What cloud computing is: the shared responsibility model, and public, private and hybrid clouds

Why this matters

Every conversation about Azure starts from three ideas: what the cloud actually is, who looks after which part of it, and where the hardware lives. A manager signing off a move to Azure needs to know which tasks the company keeps, because an audit will ask. A salesperson needs to explain why a hospital can put its website in Azure and still keep patient records in its own building. A junior administrator needs to know that a virtual machine in Azure still needs its operating system patched, and that nobody else will do it.

Most cloud mistakes come from getting one of these wrong. A team assumes that because its data sits in Microsoft's datacenter, Microsoft decides who can read it. Another team chooses a private cloud for a small project and ends up buying hardware it did not need. This lesson sets out the vocabulary the rest of the course is built on. The skill area it opens, cloud concepts, carries 25-30% of the exam.

The lesson

Define cloud computing

Cloud computing is the delivery of computing services over the internet. The services include servers, storage, databases, networking, software and analytics. A provider such as Microsoft builds and runs the hardware, and customers rent what they need instead of buying it.

A few features separate the cloud from simply having servers somewhere else:

• Self-service on demand. A customer creates a server or a database in minutes from a portal or a script, without raising a purchase order.
• Access over a network. Services are reached over the internet or a private link, from anywhere the customer allows.
• Shared, pooled hardware. The provider runs large pools of hardware and uses virtualisation to divide them between many customers safely.
• Elasticity. Capacity can grow and shrink with demand (lesson 3 covers this).
• Measured use. The provider meters what each customer uses and bills for it (lesson 2 covers how).

Compare this with colocation, where a business leases rack space in someone else's building but still buys, owns and maintains its own servers. That is not cloud computing, because the business still owns the equipment and does all the work on it. Neither is installing software from a disc on every desktop.

Describe the shared responsibility model

In a company's own on-premises datacenter, the company is responsible for everything: the building, the power, the hardware, the operating systems, the applications and the data. Nobody shares the load.

When a workload moves to Azure, the duties are split between Microsoft and the customer. That split is the shared responsibility model. It is not an even split, and it is not the same for every service. It depends on the service type the customer chooses (lesson 4 explains the three types in detail).

Some duties never move, whichever service is used.

Always Microsoft's, for any workload running in Azure:

• the physical datacenter: the buildings, power, cooling and guards;
• the physical network: the cabling and network hardware inside Microsoft's facilities;
• the physical hosts: the servers themselves, including replacing failed disks.

Always the customer's, in every service type:

• its information and data;
• its devices, such as the PCs and mobile phones staff use;
• its accounts and identities: who can sign in, and what they can do.

Between those two fixed ends sits a middle band whose owner changes with the service type: the operating system, network controls, applications, and identity and directory infrastructure.

Three examples show the rule in action.

• A company runs a Windows Server virtual machine in Azure. The VM is infrastructure, so the company installs the security updates on its operating system. Microsoft looks after the physical host and the hypervisor underneath, but not the operating system inside the VM.
• A team moves its web application from a VM to Azure App Service, a platform service. Patching the operating system underneath now moves to Microsoft. The team still owns its data and the accounts of its users.
• A company uses Microsoft 365, a software service. Microsoft runs the servers and maintains the application code, but the company still controls which people can sign in.

So the more managed the service, the more of the work Microsoft takes on. Moving from infrastructure to platform to software shifts work towards Microsoft. The customer's share is largest with infrastructure as a service. What the customer never gives up is its data, its devices and its identities.

One common confusion: choosing which Azure region a workload runs in does not make the customer responsible for the building in that region. Physical security of datacenters and hosts stays with Microsoft. The model also applies only to workloads in Microsoft's cloud. Servers in the company's own building remain the company's responsibility at every layer.

Public, private and hybrid: the three cloud models

A cloud model describes where the cloud resources live and who they belong to. There are three to know.

Public cloud. A provider builds, owns and maintains the infrastructure and sells services to any organisation or person who wants them. Azure is a public cloud. Customers share the provider's hardware, isolated from each other. Key points:

• no hardware to buy, so no large up-front cost;
• services can be launched in minutes;
• customers pay for what they use;
• the customer has less control over the hardware and the physical security, because the provider owns it.

Private cloud. Cloud resources used by one organisation only. It can sit in the organisation's own datacenter, or a third party can host it on the organisation's behalf. Key points:

• the organisation has the most control over its hardware, network and security settings;
• it pays for, houses and maintains all of the hardware, with the up-front investment that brings;
• capacity is fixed by what it has bought, so it cannot absorb a sudden peak without buying more.

Hybrid cloud. A private environment and a public cloud joined into one connected environment. The organisation decides where each workload runs, for reasons such as compliance, cost or performance. The two sides must be connected; a company with some servers on site and an unrelated cloud account is not running a hybrid cloud. Control is complete only on the private part, because the public part runs on hardware the provider controls.

Two more terms appear as distractors, so know what they are not:

• Multi-cloud means using more than one public cloud provider at the same time. It needs no private environment at all. A company with no datacenter that runs some workloads on Azure and others with a second provider is multi-cloud, not hybrid.
• A community cloud is shared by a group of organisations with common needs. It is not one of the three models this part of the exam is built around.

Managing resources across hybrid and multi-cloud estates is the job of Azure Arc (lesson 14).

Matching each cloud model to the situation

The exam describes a business and asks which model fits. Look for the deciding detail.

Choose public cloud when:

• the organisation has no datacenter and little capital, such as a start-up;
• it wants to launch quickly and pay only for what it uses;
• demand is unpredictable or likely to grow.

Choose private cloud when:

• the workload must run on dedicated hardware that no other organisation shares, such as a defence contractor's system;
• a rule requires certain records to stay on hardware in a building the organisation controls, such as a regional council's records;
• the organisation needs the greatest possible control and accepts the full cost.

Choose hybrid cloud when:

• some data must stay on site, but other workloads can go to the public cloud. A hospital that keeps patient records in its own datacenter but runs its public appointment website in Azure, with the two connected, is the textbook case;
• the organisation's own servers cannot handle seasonal peaks. Sending the extra traffic to Azure and pulling back afterwards is called cloud bursting;
• it has recently bought expensive servers it wants to keep using, while adding Azure capacity for new projects;
• it is moving to the cloud gradually, one workload at a time.

Multi-cloud fits when an organisation deliberately uses two or more public providers, for example to use a particular service from each.

What the exam is really asking

• Cloud versus colocation. Renting rack space for your own servers is not cloud computing. The cloud means renting services that the provider runs on its own hardware.
• The fixed ends of the shared responsibility model. Physical datacenter, physical network and physical hosts are always Microsoft's. Data, devices, and accounts and identities are always the customer's. If an option says the customer gives up responsibility for its data, it is wrong.
• The middle depends on the service type. The operating system is the customer's on a VM and Microsoft's on App Service or Microsoft 365. The customer's share is largest with infrastructure as a service, and it shrinks as the service becomes more managed. Duties are never "split equally".
• Hybrid versus multi-cloud. Hybrid needs a private environment connected to a public cloud. Multi-cloud is two or more public providers. A company with no private environment of its own cannot be hybrid.
• Private cloud means dedicated, not necessarily on site. A third party can host a private cloud, but the resources still belong to one organisation. Its costs are the organisation's own; there is no sharing with other tenants and no paying by the minute.
• The deciding detail. "Little capital, launch fast" points to public. "Dedicated hardware" or "records must stay in our building" points to private. "Keep some on site and connect to Azure", "burst for peaks" or "keep using recent hardware" points to hybrid.