Lesson 1: Exam Facts, Cloud Computing and Shared Responsibility

Before you start: what this course is

This course is independent of Microsoft. It follows Microsoft's AZ-900 study guide, "Skills measured as of July 20, 2026". It teaches every skill on that outline and gives you original practice questions. It does not contain real exam questions, and it does not promise a pass.

Do this now: bookmark the official AZ-900 study guide on Microsoft Learn. If Microsoft publishes a newer skills outline before your exam date, the newer outline wins.

Know how the exam works

Three points that candidates often get wrong:

1. 700 is a scaled score. Microsoft states it may not equal 70% of the points.
2. There is no penalty for guessing. A wrong answer earns no point, but nothing is deducted. Answer every question.
3. Some questions earn partial credit. In most multi-part questions, each correct component earns a point.

The exam has three sections:

• Describe cloud concepts: 25–30%
• Describe Azure architecture and services: 35–40%
• Describe Azure management and governance: 30–35%

Do this now: note that no section is small. You cannot skip one and expect to pass comfortably.

Define cloud computing

Microsoft Learn's definition: cloud computing is the delivery of computing services over the internet.

Those services include what you already know from a server room:

• Compute (virtual machines)
• Storage
• Networking
• Databases

Translate it into terms you already use:

• On-premises: you buy servers, rack them, cable them, power and cool them, and patch them. Capacity is fixed by what you bought.
• Cloud: a provider (here, Microsoft) owns datacenters full of that hardware. You request resources over the internet and get them in minutes. You release them when you no longer need them.

The hardware has not disappeared. It has moved into someone else's datacenter, and so has the work of running it. That raises the key question of this lesson: who is responsible for what?

Apply the shared responsibility model

On-premises, you own the whole stack, from the building to the data. In the cloud, some responsibilities transfer to Microsoft. How many transfer depends on the service type:

• Infrastructure as a service (IaaS): you rent virtual machines. You still manage the operating system and applications.
• Platform as a service (PaaS): you deploy applications or databases without managing virtual machines or operating systems.
• Software as a service (SaaS): you use a ready-made application, such as Microsoft 365.

Later levels cover these service types in depth. For now, learn the pattern.

Always Microsoft (in any cloud service)

• Physical datacenter
• Physical network
• Physical hosts

Always you (in every service type)

• Your information and data
• The devices (endpoints) that connect to the cloud
• Accounts and identities, including who has access

Depends on the service type

Read the table left to right: your responsibility shrinks as you move from on-premises to IaaS to PaaS to SaaS. It never reaches zero.

Decide who is responsible: a three-step method

Use these steps on every scenario question.

1. Is the task physical? Building security, power, cooling, cabling or server hardware in an Azure datacenter is Microsoft's job. Stop here.
2. Is the task about data, devices or accounts? Classifying data, securing laptops, creating and removing users or deciding who gets access is your job. Stop here.
3. Otherwise, identify the service type. For the operating system: you in IaaS, Microsoft in PaaS and SaaS. For network controls and applications, check the table.

Worked examples

• A failed disk in the host server under your Azure virtual machine. Step 1: physical. Microsoft.
• A former employee's account still has access to a SaaS application. Step 2: accounts. You.
• Security updates for Windows Server on an Azure virtual machine. Step 3: IaaS operating system. You.
• Security updates for the operating system under Azure SQL Database (PaaS). Step 3: PaaS operating system. Microsoft.

Practise: match each task to its owner

Cover the answers, then check.

1. Controlling physical access to the datacenter
2. Deciding which users can read a customer database
3. Patching the guest operating system on a virtual machine
4. Replacing a faulty datacenter switch

Answers: 1 Microsoft, 2 customer, 3 customer, 4 Microsoft.

What the exam asks about this

• Expect a short scenario that names a task and a service, then asks who is responsible. The options are usually "the customer", "Microsoft" or "shared".
• Expect statements to judge true or false, such as "The customer is always responsible for their data."
• Common trap: assuming that moving to the cloud moves all security to Microsoft. Data, devices and accounts stay with you.
• Common trap: assuming a virtual machine's operating system is patched for you. In IaaS it is not.
• The definition of cloud computing is tested directly. Learn the wording.

Key takeaways

• The exam gives you 45 minutes. You pass at a scaled score of 700 out of 1,000, which is not the same as 70%.
• The price depends on the country or region where the exam is proctored.
• The three sections are cloud concepts (25–30%), Azure architecture and services (35–40%), and Azure management and governance (30–35%).
• This course is independent of Microsoft, follows the 20 July 2026 skills outline and promises no pass.
• Cloud computing is the delivery of computing services over the internet.
• Microsoft is always responsible for the physical datacenter, physical network and physical hosts.
• You are always responsible for your data, devices, and accounts and identities.
• Everything in between depends on the service type: more is yours in IaaS, less in PaaS, least in SaaS.