectives updated on July 28, 2026. Check the official study guide before your exam.
1. The shared responsibility model
The single most tested concept in this domain. Move to the cloud and Microsoft takes over some of the work — but not all of it, and how much depends on the service model.
Read the diagram top-down and one rule jumps out:
Data, devices, and accounts & identities are always yours. In every model. On-premises, IaaS, PaaS or SaaS.
That is the answer to a whole family of exam questions phrased like "Your company moves to SaaS. Who is responsible for protecting user identities?"
The rest shifts:
- On-premises: you own everything, down to the building.
- IaaS (virtual machines): Microsoft owns the physical layer; you still own the OS, patching, apps and network controls.
- PaaS (App Service, Azure SQL): Microsoft owns the OS and runtime; you own your app, your data and your identities.
- SaaS (Microsoft 365): Microsoft owns nearly the whole stack; you own data, devices, identities and how you configure it.
2. Zero Trust
Zero Trust replaced the old "castle and moat" idea, where anything inside the corporate network was trusted. That model broke the moment people started working from home on their own devices.
Three guiding principles:
- Verify explicitly — authenticate and authorize using every available signal: identity, location, device health, service, data classification, anomalies.
- Use least privilege access — just-enough-access (JEA), just-in-time (JIT), risk-based adaptive policies.
- Assume breach — segment access, encrypt end to end, use analytics to detect and improve defenses.
Six pillars to protect: identities, endpoints, applications, data, infrastructure, networks.
A phrase worth memorizing: "Zero Trust doesn't mean trusting no one; it means never trusting implicitly, and verifying every time."
3. Defense in depth and the CIA triad
Defense in depth = layers, so that a failure in one control doesn't reach the data. Classic layer stack from outside in: physical → identity and access → perimeter → network → compute → application → data.
The CIA triad is what every control ultimately serves:
| Property | Question it answers | Example control |
|---|---|---|
| Confidentiality | Can only authorized people read it? | Encryption, access control |
| Integrity | Is the data unaltered and trustworthy? | Hashing, digital signatures |
| Availability | Can authorized people reach it when needed? | Redundancy, backups, DDoS protection |
Also know the common threat vocabulary the exam uses: phishing, ransomware, data breach, dictionary/brute-force attack, password spray (one password against many accounts, which is why lockout policies alone don't catch it), and supply chain attack.
4. Cryptography basics: encryption, hashing, signing
The exam does not ask you to implement anything, but it does ask you to pick the right one.
| Technique | Reversible? | Keys | Used for |
|---|---|---|---|
| Symmetric encryption | Yes | One shared key for encrypt and decrypt | Bulk data, fast |
| Asymmetric encryption | Yes | Key pair: public + private | Key exchange, certificates, signatures |
| Hashing | No | None | Storing passwords, verifying integrity |
| Digital signature | n/a | Signed with private key, verified with public | Proving origin and integrity (non-repudiation) |
Two traps:
- Hashing is not encryption. There is no "unhash." Same input always gives the same hash; that's why passwords are stored hashed (and salted).
- You encrypt with the recipient's public key; you sign with your own private key. Reversing those two is the most common mistake.
Also know data states: data at rest (in storage), data in transit (moving over a network), data in use (loaded in memory). Different states need different protections.
5. Authentication vs authorization
- Authentication (AuthN) proves who you are.
- Authorization (AuthZ) decides what you're allowed to do.
AuthN always happens first. Single sign-on (SSO) means you authenticate once and access many applications — it is an authentication benefit, not an authorization one.
Identity vocabulary to have ready:
- Identity provider (IdP): the service that verifies identity and issues tokens (Microsoft Entra ID is one).
- Federation: a trust relationship that lets an IdP in one organization vouch for a user accessing another organization's resources.
- Identity as the security perimeter: the modern replacement for the network perimeter — the "four pillars" being administration, authentication, authorization and auditing.
⚠️ Exam traps in this domain
- "Who is responsible for the operating system in IaaS?" → The customer. Microsoft only owns the physical layer and hypervisor.
- Hashing vs encryption → if the question says "must be verified but never recovered," it's hashing.
- SSO is an authentication convenience; it does not grant permissions.
- Zero Trust is not a product. You cannot buy it. It's a strategy implemented with many products.
- Federation vs SSO → federation is the trust between organizations; SSO is the user experience.
🎯 Now practise it: 12 questions + both labs
Reading about Zero Trust and answering an exam question about Zero Trust are two different skills, and only one of them is graded on exam day.
So the practice for this domain lives in an interactive page instead of a list you can scroll past:
👉 Take the Part 1 quiz and labs
What you get:
- 12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. That reasoning is the actual skill: the exam is won by elimination, not by recognition.
- Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
- Lab 1 — shared responsibility. Fill the table from memory. It grades every cell and gives you the corrections.
- Lab 2 — map your own laptop to Zero Trust. Six pillars, and it tells you which ones you left blank. Those blanks are your real gap list.
Free, no sign-up, works on your phone. It's a single static page — nothing is collected.
Then come back and comment your score out of 12, and which question caught you. I use those comments to improve the series.
What's next
Part 2 covers Microsoft Entra — 25–30% of the exam, and the domain where a single licensing detail (P1 vs P2) decides several questions. We'll build users, groups and a Conditional Access policy in the free lab.
If you found an error or something changed in a newer exam update, drop a comment — I keep these posts edited.
Top comments (0)