In one sentence: The shared responsibility model says the cloud provider secures the underlying platform, but you are always responsible for your own data, accounts and settings.

What it is

When you move to the cloud you do not hand over all your security. Microsoft’s documentation says that in an on-premises datacentre you own the whole stack, and as you move to the cloud some responsibilities transfer to the provider. It also states that for all cloud deployment types, you own your data and identities.

Microsoft says Azure secures the underlying infrastructure, including physical datacentres, hardware, network infrastructure and the host operating system. You secure your data, applications, identities and access management. The split varies by service type, and the same idea applies to other providers such as AWS and Google.

How it works

The split depends on the service model, as Microsoft explains:

1. Infrastructure as a service (IaaS), such as virtual machines: you manage the virtual machines, operating systems and applications, and configure network security.
2. Platform as a service (PaaS), such as app hosting or managed databases: you deploy applications without managing machines or operating systems, but you still own application configuration, code security and access controls.
3. Software as a service (SaaS), such as Microsoft 365: you use ready-made applications. Microsoft runs the platform, but you configure it.
4. In every model you remain responsible for endpoints, accounts and access management, including role-based access, MFA and conditional access.

What it does not do: it does not mean the provider will protect you from weak passwords, open storage or unused admin accounts. The NCSC’s Cyber Essentials requirements say of SaaS that you must still make sure the service is configured securely.

Who it affects and how badly

Every organisation using Microsoft 365, Google Workspace, AWS, Azure or any SaaS tool. That is almost everyone.

Sole traders and small firms often assume “it is in the cloud, so it is safe”, and leave MFA off. Firms of 10 to 50 staff, such as accountancy, legal and recruitment practices, store client data in cloud drives with loose sharing. SaaS start-ups and MSPs run IaaS and PaaS and own more of the stack. Regulated firms, such as fintech and insurers, remain accountable to the regulator even when a supplier hosts the data.

Realistic worst case is a misconfiguration that exposes data or lets an attacker in, with the provider correctly saying the platform worked as designed.

Real examples

Microsoft’s own test tenant, 2024. Microsoft said a legacy, non-production test tenant account without MFA was compromised by password spraying. The platform was not the weak point. The identity setting was. If the same team deployed that tenant today, Microsoft said mandatory policy would ensure MFA. The model applies to a provider’s own tenants too. Source: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

Cyber Essentials. The scheme requires cloud services to be configured securely by you. Source: https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-2.pdf

How to detect it

• List every cloud service you use, including ones staff signed up for themselves.
• In Microsoft 365, check Secure Score and the Entra sign-in and audit logs. In Google Workspace, review the security health page and admin audit logs.
• Check which accounts have no MFA, which are admin accounts and which are old.
• Check sharing settings: files shared with “anyone with the link” and external guest access.
• For IaaS and PaaS, look for open storage, exposed management ports and public databases using your provider’s built-in security recommendations.

How to fix or prevent it

1. Turn on MFA for every user and admin, and block legacy sign-in methods.
2. Limit admin roles, and use separate admin accounts.
3. Review sharing and external access settings.
4. Apply your provider’s security baseline and act on its recommendations.
5. For IaaS, patch your own virtual machines and lock down network rules.
6. Back up your SaaS data separately. The provider’s availability is not the same as your recovery plan.
7. Log and monitor sign-ins and admin changes.
8. Write down, for each service, who is responsible for what.

Related terms

• microsoft 365 security basics
• multi-factor authentication
• cyber essentials
• password spraying
• shadow it
• supply chain attack

Browse the full Resources library.

FAQ

Is my data safe just because it is in Microsoft 365? Microsoft says you own your data and identities in every deployment type, so you must secure access and settings.

What does the provider secure? Microsoft says Azure secures physical datacentres, hardware, network infrastructure and the host operating system.

Does it change between IaaS, PaaS and SaaS? Yes. You manage more in IaaS and less in SaaS, but never nothing.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.