IaaS
You manage more. With virtual machines, the cloud provider handles physical infrastructure, but you still manage the operating system, patches, apps, identity choices, and data.
Cloud security basics
Shared responsibility decides who secures what.
In cloud computing, security is not entirely Microsoft’s job and not entirely the customer’s job. The shared responsibility model explains where the line is.
Simple version
Microsoft always secures the physical infrastructure; customer responsibilities depend on the service model.
Microsoft secures the physical datacenters, physical network, and physical hosts. Customers always retain responsibility for their data, identities, accounts, and endpoints. Responsibility for operating systems, applications, network controls, and other components shifts from the customer to Microsoft as you move from IaaS to PaaS to SaaS.
PaaS
Responsibility shifts toward the provider. You focus more on your application, data, users, and configuration while the provider manages the runtime and operating system.
SaaS
The provider manages most of the application stack. You still manage users, data, access policies, endpoint security, and tenant-level security settings.
Common exam trap
The customer always retains responsibility for data, identities, accounts, and endpoints.
Even with SaaS, the customer must control access, classify and protect data, secure user accounts and endpoints, and configure the tenant appropriately. The service model changes which responsibilities remain with the customer.
- Do not assume Microsoft protects you from every bad configuration.
- Check which patching tasks remain with you: customers patch guest operating systems in IaaS, while the provider manages the operating system in PaaS and SaaS.
- The customer manages fewer platform components from IaaS to PaaS to SaaS, but always retains responsibility for data, identities, accounts, and endpoints.
Practice-style examples
Check your understanding.
A company stores customer records in a cloud database. Who is responsible for deciding who can read that data?
The customer. The provider secures the underlying platform, but the customer controls access decisions, identities, roles, and data handling.
A team runs a virtual machine in Azure. Who is responsible for patching the guest operating system?
The customer. An Azure virtual machine is IaaS, so the customer is responsible for patching and securing the guest operating system.
A company uses a SaaS email platform. Is the customer responsible for anything?
Yes. The provider runs the service, but the customer still manages users, data, access policies, device practices, and security settings.