Cloud computing and the shared responsibility model

What changes when a workload moves to the cloud?

Cloud computing delivers technology resources over a network on demand, with adjustable capacity and measured consumption. It does not transfer every responsibility to the provider. Microsoft operates the physical datacenter infrastructure, while customers remain accountable for their data, identities, and access configuration. Moving from IaaS to PaaS and then SaaS reduces the technology layers a customer operates, but it never removes responsibility for accounts and information. When analyzing responsibility, separate the provider’s security “of the cloud” from the customer’s security “in the cloud.” Provider duties include facilities, power, and foundational hardware. Customer duties include selecting and classifying uploaded data, assigning roles, and controlling accounts and devices. Middle layers vary by service model. Therefore, an Azure label alone cannot answer a responsibility scenario; identify both the service model and the layer in question. Verify the design with a layer matrix that assigns every operational action to an owner and an evidence record, such as patch status or a role review.

The shared responsibility model identifies who protects each layer. With a virtual machine, the customer manages the operating system, patches, applications, and data; Microsoft manages physical hardware and networking. With a managed platform, Microsoft also operates the OS and runtime, while the customer configures the application, identity, and data. In SaaS, the application is ready to use, yet the customer still controls accounts, sharing, and data classification.

Worked case: a company has a legacy application that requires a custom driver and operating-system changes. App Service reduces administration but does not provide the required OS control. A virtual machine provides that control and adds patching and monitoring duties. VM is the defensible choice because the technical constraint is explicit. If the driver requirement disappears, PaaS may become preferable because it removes undifferentiated operational work.

Check an answer with two questions: does the option provide the required capability, and has responsibility been assigned to the correct party? A scenario requiring OS control is not satisfied by SaaS. A scenario requiring only a finished business application rarely justifies operating virtual machines. This reasoning maps needs to service layers instead of memorizing product names.

Reference solution: classify each component independently. Microsoft owns the facility, power, and physical hardware. The customer classifies data and grants roles. Operating-system patching depends on whether the service is IaaS, PaaS, or SaaS. Any answer assigning all components to one party ignores the service model.

Greater control creates greater operational responsibility.