The shared responsibility model
In your own data centre, you are responsible for everything: the building, the servers, the network, the operating systems, the applications and the data. In the cloud, that responsibility is shared between you and the provider. The shared responsibility model describes who looks after what.
The split by service type
Read the chart from left to right: the more managed the service, the more Microsoft takes on.
Always the provider's job
The physical layer: the data centre buildings, physical security, the physical network and the physical hosts. You can never be asked to secure a Microsoft data centre.
Always your job
Whatever service you use, you are always responsible for:
- Your information and data: what you store, who you share it with, how it is classified.
- Your devices: the phones and computers that connect to the cloud.
- Your accounts and identities: who has access, strong passwords, multi-factor authentication.
A worked example
A company runs a website on an Azure virtual machine (IaaS). Who patches the VM's operating system? The company. If they move the same website to Azure App Service (PaaS), Microsoft patches the operating system, but the company is still responsible for its application code and its data.