> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/exam-prep-notes/sc-900/shared-responsibility-model.md).

# Shared Responsibility Model

<figure><img src="/files/n97wm6L4e2mKyhdyvuWe" alt=""><figcaption></figcaption></figure>

The **Azure Shared Responsibility Model** outlines the division of security and compliance responsibilities between **Microsoft (Azure)** and the **customer** when using Azure cloud services. It helps both parties understand their roles in securing applications, data, and systems in the cloud.

The model is primarily divided into two key areas:

1. **Microsoft’s Responsibility** (Azure’s Responsibility) – **Security of the Cloud**
2. **Customer’s Responsibility** – **Security in the Cloud**

#### 1. **Microsoft’s Responsibility**: **Security of the Cloud (Infrastructure)**

Microsoft is responsible for securing the **underlying infrastructure** of Azure. This includes the hardware, physical datacenters, networking, and foundational services that support the cloud environment. Some examples of Microsoft’s responsibilities are:

* **Physical security** of data centers (e.g., access control to the physical servers).
* **Network security** (e.g., securing the connectivity between Azure regions and data centers).
* **Compute infrastructure** (e.g., security of physical servers, virtualization).
* **Storage infrastructure** (e.g., managing secure storage facilities).
* **Platform-level services**, such as Azure Compute, networking, and storage management.
* **Patching and maintenance** of physical hardware and foundational software (e.g., hypervisors, physical servers).
* **Identity management** for Azure accounts and roles (though customers still control user-level permissions).

#### 2. **Customer’s Responsibility**: **Security in the Cloud (Your Workload)**

Customers are responsible for securing **everything that they deploy and manage** on top of Azure infrastructure. This responsibility varies depending on which Azure services are being used (IaaS, PaaS, SaaS). Some examples of the customer’s responsibilities include:

* **Identity and Access Management** (IAM): Managing who has access to the Azure resources (e.g., Azure Active Directory, user authentication, access control).
* **Data Protection**: Encrypting data at rest and in transit, setting data retention policies, backup, and recovery strategies.
* **Operating System**: Managing, securing, and patching the operating systems of virtual machines (VMs) you deploy (for example, managing Windows Server or Linux VMs).
* **Applications**: Securing the software or applications you build or deploy on Azure. This includes code security, vulnerability management, and patching.
* **Networking**: Configuring virtual networks, firewalls, subnets, and VPNs to protect your traffic and workloads.
* **Monitoring and Logging**: Enabling and managing monitoring, logging, and auditing to track user activities, detect potential threats, and maintain compliance.
* **Compliance**: Ensuring your workloads and applications meet legal, regulatory, and organizational compliance requirements.

***