Shared Responsibility Model: IaaS, PaaS, SaaS
Who owns each layer: the rule and the matrix
In the shared responsibility model the provider secures the cloud infrastructure and you secure what you put in it, and the further you move from IaaS toward SaaS, the more layers the provider takes over, but you always keep your data, your identities and your configuration. The decision rule for a question is: find the layer the scenario is about, find the service model, and read the answer off the matrix below. If the layer is data, accounts or access, the answer is the customer in every model.
Microsoft’s matrix on shared responsibility in the cloud (page updated August 2026) reads:
| Responsibility area | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Customer data | Customer | Customer | Customer | Customer |
| Configurations and settings | Customer | Customer | Customer | Customer |
| Identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts | Customer | Microsoft | Microsoft | Microsoft |
| Physical network | Customer | Microsoft | Microsoft | Microsoft |
| Physical datacenter | Customer | Microsoft | Microsoft | Microsoft |
Read it column by column. On-premises you own everything. In IaaS the provider takes the three physical rows, so you patch the guest operating system. In PaaS the operating system moves to the provider as well. In SaaS almost everything moves, and you are left with data, identities, configuration, and a shared slice for devices and applications.
The three service models in one example each
- IaaS gives you virtual machines, disks and virtual networks. Azure Virtual Machines is the standard example. You choose the OS image and you patch it.
- PaaS gives you a managed runtime where you deploy code or data and never touch the OS. Microsoft lists Azure App Service, Azure Functions, Azure SQL Database and Azure Storage as examples.
- SaaS gives you a finished application. Microsoft 365 and Dynamics 365 are the examples.
Many solutions mix models. A web app in App Service (PaaS) that stores files in a storage account (PaaS) and calls a virtual machine running a legacy service (IaaS) has three different splits at once, which is why the model is applied per resource, not per company. Choosing an Azure compute service lists how the compute options sit on this spectrum.
The AWS wording: of the cloud vs in the cloud
AWS describes the same idea with two phrases. Security of the cloud is AWS: hardware, software, networking and facilities, and for abstracted services such as Amazon S3 and DynamoDB also the operating system and platform layers. Security in the cloud is the customer, scaled to the services chosen. With Amazon EC2 the customer manages the guest OS, installed software and the security group firewall; with S3 the customer manages data, encryption choices and IAM permissions. AWS also classifies controls as inherited (for example physical and environmental controls), shared (patch management, configuration management, awareness and training, where each side does its own part) and customer-specific. Source: AWS shared responsibility model. The same logic governs identity policies on AWS, covered in AWS IAM basics.
Worked example: a patch gets missed
A team runs a customer portal on an Azure virtual machine, a managed Azure SQL Database, and uses Microsoft 365 for staff email. A vulnerability is published in the OS running the portal, in the database engine, and in the email service.
- The VM is IaaS, so the OS patch is the customer’s job. If it is missed, the breach is on the customer side.
- Azure SQL Database is PaaS. Microsoft patches the OS and the engine. The customer still owns database permissions, firewall settings and what data is stored.
- Exchange Online is SaaS. The vulnerability is Microsoft’s to fix. The customer owns mailbox permissions, conditional access and the devices used to read mail.
The pattern for any such question is the same: split the scenario into resources, label each IaaS, PaaS or SaaS, then answer per layer.
Which exams test this
| Exam | Domain and objective | Where on this site |
|---|---|---|
| AZ-900 | Cloud concepts (25 to 30%): describe the shared responsibility model, and describe IaaS, PaaS and SaaS with use cases (skills as of July 20, 2026) | Cloud concepts explained |
| SC-900 | Concepts of security, compliance and identity (10 to 15%): describe the shared responsibility model (applies from Oct 21, 2026) | Security, compliance and identity concepts |
| AIF-C01 | Domain 5, Security, Compliance and Governance for AI Solutions (14%): methods to secure AI systems, which names the AWS shared responsibility model | Security, compliance and governance explained |
| N10-009 | Networking Concepts: summarize cloud concepts, including the SaaS, IaaS and PaaS service models | Networking concepts (23%) |
| AZ-305 | Infrastructure: recommend migrating workloads to IaaS and PaaS (minor for this topic) | Minor |
How exam questions are built around shared responsibility
The question names a service and asks who patches, secures or configures something. Constraint words decide it. “Operating system” with a VM is the customer; with App Service or SQL Database it is the provider. “Physical”, “hypervisor” or “datacenter” is always the provider except on-premises. “Data”, “accounts”, “access” and “classification” are always the customer. The trap is assuming that a managed service takes over everything: PaaS and SaaS still leave you with identity, access policy and data protection. The second trap is mixing the two vendors’ vocabulary, so “inherited controls” belongs to AWS and “responsibility matrix” to Microsoft, although the meaning is the same. The model links directly to Zero Trust, which assumes you secure identities and data whichever service you use, and to Azure RBAC vs Entra roles for the access side that is always yours.
Question 1. A company moves a line-of-business application from its own servers to Azure App Service. Which task moves from the company to Microsoft?
- A. Classifying the data the application stores
- B. Managing which users can sign in to the application
- C. Configuring the application’s access settings
- D. Patching the operating system that hosts the application
Show answer
Answer: D
App Service is PaaS, and in the PaaS column the operating system is Microsoft’s responsibility. Customer data, user accounts and the application’s access configuration stay with the customer in every service model.
Question 2. Under the AWS shared responsibility model, a company runs a database on Amazon EC2 instances. Which responsibility belongs to the customer?
- A. Patching the guest operating system and database software
- B. Physical security of the datacenter
- C. Maintaining the host hardware
- D. Operating the physical network between availability zones
Show answer
Answer: A
With EC2 the customer manages the guest operating system, including patches, the software installed on it and the security group configuration. AWS is responsible for the underlying hardware, networking and facilities, which is security of the cloud.