A mayor asks who is responsible if a SaaS HR system is misconfigured to expose employee records. Which answer aligns with shared responsibility?
Select an answer to reveal the explanation.
Short Explanation
SaaS means someone else runs the app plumbing, but the city still decides who sees the employee files. Mis-clicked sharing and weak access choices stay on the customer side. The provider does not become the HR records owner.
Full Explanation
Shared responsibility for SaaS still leaves the customer accountable for data classification, identities, and access decisions. When a SaaS HR system is misconfigured to expose employee records, the failure is typically on the customer’s configuration and permission choices even though the provider runs the application and much of the underlying stack. The mayor should hear that SaaS removes infrastructure toil, not ownership of who can see municipal HR data.
Holding the SaaS provider solely liable for every misconfigured sharing setting the city chooses ignores the customer’s access-governance duty. Claiming shared responsibility “ends” for SaaS so that nobody owns access mistakes is incorrect; the split changes, it does not vanish. Asserting that only an Azure region operator—not the HR SaaS customer—controls employee data exposure misassigns accountability away from the organization that grants access.
Exam caveat: contractual liability and insurance are legal topics separate from the technical shared-responsibility teaching model on AZ-900; the exam focus is which party typically owns which control plane. Operational check: audit HR SaaS sharing defaults, guest access, admin roles, and retention settings on a recurring schedule, and require change control for permission expansions.