The shared responsibility model describes which tasks the cloud provider handles and which stay with the customer. The split changes with the type of service used, but some responsibilities never move.
In an on-premises datacentre the organisation owns the whole stack: the building, power, cooling, physical security, servers, network, operating systems, applications and data. As workloads move to the cloud, some of those responsibilities transfer to Microsoft. The cloud service types (infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS)) decide how far the transfer goes. They are described in full in Chapter 2; here the focus is on who does what.
The responsibility matrix
Microsoft publishes the following division of responsibility between the customer and Microsoft:
| Responsibility area | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Customer data | Customer | Customer | Customer | Customer |
| Configurations and settings | Customer | Customer | Customer | Customer |
| Identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts | Customer | Microsoft | Microsoft | Microsoft |
| Physical network | Customer | Microsoft | Microsoft | Microsoft |
| Physical datacentre | Customer | Microsoft | Microsoft | Microsoft |
Reading the table from bottom to top shows the pattern: the physical layers move to Microsoft as soon as a workload leaves the customer’s own datacentre (IaaS), the operating system moves at PaaS (where applications and network controls become shared), and network controls pass fully to Microsoft at SaaS, while applications stay shared. Figure 1.1 shows the same matrix as a grid.
What always stays with the customer
Whatever the service type, the customer always retains:
- Data: the information stored in the cloud, including classification, protection, encryption decisions and compliance with data governance requirements.
- Endpoints and devices: the phones, laptops and desktops allowed to connect to the cloud services.
- Accounts and identities: the user, service and device accounts in the environment, including creating and removing access.
- Access management: the controls that decide who can do what, such as role-based access control, multifactor authentication and Conditional Access policies (covered in Chapter 7, “Identity, access and security”).
What always sits with the provider
Microsoft is always responsible for the physical datacentre (facilities, physical access and environmental controls such as power and cooling), the physical network (routers, switches and cabling inside the datacentres), the physical hosts (the servers themselves) and the hypervisor (the virtualisation layer). In PaaS and SaaS, Microsoft also manages operating systems, runtimes and middleware.
What depends on the service type
Operating systems, network controls and applications are the areas that shift. Microsoft Learn’s training also describes identity and access as shared in PaaS and SaaS: Microsoft runs the identity platform (such as Microsoft Entra ID) that performs authentication, while the customer still manages its own users, roles and policies, which is why the table keeps identities and users with the customer. A practical example from Microsoft Learn: with a managed cloud SQL database (PaaS), Microsoft maintains the database engine but the customer is still responsible for the data put into it. If the customer instead installs SQL Server on a virtual machine (IaaS), the customer is also responsible for patching and updating the database software and the operating system underneath it.
Common trap: With SaaS the provider is responsible for everything, including the data - data, accounts and identities, and access management always remain the customer’s responsibility in every service type, including SaaS.
Common trap: Moving a server to an Azure virtual machine hands operating system patching to Microsoft - in IaaS the operating system is still the customer’s responsibility; only from PaaS upwards does Microsoft manage the operating system.