Shared Responsibility Model

The shared responsibility model defines which security tasks Microsoft handles and which fall to the customer, with the boundary shifting by service type. In IaaS, Microsoft secures the physical datacenter, network, and hypervisor while the customer manages the operating system, applications, and data. In PaaS, Microsoft also maintains the OS and runtime, leaving the customer apps and data. In SaaS, Microsoft manages nearly the whole stack. Regardless of model, the customer always owns its data and controls access through identity management — moving to SaaS reduces obligations but never eliminates data classification and identity governance.