The Azure shared responsibility model is the single most misunderstood idea in cloud security, and it is the reason so many businesses leave their Azure environments wide open without realising it. Many teams move to Microsoft Azure believing the platform “looks after security” on their behalf. That belief feels comforting, but it is only half true. Microsoft protects the cloud itself. You protect what you put inside it. Mix those two jobs up and you get exposed storage accounts, stolen admin passwords and failed audits.
This guide explains the Azure shared responsibility model in plain English. You will see exactly what Azure secures, what you must secure yourself, how the split changes between IaaS, PaaS and SaaS, and which mistakes cause real breaches. If you are studying for the Microsoft Azure Fundamentals exam, it also shows how this topic appears in AZ-900 certification training and why examiners love it.
Quick answer: Microsoft secures the physical datacentres, the hardware, the host infrastructure and the core Azure platform. You are always responsible for your data, your identities, your user accounts, your devices and how you configure every service you switch on.
What Is the Azure Shared Responsibility Model?
The Azure shared responsibility model is a framework that divides security and compliance duties between Microsoft and its customers. Microsoft documents the idea clearly in its shared responsibility in the cloud guidance on Microsoft Learn. The principle is simple: the more of the technology stack Microsoft runs for you, the fewer tasks land on your plate. The less Microsoft runs, the more you carry.
Think of renting an apartment. The landlord is responsible for the building structure, the front door lock, the fire alarms and the lifts. You are responsible for locking your own door, not handing out spare keys and keeping valuables out of sight. If a burglar walks through an unlocked apartment door, the landlord is not at fault. Azure works the same way. Microsoft builds a secure building, but you decide who gets keys and what is left lying around.
The Azure shared responsibility model exists because no single party can secure everything. Microsoft cannot know which of your files are confidential. You cannot inspect the physical servers in a datacentre. So each side owns the layers it can actually control.
The Big Misunderstanding: “Microsoft Handles Our Security”
Ask ten managers who owns security after a cloud migration and several will say the provider does. This assumption is the heart of the Azure shared responsibility model misunderstanding, and it causes damage in three common ways:
- Teams skip basic controls. They assume multi-factor authentication, patching or backups are “included” with Azure when they are often settings you must turn on.
- Nobody owns configuration. Developers spin up storage, databases and virtual machines quickly, and no one checks whether they are public.
- Compliance gaps appear. Azure holds many compliance certifications, but a certified platform does not make your own workload compliant.
Microsoft publishes plenty of security tooling, yet tools only help when someone switches them on and reads the alerts. A secure platform does not rescue an insecure configuration.
What Azure Secures: Microsoft’s Side of the Line
In every Azure deployment, Microsoft takes responsibility for the foundations that customers cannot see or touch. Under the Azure shared responsibility model, that always includes:
- Physical datacentres: buildings, perimeter security, cameras, power, cooling and controlled access for staff.
- Physical hosts and hardware: the servers, storage devices and network equipment that run Azure.
- Physical network: the cabling and core network that connects datacentres around the world.
- The host layer: the hypervisor and virtualisation platform that keeps one customer’s virtual machine separate from another.
- Platform services: patching and operating the underlying systems behind managed services such as Azure SQL Database or Azure App Service.
You do not need to worry about someone walking out of a datacentre with a hard drive. That job belongs to Microsoft, and it is the biggest benefit of moving to the cloud.
What You Must Secure Yourself: Your Side of the Line
Here is where most breaches start. Regardless of whether you use virtual machines, databases or software subscriptions, the Azure shared responsibility model says you are always responsible for the following.
1. Your data
Microsoft stores your data, but you classify it, decide who can read it and choose whether it is encrypted with your own keys. If a storage container is set to public and customer records leak, that is a customer configuration failure.
2. Identities and access
Passwords, admin roles and permissions belong to you. Use multi-factor authentication, conditional access and least-privilege roles through Microsoft Entra. Stolen credentials remain one of the most common ways attackers get in.
3. Devices and endpoints
The laptops, phones and tablets that connect to Azure are your problem. An unmanaged, unpatched laptop with admin access is a doorway into your cloud.
4. Configuration and network controls
Network security groups, firewalls, open ports, private endpoints and storage permissions are set by you. Azure gives you the lock; you must fit it to the door.
5. Applications and operating systems (on IaaS)
When you run a virtual machine, you patch the guest operating system, harden it, install antivirus and secure the software on top. Microsoft keeps the host safe, not your Windows or Linux guest.
6. Monitoring, backup and compliance
You decide what to log, who reviews alerts and how long backups are kept. Tools like Microsoft Defender for Cloud can highlight weaknesses, but acting on the findings is still your task.
How the Azure Shared Responsibility Model Changes for IaaS, PaaS and SaaS
The Azure shared responsibility model is not a single fixed line. It moves depending on the service type you choose. In an Infrastructure as a Service deployment such as a virtual machine, you carry most of the work. With Platform as a Service, Microsoft takes on more. With Software as a Service, such as Microsoft 365, Microsoft runs nearly the entire stack, but you still own your data, users and settings.
| Responsibility | On-premises | IaaS (VMs) | PaaS (App Service, SQL) | SaaS (Microsoft 365) |
| Data and information | You | You | You | You |
| Accounts and identities | You | You | You | You |
| Devices and endpoints | You | You | You | You |
| Applications | You | You | Shared | Microsoft (you configure) |
| Network controls | You | You | Shared | Microsoft |
| Operating system | You | You | Microsoft | Microsoft |
| Physical datacentre | You | Microsoft | Microsoft | Microsoft |
Figure 1: The Azure shared responsibility model across on-premises, IaaS, PaaS and SaaS.
Notice that three rows never change: data, identities and devices. No matter which Azure service you choose, those stay with you. That single fact clears up most of the confusion around the Azure shared responsibility model.
Real-World Mistakes Caused by Misunderstanding the Azure Shared Responsibility Model
Most cloud breaches are not clever hacks of Microsoft’s infrastructure. They are ordinary customer errors that the Azure shared responsibility model would have prevented if people had read it. Common examples include:
- A storage account left open to the public internet, exposing customer files.
- Remote Desktop or SSH ports open to the whole world on a virtual machine.
- Global administrator accounts without multi-factor authentication.
- Virtual machines running outdated operating systems that nobody patched.
- Former staff and contractors who still hold active access months later.
- Backups that were never tested until the day they were needed.
Every item on that list sits on the customer side of the line. Microsoft’s infrastructure worked perfectly in each case; the customer configuration did not.
Seven Practical Steps to Close the Gaps
You can turn the Azure shared responsibility model from theory into daily practice with these steps:
- Map your responsibilities. For each Azure service you use, write down who secures what. Use IaaS, PaaS or SaaS as your starting point.
- Enforce multi-factor authentication for every user, with extra protection for administrators.
- Apply least privilege. Give people only the roles they need and review access regularly.
- Patch and harden virtual machines and automate updates wherever possible.
- Lock down networks. Close unused ports, use private endpoints and restrict public access by default.
- Turn on monitoring. Enable logging and review the recommendations in Defender for Cloud.
- Train your people. Staff who understand the Azure shared responsibility model make safer decisions every day.
Why the Azure Shared Responsibility Model Matters for the AZ-900 Exam
The Microsoft Azure Fundamentals exam, AZ-900, tests whether you understand core cloud ideas. The Azure shared responsibility model appears in the cloud concepts section and links directly to security, governance and compliance questions. Expect scenario questions such as which party is responsible for patching a virtual machine, or who secures the physical datacentre. Microsoft lists the full skills measured on its Azure Fundamentals certification page.
The AZ-900 exam suits beginners, career changers, managers and sales staff as well as technical people, and no prior cloud experience is required. If you want structured help, explore our AZ-900 course details, read the AZ-900 certification FAQs or learn why students choose us.
AZ-900 Training Across Australia
Whether you want to understand the Azure shared responsibility model for your job or sit the exam, instructor-led classes are available in your city:
- AZ-900 course Melbourne: classroom and live online options for Victorian learners.
- AZ-900 course Sydney: hands-on training for professionals across New South Wales.
- AZ-900 course Brisbane: flexible classes for Queensland teams and individuals.
- AZ-900 course Perth: live online and in-house training for Western Australia.
- AZ-900 course Adelaide: live online and in-house delivery for South Australia.
- AZ-900 course Canberra: training for government and private sector learners in the ACT.
Prefer to see every option in one place? Visit our AZ-900 locations page. Part-time weekend classes start from $899, and weekday and weeknight schedules are also available. You can also contact the team or call 1300 649 299 to talk through group and in-house training.
Frequently Asked Questions About the Azure Shared Responsibility Model
What does Microsoft secure under the Azure shared responsibility model?
Microsoft secures the physical datacentres, hardware, host infrastructure and the core platform that runs Azure services. Customers secure everything they build or store on top.
Is my data safe just because it is in Azure?
Not automatically. Azure provides strong protection features, but you must classify data, set permissions and enable encryption and backups correctly.
Does the Azure shared responsibility model change for PaaS and SaaS?
Yes. Microsoft takes on more as you move from IaaS to PaaS to SaaS. Even in SaaS, you remain responsible for data, identities and devices.
Who is responsible if my Azure account is hacked through a weak password?
The customer. Identity and access management sits on your side of the line, which is why multi-factor authentication matters so much.
Is the Azure shared responsibility model on the AZ-900 exam?
Yes. It is a core cloud concept and a common source of exam questions, so it is worth mastering early.
Final Thoughts
Microsoft builds and protects the cloud. You protect what you place in it. Once your team accepts that, the Azure shared responsibility model stops being a confusing diagram and becomes a practical checklist for safer decisions. Start with identities, data and configuration, because that is where most incidents begin. When you are ready to turn that knowledge into a recognised credential, enrol in AZ-900 training today and build your cloud career on solid foundations.
