What is the shared responsibility model in Azure?

The shared responsibility model defines what the cloud provider secures and what remains yours. Misunderstanding it is a leading cause of cloud breaches, which is why it is asked so often.

Microsoft is always responsible for the physical datacentres, the physical network, and the physical hosts.

You are always responsible for your data, your endpoints, your accounts, and your access management — regardless of service model.

What shifts depends on the model:

• IaaS — you manage the operating system, patching, network configuration, applications, and identity. Microsoft manages the virtualisation layer down.
• PaaS — Microsoft manages the OS and runtime. You manage the application, its configuration, identity, and data.
• SaaS — Microsoft manages nearly everything except your data, users, and access policies.

The practical consequences worth stating:

• Azure guarantees infrastructure durability, but backup of your data is your responsibility. Accidentally deleting a database is not something the platform undoes for you.
• A storage account left publicly accessible is a customer misconfiguration, not a platform failure. Most cloud data exposures are of exactly this kind.
• Patching a virtual machine's operating system is yours under IaaS and Microsoft's under PaaS — which is itself a strong argument for PaaS.