How does shared responsibility shift between IaaS and SaaS?

What's really being asked

This question tests whether you understand the division of security and management responsibilities between a cloud provider and the customer across different service models. Interviewers want to see that you know which stack layers shift to the provider as you move from IaaS to SaaS, and which responsibilities you always retain regardless of deployment type.

The full answer

First, define the shared responsibility model as a framework that allocates security and management duties based on the service model. Second, explain that in IaaS the customer manages everything above the physical host including the operating system, applications, network controls, and configurations, while the provider secures the physical datacenter, network, and hosts. Third, explain that in SaaS the provider manages the entire stack including applications, network controls, operating system, and infrastructure, while the customer retains responsibility for data classification and protection, identity and access management, endpoint security, and account governance. Fourth, note that some areas like applications and network controls can be shared in PaaS and SaaS, meaning the provider manages the platform but the customer still configures application-level security and access controls.

The mistakes people make

A major red flag is claiming that using cloud services means the provider secures your data or endpoints. Another is saying that SaaS requires no security effort from the customer, which ignores the fact that data, identities, accounts, and endpoints remain customer responsibilities. Confusing who owns the operating system layer is also common, specifically forgetting that IaaS leaves the OS with the customer.

What usually comes next

Interviewers may ask how this model applies to a hybrid or multi-cloud environment, or how responsibilities change with PaaS offerings like Azure App Service or Azure SQL Database. They might also probe how you enforce your retained responsibilities in practice, such as through encryption, RBAC, MFA, conditional access policies, or data loss prevention.

A concrete example

If you deploy a web application on Azure Virtual Machines under IaaS, you are responsible for patching the guest OS, configuring the firewall and virtual network, securing the application code, and managing data encryption. If you switch to a SaaS product like Microsoft 365 for the same workload, Microsoft patches the OS, manages the network, and runs the application, but you still must classify sensitive data, enforce MFA on user accounts, manage access policies, and ensure employee laptops are compliant and secure.