Cloud security
The cloud shared responsibility model, explained
The cloud shared responsibility model explained: how Microsoft splits security between provider and customer, and why data and identities stay yours.
Where to start: the parts of the cloud that stay with you
Microsoft's model lists four areas the customer keeps in every cloud service type, including Microsoft 365. These are the places to look first, in the order Microsoft lists them.
- Work out which service type you're usingIaaS, PaaS and SaaS split the work differently. Most small businesses on Microsoft 365 are using SaaS, where Microsoft handles the physical and operating system layers.How the split changes by service type
- Look after your dataMicrosoft lists data classification, protection and governance as the customer's job, and its built-in restore features have time limits. Check what you can recover and for how long.Microsoft 365 backup options explained
- Look after the devices that sign inMicrosoft lists the laptops, desktops and phones that access cloud services on the customer's side. Keep them updated and protected.Device security basics with Intune
- Manage accounts: who gets access, and when it's removedCreating, managing and removing user access stays with the customer. Removing access when someone leaves is part of this.Removing access when staff leave
- Set up access controls such as multifactor authenticationMicrosoft lists role-based access, multifactor authentication and conditional access policies as customer responsibilities.Security defaults vs Conditional Access
Based on Microsoft Learn's 'Shared responsibility in the cloud', checked October 2026. Each provider publishes its own model, and your contract sets the exact split.
Key points
- Microsoft's documentation says that for all cloud deployment types, you own your data and identities.
- In Microsoft's model, the provider takes on more layers, such as physical hosts and operating systems, as services move from IaaS to PaaS to SaaS.
- Built-in recovery has limits: Microsoft says OneDrive's restore feature undoes actions from "within the last 30 days", so "it's in the cloud" isn't the same as "it's backed up".
“It’s in the cloud” can sound like “someone else looks after it”. Cloud providers describe security as shared, an idea known as the shared responsibility model: the provider looks after some layers and the customer looks after others. This guide explains the shared responsibility model using Microsoft’s published documentation as the example.
What stays with you in every cloud service
Microsoft’s documentation says: “For all cloud deployment types, you own your data and identities.” It lists responsibilities the customer always retains:
- Data: data classification, data protection, encryption decisions and compliance with data governance requirements
- Endpoints: client devices and endpoints that access cloud services, including mobile devices, laptops and desktops
- Accounts: creating, managing and removing user access
- Access management: access controls, including role-based access control, multifactor authentication and conditional access policies.
How the split changes by service type
Microsoft describes three broad service types:
- IaaS (infrastructure as a service): the customer manages virtual machines, operating systems and applications.
- PaaS (platform as a service): the customer deploys applications without managing virtual machines or operating systems.
- SaaS (software as a service): the customer uses ready-made applications, such as Microsoft 365.
Microsoft’s published responsibility matrix:
| Responsibility area | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Customer data | Customer | Customer | Customer | Customer |
| Configurations and settings | Customer | Customer | Customer | Customer |
| Identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts | Customer | Microsoft | Microsoft | Microsoft |
| Physical network | Customer | Microsoft | Microsoft | Microsoft |
| Physical datacenter | Customer | Microsoft | Microsoft | Microsoft |
Source: Microsoft Learn, Shared responsibility in the cloud.
What this means for a business using Microsoft 365
For SaaS such as Microsoft 365, Microsoft’s matrix shows the provider handling physical hosts, networks, datacentres, operating systems and network controls. The rows that stay with the customer are:
- customer data, including how it’s classified and protected
- configurations and settings, such as SharePoint and OneDrive sharing settings
- identities and users, including creating and removing access and, under access management, multifactor authentication and conditional access (see security defaults vs Conditional Access).
Client devices and applications are shown as shared. The Microsoft 365 security baseline walks through the account and access settings Microsoft documents, and the Microsoft 365 security readiness checklist lets you track them.
Common misunderstandings
- “The provider backs everything up for me.” Customer data is the customer’s responsibility in every service type. Built-in recovery has limits: Microsoft says its OneDrive restore feature is for Microsoft 365 subscribers and undoes actions from “within the last 30 days.” See Microsoft 365 backup options.
- “If an account is hacked, that’s the provider’s problem.” Identities, users and access management sit on the customer’s side. See what Microsoft’s guide describes for a compromised Microsoft 365 account.
- “SaaS means no security work.” Even in SaaS, the customer keeps data, configurations, identities and a share of devices and applications.
Common questions
What is the shared responsibility model?
It’s the way cloud providers describe dividing security work between themselves and their customers: the provider looks after some layers and the customer looks after others. Microsoft’s documentation says that “for all cloud deployment types, you own your data and identities.” It lists data, endpoints, accounts and access management as responsibilities the customer always retains. See what stays with you in every cloud service.
Who is responsible for security in the cloud, me or the provider?
Both, and the split depends on the service. In Microsoft’s published matrix, Microsoft handles the physical datacentre, network and hosts for IaaS, PaaS and SaaS. Customer data, configurations and settings, and identities and users stay with the customer in every type. Each provider publishes its own model, and the contract sets the exact split. See how the split changes by service type for Microsoft’s full table.
What’s the difference between IaaS, PaaS and SaaS responsibilities?
The provider takes on more layers as services move from IaaS to PaaS to SaaS. In IaaS, the customer manages virtual machines, operating systems and applications. In PaaS, the customer deploys applications without managing the operating system. In SaaS, such as Microsoft 365, the customer uses ready-made applications. Customer data, configurations and settings, and identities stay with the customer in all three. See how the split changes by service type.
Does Microsoft back up Microsoft 365 data?
Microsoft’s model lists customer data as the customer’s responsibility in every service type, and its built-in restore features have time limits. For example, Microsoft says OneDrive’s restore feature undoes actions from “within the last 30 days.” So “it’s in the cloud” isn’t the same as “it’s backed up.” Microsoft 365 backup options explains what’s built in and what third-party backup adds.
If my cloud account is hacked, isn’t that the provider’s problem?
Not in Microsoft’s model. Identities, users and access management, including multifactor authentication and conditional access, sit on the customer’s side in every service type. Our guide to what Microsoft describes for a compromised Microsoft 365 account covers the response. For Australian help, the ACSC takes reports through ReportCyber and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). See common misunderstandings.
Is the shared responsibility model the same for AWS and other providers?
Each provider publishes its own model, and the exact split depends on the service and the contract. This guide uses Microsoft’s published model as the example. Our guides to AWS security fundamentals and Azure security fundamentals explain how those platforms describe the customer’s side, such as protecting the AWS root user or limiting Azure subscription owners.
Where to get official help
Microsoft Learn’s Shared responsibility in the cloud page has the current matrix. For Australian guidance, incident reporting through ReportCyber, or the ACSC’s 24/7 hotline (1300 CYBER1, 1300 292 371), see the ACSC’s where to get help page.