Moving a service to the cloud does not transfer every security task to the provider. The division of work depends on the service model. This is the idea behind shared responsibility, a topic in Microsoft's AZ-900 study guide.

A useful starting point is to ask: How much of the technology stack does the customer still control?

Start with what the customer always controls

Customers remain responsible for their data and for decisions about who should have access to it. Managing identities, access rights and information appropriately remains important whether the service runs on premises or in the cloud. The provider's responsibilities grow as the customer buys more managed services, but the customer still needs to configure and use those services responsibly.

Compare the three common models

With infrastructure as a service (IaaS), the provider manages the physical data centre and underlying hardware. The customer has more direct control over components such as virtual machines and therefore has more work to do on configuration, operating systems and applications.

With platform as a service (PaaS), the provider manages more of the platform. A development team can focus on its application and data while still configuring access, application security and the service options it chooses.

With software as a service (SaaS), the provider operates the application. The customer still needs to manage its users, data and relevant settings. A hosted email service is a familiar example: the provider runs the service, but the organisation decides who gets an account and what information users may share.

Apply the model to a question

Imagine an organisation running its own application on an Azure virtual machine. If the scenario asks who is responsible for maintaining the guest operating system, first identify the service model: a virtual machine is an IaaS example. If the scenario instead describes a fully hosted application, ask which settings and data the customer still controls.

The point is to reason from the service model, not memorise that "cloud means Microsoft handles security". In an exam question, look for what the customer operates, what the provider operates and which responsibilities remain shared.

The ICT Exam Academy AZ-900 course offers a route to practise cloud concepts alongside Azure services and governance.