Cloud Computing and Shared Responsibility

What changes when computing arrives over the internet

Before any Azure service makes sense, one sentence has to be exact, because every later decision in this exam hangs off it. Cloud computing is the delivery of computing services over the internet. The delivery mechanism is the definition, not the size of the machines or who owns the building.

Those services start with familiar IT infrastructure:

Cloud offerings also extend beyond traditional infrastructure to Internet of Things, machine learning, and artificial intelligence services. A cloud platform is therefore wider than a rented datacenter: it sells capabilities that most organizations would never build for themselves.

Internet delivery changes how an organization obtains capacity. Cloud computing is not constrained by physical infrastructure in the same way as a traditional datacenter. When an organization needs to expand rapidly, it can use cloud resources instead of waiting to build another datacenter.

Picture a retail team facing a seasonal launch. The traditional path is to buy and configure extra physical servers months in advance and hope the estimate was right. The cloud path is to deploy additional capacity for the launch period and scale down afterwards. The workload is the same; the lead time is not.

That is the practical meaning of "not constrained": capacity stops being a construction project and becomes a request.

Where the responsibility line moves

In an on-premises datacenter there is no line to draw, because everything is on one side of it. The organization is responsible for the physical space, security, servers, infrastructure, software, patches, and versions. If a server fails, its team replaces it. If a version goes out of support, its team upgrades it.

Moving to the cloud does not delete that list of duties. It splits it. In cloud computing, the provider and the consumer share responsibility. And the division is not the same for every task or every service type, which is why "the cloud handles it" is never a complete answer.

Start with the part that never moves. The cloud provider is responsible for physical security, power, cooling, and network connectivity. The reason is simple: the consumer is not in the building, so those duties could not belong to it even in principle.

The right-hand column is the whole model in one view: a fixed provider block at the bottom, a fixed consumer block at the top, and a movable middle.

Always yours, always theirs, and it depends

The model is easiest to apply as three buckets rather than as a long list. Two of the buckets are fixed no matter what you buy, and only the third one moves.

Notice what the middle bucket is made of: software and control layers. Those are precisely the things that can be handed over or kept, which is why they are the ones that move.

The consumer bucket deserves a sentence of its own, because it is where most exam mistakes happen. The consumer remains responsible for the information and data stored in the cloud. It is also responsible for connected devices and for the accounts and identities in the environment.

Access security stays a consumer duty for a reason that is worth understanding rather than memorizing: the consumer is the only party that knows who should receive access. A provider can run an authentication platform, but it cannot decide that a particular contractor should read a particular folder.

So the sentence "we moved to the cloud, so identity is handled for us" is wrong in every service type, including the most managed ones.

The service type sets the boundary

The middle bucket does not move at random. It moves along a spectrum defined by the cloud service types. Infrastructure as a service places the most responsibility on the consumer, software as a service places most responsibility on the provider, and platform as a service sits between them.

Read the table as a slope, not as four unrelated cases. Each step to the right hands another movable layer to the provider.

Two things the slope does not do are worth stating plainly.

It never moves the bottom bucket up: even in SaaS, the physical datacenter, physical network, and physical hosts remain the provider's, so they cannot "shift" anywhere. And it never moves the top bucket down: even in SaaS, the data, the connected devices, and the accounts and identities remain the consumer's.

Identity and access shows how the middle behaves. In PaaS and SaaS it is genuinely shared: the organization manages its own users, roles, and policies, while the provider runs the authentication platform underneath them. Infrastructure behaves differently: it shifts to the provider as soon as the organization moves off-premises to IaaS.

Applying the model to a database

An abstract model is only useful if it settles a concrete argument, so take the one that comes up most often: who patches the database?

The deployed service determines the boundary. With a cloud SQL database, the provider maintains the database while the consumer remains responsible for the data ingested into it. If the consumer instead installs an SQL database on a virtual machine, the consumer becomes responsible for database patches and updates as well as the stored data.

The same product name, two different answers, because the boundary follows what was actually deployed.

That gives a heuristic you can apply to a service you have never seen before: use the resource layer to decide responsibility.

• Physical facilities and hosts belong to the provider.
• Customer data, devices, accounts, and identities stay with the consumer.
• Software and control layers can shift with the service type.

Work down the stack until you reach the layer the question is really about, then read off the bucket. A question about cooling never reaches the movable middle; a question about operating-system patches always does.

Key takeaways

• Cloud computing delivers computing services over the internet, from virtual machines, storage, databases, and networking through to IoT, machine learning, and AI, without the physical constraints of a traditional datacenter.
• The provider owns the physical datacenter, the physical network, and the physical hosts, along with physical security, power, cooling, and network connectivity.
• The consumer owns cloud data, connected devices, accounts, and identities, and keeps access security because it decides who should receive access.
• Responsibility for operating systems, network controls, applications, identity and access, and infrastructure depends on the service type: IaaS is consumer-heavy, SaaS is provider-heavy, PaaS sits between them.
• On-premises operation keeps every layer with the organization, which is why the shared model only begins once a provider is involved.