Governance & compliance

Azure DDoS Protection is designed to safeguard applications from distributed denial-of-service attacks by monitoring traffic and mitigating malicious spikes. It does not protect against phishing, which is an email-based social engineering threat requiring identity and email security solutions.

Under the shared responsibility model, customers always retain responsibility for securing their own data, identities, and endpoints. In contrast, physical datacenter security is managed entirely by Microsoft, making any claim that the customer must secure physical infrastructure incorrect.

Azure Active Directory (Entra ID) is used to manage user identities and access to Azure resources, providing a secure way to authenticate and authorize users. A diagram for this topic isn't available yet — the worked example below walks the same reasoning step by step.

• !Many people confuse Azure Active Directory with other Azure services, such as storage or messaging services, due to the broad range of services offered by Azure. However, its primary function is to provide identity and access management capabilities.
• !A common confusion is that Microsoft is responsible for all aspects of security, or that the customer is responsible for physical datacenter security, which is not the case. The shared responsibility model is often misunderstood, leading to incorrect assumptions about security roles and responsibilities.
• !In contrast, physical datacenter security is managed entirely by Microsoft, making any claim that the customer must secure physical infrastructure incorrect.
• !They do not block user authentication or login, which is managed through identity and access control systems like Microsoft Entra ID.

Answer each from memory — you'll see instantly whether you're right and why.

Run a focused 10-question mini-mock on Governance & compliance and see it stick.