Shared Responsibility Model
😟 THE PROBLEM
“It’s in the cloud, so Microsoft keeps it safe”, until a weak password lets an attacker in.
😊 THE SOLUTION
Know the split: Microsoft secures the cloud, you secure what you put in it.
- Nobody knows who patches what✓ The model shows each layer’s owner
- Accounts protected only by passwords✓ Identities are yours: turn on MFA
- Worrying about datacenter break-ins✓ Physical security is always Microsoft’s
Quick answer
The shared responsibility model defines which security and management tasks belong to the cloud provider and which belong to the customer. Microsoft is always responsible for the physical datacenter, hosts and network. The customer is always responsible for its data, devices, and accounts and identities. Everything in between shifts depending on whether you use IaaS, PaaS or SaaS.
Exam objective: 1.1.2 Describe the shared responsibility model. (Skills measured as of July 20, 2026)
Start with a question
If someone breaks into your rented flat because you left the door unlocked, is that the landlord's fault?
The landlord is responsible for the building: solid walls, a working front-door lock, a safe staircase. You are responsible for locking your own door and not giving your key to strangers.
Cloud security works exactly like this. Many people assume “it is in the cloud, so Microsoft keeps it safe”. Microsoft keeps the building safe. Locking your door is still your job.
Explain it like I’m 10
The technical explanation
The shared responsibility model divides security and operational duties between the provider and the customer. A useful summary is:
- The provider is responsible for security of the cloud (facilities, hardware, network, virtualisation, and the managed parts of its services).
- The customer is responsible for security in the cloud (what they deploy, configure and store).
How much each side does depends on the service type. Read the chart from left to right: as you move from on-premises to SaaS, more rows turn blue (Microsoft).
| Responsibility | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Information and data | You | You | You | You |
| Devices (mobile and PCs) | You | You | You | You |
| Accounts and identities | You | You | You | You |
| Identity and directory infrastructure | You | You | Shared | Shared |
| Applications | You | You | Shared | Microsoft |
| Network controls | You | You | Shared | Microsoft |
| Operating system | You | You | Microsoft | Microsoft |
| Physical hosts | You | Microsoft | Microsoft | Microsoft |
| Physical network | You | Microsoft | Microsoft | Microsoft |
| Physical datacenter | You | Microsoft | Microsoft | Microsoft |
The three rules to remember
- Always Microsoft (in any Azure model): physical datacenter, physical network, physical hosts.
- Always you: information and data; devices (mobile and PCs); accounts and identities.
- It depends: identity and directory infrastructure, applications, network controls and the operating system shift towards Microsoft as you move from IaaS to PaaS to SaaS.
-
1 Azure VM (IaaS)
You patch Windows, configure the firewall rules, secure the app and data.
-
2 Azure SQL Database (PaaS)
Microsoft patches the engine and OS. You control network access, logins and data.
-
3 Microsoft 365 (SaaS)
Microsoft runs the app. You manage users, MFA, sharing settings and data.
Architect level Turning customer responsibilities into controls
| Customer responsibility | Azure controls that help |
|---|---|
| Accounts and identities | Microsoft Entra ID, MFA, Conditional Access, Privileged Identity Management, managed identities |
| Data | Encryption at rest (on by default) with optional customer-managed keys in Key Vault, Microsoft Purview for classification |
| Network controls | NSGs, Azure Firewall, private endpoints, DDoS Protection |
| OS (IaaS) | Azure Update Manager, Defender for Servers, just-in-time VM access |
| Configuration posture | Azure Policy, Defender for Cloud secure score and recommendations |
The model also applies to resilience, not only security. Microsoft keeps the platform available within the SLA. Designing your application across zones, backing up your data and testing restores are your job.
Real-world business scenario
A fintech start-up
- The problem
- During a security review, auditors asked: 'Who patches the database engine? Who controls who can read customer records?' Nobody could answer clearly.
- What they used
- Mapped every component to the shared responsibility model and used Azure Policy, Microsoft Entra Conditional Access and Defender for Cloud to cover the customer-side duties.
- Why that choice
- The model gave a clear, auditable split. Azure SQL Database patching was Microsoft's, but access control, MFA and data classification were theirs.
- The result
- The audit passed with a documented responsibility matrix, and two over-privileged accounts and a public firewall rule were fixed along the way.
When to use it and when not to
The shared responsibility model is not a service you switch on. It is a lens you should always apply. Use it to:
✓ Use it when…
- Decide which service type fits your team. Less operational responsibility usually means PaaS or SaaS.
- Build security checklists and audit evidence for each workload.
- Explain to management why "moving to the cloud" does not remove security work.
✕ Think twice when…
- Treating the model as a reason to ignore SaaS security. Identity and data are always yours.
- Assuming responsibilities are identical across all services of the same type. Always read each service's documentation.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is the shared responsibility model?
Model answer
It explains who looks after what in the cloud. Microsoft secures the physical side: buildings, servers and network. I am responsible for my data, my user accounts and the devices that access them. The tasks in the middle, like the operating system or applications, depend on whether I use IaaS, PaaS or SaaS.
Interviewer follows up
So with SaaS like Microsoft 365, is the customer responsible for anything?
You
Yes. Data, devices, and accounts and identities. If a user with a weak password and no MFA gets phished, that is a customer-side failure, not Microsoft's.
Intermediate Walk me through how the responsibility for the operating system changes across the models.
Model answer
On-premises and IaaS, the customer owns the OS, including patching and hardening. In PaaS and SaaS, the provider manages the OS. That is a big part of why PaaS reduces operational effort.
Experienced developer Where do real-world cloud breaches usually happen in terms of the shared responsibility model?
Model answer
Almost always on the customer side. Leaked credentials and no MFA, over-privileged identities, storage accounts or databases exposed publicly, unpatched IaaS VMs with open management ports, secrets in source code. The provider's side is rarely the weak point. That is why a cloud security programme focuses on identity (Entra ID, Conditional Access, least privilege), configuration posture (Defender for Cloud, Azure Policy) and data protection.
Interviewer follows up
How do you make customer responsibilities enforceable at scale?
You
Guardrails, not guidelines. Azure Policy to deny public endpoints and require encryption or tags, management groups to apply them across subscriptions, Defender for Cloud secure score to track posture, and infrastructure as code reviewed in pull requests so misconfigurations are caught before deployment.
Scenario A company's Azure SQL Database was exposed because a developer allowed all public IP addresses in the firewall. Whose responsibility was that?
Model answer
The customer's. Azure SQL Database is PaaS. Microsoft manages the database engine, OS and infrastructure, but network access configuration, identities and the data are the customer's responsibility.
Test yourself with exercises
5 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- Always Microsoft: physical datacenter, physical network, physical hosts.
- Always customer: information and data, devices, accounts and identities.
- Varies: identity infrastructure, applications, network controls, operating system.
- The more managed the service (IaaS → PaaS → SaaS), the more Microsoft takes on.
- Most breaches come from customer-side misconfiguration or weak identity.
Important terminology
- Shared responsibility model
- The division of security and operational duties between the cloud provider and the customer.
- Security OF the cloud
- The provider's job, which covers physical facilities, hardware, the hypervisor and the provider's own services.
- Security IN the cloud
- The customer's job, which covers data, identities, access, configuration and (in IaaS) the OS and apps.
- Always customer-owned
- Information and data, devices (mobile and PCs), and accounts and identities, in every model.
Common mistakes
- Believing SaaS moves all responsibility to the provider.
- Forgetting the OS is the customer's job in IaaS.
Exam tips
- If an answer option says the customer is responsible for physical security in the public cloud, it is wrong.
- If an option says the provider is responsible for your data or user accounts, it is wrong in every model.
Five quick revision questions
-
1.Who is responsible for physical datacenter security in Azure?Show
Microsoft.
-
2.Name the three things that are always the customer's responsibility.Show
Information and data, devices, and accounts and identities.
-
3.Who manages the operating system in PaaS?Show
Microsoft (the provider).
-
4.Who manages the operating system in IaaS?Show
The customer.
-
5.In which model does the customer have the most responsibility?Show
On-premises (in the cloud, IaaS).
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.
Next up: Serverless Computing