The shared responsibility model, the three deployment models, and consumption-based pricing — the concepts every later Azure-specific lesson assumes you already have.
You've already clicked around Azure a bit, so try this before reading on: if a hacker breaches an application you built on an Azure Virtual Machine, whose fault is it — yours, or Microsoft's? Hold that answer in your head; the next section gives you the precise, exam-tested way to reason about it.
Cloud computing splits responsibility for security and operations between you (the customer) and the provider (Microsoft). Exactly where the split falls depends on which service type you're using. One thing never moves, no matter what you buy:
Microsoft always owns physical security — the datacenter, the racks, the physical network. You never manage that layer, even on the most "raw" IaaS offering.
Everything above physical security slides along a spectrum:
| Layer | IaaS (e.g. a VM) | PaaS (e.g. Azure App Service) | SaaS (e.g. Microsoft 365) |
|---|---|---|---|
| Data & access | You | You | You |
| Application | You | You | Microsoft |
| Runtime / OS patching | You | Microsoft | Microsoft |
| Networking & virtualization | Microsoft | Microsoft | Microsoft |
| Physical host & datacenter | Microsoft | Microsoft | Microsoft |
So back to the calibration question: on a VM (IaaS), you own the OS and the application — so an app-level breach on your VM is on you. Move the same app to a PaaS or SaaS offering and Microsoft absorbs more of that stack. This "who owns what layer" logic is one of the most directly-tested ideas on the exam — it reappears any time a question describes a scenario and asks "whose job is this?"
Separately from who manages what, there's where the infrastructure physically lives:
| Model | What it means | Typical use case |
|---|---|---|
| Public cloud | Infrastructure owned and run by the provider, shared across customers over the internet | Startups, variable workloads, anything not bound by strict data-residency rules |
| Private cloud | Infrastructure dedicated to one organization, on-premises or hosted | Regulated industries (finance, healthcare) needing full control over hardware and data location |
| Hybrid cloud | A mix — some workloads on-premises/private, others in public cloud, connected together | An organization keeping sensitive data private while bursting compute-heavy jobs to the public cloud |
The exam likes to describe a scenario in a sentence or two and ask which model fits — the calibration question earlier in this lesson (a hospital keeping records on owned infrastructure but bursting extra compute to the cloud) is a hybrid cloud scenario, not private or public alone.
Traditional (on-premises) IT is CapEx — you buy hardware upfront as a capital expense, sized for peak load, and it sits idle most of the time. Cloud computing is OpEx — you pay only for what you actually consume, billed as an operating expense, and you can scale usage up or down on demand. This is why "no large upfront hardware cost" and "pay only for what you use" are the phrases the exam associates with the consumption-based model.
"Serverless" doesn't mean no servers — it means you never provision, patch, or scale them. You deploy code (e.g. an Azure Function), and the platform handles the underlying compute entirely, scaling it up and down — including to zero — automatically. It's the far end of the IaaS→PaaS→SaaS spectrum from the shared-responsibility table above: you own almost nothing but the code.
Four quick questions — no peeking at the tables above. This is retrieval practice: struggling a little before you get it right is what makes it stick.
Stuck, or got one wrong and the explanation didn't fully click? Ask your teacher — that's what this conversation is for. Don't just reread the section silently.