Customer Versus Microsoft Responsibilities in Azure

What the Shared Responsibility Model Is

The shared responsibility model is a core cloud computing framework that defines how operational tasks, management overhead, and security controls are divided between the cloud service provider (Microsoft) and the cloud consumer (the customer).

How It Delineates Responsibilities

In an on-premises deployment, the customer owns and manages the entire stack from physical facilities up to the data. When moving to the cloud, responsibility shifts:

• Responsibilities that shift by service model: Depending on whether Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) is selected, Microsoft assumes varying levels of responsibility for operating systems, application runtimes, and network controls.
• Responsibilities always retained by the customer: Regardless of whether an organization uses IaaS, PaaS, or SaaS, the customer always retains ownership and primary responsibility for their customer data, user identities, account credentials, and endpoint access management.
• Responsibilities managed by Microsoft: Across all cloud models, Microsoft assumes responsibility for physical datacenters, physical hosts, and physical network infrastructure.

Key Advantages of the Model

• Clear governance boundaries: Establishes transparent boundaries for security configuration, compliance tracking, and incident response.
• Reduced administrative burden: Offloads physical infrastructure maintenance and physical facility security to Microsoft.
• Flexibility across workloads: Allows organizations to select service tiers that match their desired balance between control and convenience.
• Consistent data sovereignty: Keeps data ownership and user access control firmly in the hands of the organization.

Why This Is the Accurate Choice

This option accurately reflects that cloud management is a partnership where duties shift depending on the architecture tier, while critical assets like data classification, governance, and identity protection consistently remain the customer's duty.