MSDEVBUILD / azure

Security in the Cloud

Physical Identity Perimeter Network Compute & app 🔒DATA ✕ ✕ ✕ ✕ 🚫 attacks blocked
Layer after layer of protection surrounds your data, so attacks are stopped long before they reach it.

😟 THE PROBLEM

Servers in an office cupboard, patched “when someone remembers”.

😊 THE SOLUTION

Use Azure’s layers of security and its tools to protect your part.

  • Anyone can walk into the server room✓ Guarded Microsoft datacenters
  • Floods of fake traffic take the site down✓ Azure DDoS Protection
  • Missed security patches✓ PaaS is patched for you; Defender flags gaps
🛠️ Solved with: Defender for Cloud · DDoS Protection · Entra ID
Try it yourself in the Azure simulator No Azure account needed. Launch a VM and save money · Protect resources with locks 🖥️ Try it ❯🔒 Try it ❯
Module 1: Cloud Concepts ⏱ 8 min read Updated 11 Nov 2026

Quick answer

The cloud improves security because providers invest in protections few organisations could build themselves: physically secured datacenters, network protection such as DDoS defence, encryption, and automatic patching of managed services. You choose how much control you want. IaaS lets you manage OS-level security yourself, while PaaS and SaaS hand more patching to Microsoft. Your data and identities stay your responsibility.

Exam objective: 1.2.3 Describe the benefits of security and governance in the cloud. (Skills measured as of July 20, 2026)

Start with a question

Who protects your company's servers better, one IT person with a key to the server cupboard, or thousands of security specialists, guards, cameras and biometric scanners?

Many small and medium businesses keep servers in an office cupboard. The “security” is a door lock and a hope that nobody spills coffee.

Microsoft’s datacenters have perimeter fences, security staff, multi-factor physical access, and teams monitoring for attacks around the clock. Moving to the cloud gives you all of that on day one, as long as you secure your own part.

Explain it like I’m 10

The technical explanation

Microsoft’s AZ-900 material frames the security benefit like this: whether you want maximum control or want the provider to handle most of it, the cloud supports your needs.

  • Want maximum control of security configuration? Use IaaS. You manage the OS, patches and installed software.
  • Want patches and maintenance handled for you? Use PaaS or SaaS. Microsoft patches the platform automatically.
  • In every case, the provider handles physical security and offers built-in network protection, including defence against DDoS attacks.

Defense in depth

Azure security is usually described in layers, so that if one layer fails, others still protect the data:

  1. 1 Physical

    Datacenter access controls

  2. 2 Identity & access

    Entra ID, MFA, Conditional Access

  3. 3 Perimeter

    DDoS Protection, firewalls

  4. 4 Network

    NSGs, segmentation, private endpoints

  5. 5 Compute & app

    Patching, secure code, Defender

  6. 6 Data

    Encryption, Key Vault, classification

Defense in depth: layers around your data (covered fully in Module 2)

Built-in security you get from Azure

ProtectionWhat Azure provides
Physical securityRestricted, monitored datacenters run by Microsoft
EncryptionEncryption at rest on by default for Azure Storage and Azure SQL Database; TLS in transit
DDoSInfrastructure-level protection for all; Azure DDoS Protection for enhanced, tuned protection
PatchingAutomatic for PaaS and SaaS platforms
Posture and threatsMicrosoft Defender for Cloud: secure score, recommendations, threat detection
SecretsAzure Key Vault for keys, secrets and certificates

Real-world business scenario

Banking

A regional bank's mobile app team

The problem
Auditors flagged that on-premises servers were patched irregularly, admin accounts used passwords only, and there was no DDoS protection for public APIs.
What they used
APIs moved to App Service (platform patched by Microsoft) behind Azure Front Door with WAF; Entra ID with MFA and Conditional Access for admins; secrets in Key Vault with managed identities; Defender for Cloud enabled.
Why that choice
PaaS removed the patching gap, edge protection blocked attacks before they reached the app, and identity controls closed the biggest risk.
The result
The next audit passed, and Defender for Cloud's secure score became a monthly KPI for the team.

When to use it and when not to

✓ Use it when…

  • **PaaS/SaaS** when you want the provider to handle patching and platform hardening.
  • **IaaS** when you need full control of OS-level security settings and agents.
  • **Defender for Cloud** on every subscription to see and improve your posture.

✕ Think twice when…

  • Exposing management ports (RDP/SSH) to the internet. Use Azure Bastion or just-in-time access.
  • Storing secrets in code or configuration files. Use Key Vault and managed identities.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner Why can the cloud be more secure than an on-premises server room?

Model answer

Microsoft spends heavily on security: guarded datacenters with strict physical access, protection against attacks like DDoS, encryption, a large security team, and automatic patching for managed services. Most companies could not afford that themselves. But I still have to secure my own data, accounts and configuration.

Interviewer follows up

How does the choice of IaaS, PaaS or SaaS affect security work?

You

With IaaS I control and must patch the OS, which gives more control and more work. With PaaS and SaaS, Microsoft patches the platform, so I focus on identities, access and data.

Intermediate Name some Azure services that help secure workloads.

Model answer

Microsoft Entra ID for identity with MFA and Conditional Access, Microsoft Defender for Cloud for posture and threat protection, Azure Key Vault for secrets and keys, network security groups and Azure Firewall for traffic control, Azure DDoS Protection, and private endpoints to keep PaaS traffic off the public internet.

Experienced developer If you could implement only three security controls on a new Azure environment, which would you pick and why?

Model answer

First, phishing-resistant MFA and Conditional Access for every identity, especially admins, because identity is the most attacked layer. Second, least privilege with Azure RBAC and Privileged Identity Management for just-in-time admin access. Third, guardrails with Azure Policy and Defender for Cloud to block public exposure of storage and databases and to surface misconfigurations. Those three prevent most real-world cloud breaches, which are identity and configuration failures, not provider failures.

Scenario A small online shop worries about being taken offline by a flood of fake traffic during a sale. What does Azure offer?

Model answer

All Azure resources get basic infrastructure-level DDoS protection automatically. For stronger, tuned protection with telemetry and rapid-response support, they can enable Azure DDoS Protection on the virtual network, or put the site behind Azure Front Door with Web Application Firewall to filter malicious requests at the edge.

Test yourself with exercises

4 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 4

A company wants the most control over the security configuration of its operating systems in the cloud. Which service type should it choose?

Question 2

Question 2 of 4

Which Azure service helps protect applications from distributed denial of service attacks?

Question 3

Question 3 of 4 · Select 2

Which TWO are security benefits of using PaaS instead of IaaS?

Question 4

Question 4 of 4

Which Azure service provides a secure score, security recommendations and threat protection for Azure, hybrid and multi-cloud resources?

Quick revision

Key points

  • Providers deliver security few companies can match, including physical security, DDoS protection, encryption and expert teams.
  • Choose your level of control. IaaS = you patch the OS; PaaS/SaaS = Microsoft patches the platform.
  • Data, identities and devices remain the customer's job (shared responsibility).
  • Key tools are Entra ID, Defender for Cloud, Key Vault, NSGs, Azure Firewall and DDoS Protection.
  • Defense in depth layers controls so one failure does not expose everything.

Important terminology

Defense in depth
Layered security (physical, identity, perimeter, network, compute, application, data) so one failed control does not expose everything.
DDoS attack
Distributed Denial of Service. Flooding a service with traffic from many sources to make it unavailable.
Encryption at rest
Data stored on disk is encrypted. It is enabled by default for Azure Storage and Azure SQL Database.
Microsoft Defender for Cloud
Azure's security posture management and threat protection service for Azure, hybrid and multi-cloud workloads.

Common mistakes

  • Assuming "in the cloud" means "secure by default for everything I configure".
  • Leaving storage or databases publicly accessible and blaming the provider.

Exam tips

  • "Protection from distributed denial of service attacks" = Azure DDoS Protection.
  • "Security posture, secure score, threat protection across hybrid and multi-cloud" = Microsoft Defender for Cloud.

Five quick revision questions

  1. 1.Who secures the physical Azure datacenters?Show

    Microsoft.

  2. 2.What does DDoS stand for?Show

    Distributed Denial of Service.

  3. 3.In which service type do you patch the operating system yourself?Show

    IaaS.

  4. 4.Which Azure service stores secrets, keys and certificates securely?Show

    Azure Key Vault.

  5. 5.What is defense in depth?Show

    Layered security controls so a single failure does not compromise the whole system.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Governance in the Cloud