The shared responsibility model divides accountability for Azure security between the cloud provider and the organization using its services. This division reduces operational burden, but it does not eliminate customer responsibility for configuration, data, or deployed resources. Security still requires coordinated people, processes, and technologies, including protection against misconfigurations such as missing encryption. section 1.1 section 1.2
In Azure, accountability is divided broadly as follows:
- Microsoft secures the cloud: datacenters, physical access, hardware, power resilience, and the infrastructure running compute, storage, and networking resources. section 1.2
- The customer secures resources inside the cloud, including cloud-resident data and deployed resource aspects such as virtual machines. section 1.2
- The exact division changes with the service model: SaaS provides applications, PaaS provides application development and deployment resources, and IaaS provides on-demand compute, storage, and networking. section 1.2
Fixing vulnerable code
Code vulnerabilities illustrate shared responsibility beyond infrastructure. Developers understand their applications and security teams may discover vulnerabilities across many applications. Microsoft Defender for DevOps can give both teams the same visibility, enabling them to work together on remediation. section 11.3.2
Treat the model as a starting point for continuous security improvement rather than a complete control. Understanding attack behavior, applying multiple Azure security services, and layering defenses help reduce the probability of a successful breach as threats evolve. section 1.9
