The Shared Responsibility Model

Security in the cloud is not the sole responsibility of the cloud provider, nor is it the sole responsibility of the customer. It is a shared responsibility — and understanding who is responsible for what is one of the most important concepts in cloud computing.

---

What is the Shared Responsibility Model?

The shared responsibility model defines the division of security responsibilities between the cloud provider (Microsoft, in the case of Azure) and the customer. The model ensures that both parties understand their obligations so that nothing falls through the cracks.

At a high level:

• Microsoft is responsible for securing the cloud infrastructure itself — the physical data centres, the network, the hypervisor, and the foundational platform services
• The customer is responsible for securing what they put in the cloud — their data, identities, applications, and configurations

The exact division of responsibilities depends on the service model you use: IaaS, PaaS, or SaaS.

---

Responsibility by Service Model

The following table shows how responsibilities shift between the customer and Microsoft across the three service models: