The bill and the blame
Two questions end every cloud project. First: who was supposed to secure that? When a VM is breached through an unpatched OS, that's not Microsoft's fault — on a VM, the OS is yours. Second: why is the bill so high? A build server left running all month, a test VM "stopped" but not deallocated, nobody tagged anything.
In this capstone you'll write the tools Sita needs to run her subscription well: a shared responsibility model lookup, a monthly cost calculator, cost by tag, and budget alerts that warn before the month ends.
Who secures what
In your own building you're responsible for everything, down to the locks on the server-room door. In the cloud the duties split, and the split moves with the service model. Microsoft always looks after the physical layers: datacenters, hosts and the physical network. You always own your data, your devices and your accounts and identities — Microsoft can't stop you from sharing a password or making a container public.
- IaaS (VMs): the operating system, network controls, applications and identity infrastructure are yours.
- PaaS (App Service, Azure SQL): Microsoft runs the OS; applications, network controls and identity infrastructure are shared.
- SaaS (Microsoft 365): Microsoft runs the application and its network controls; identity infrastructure is still shared.
- Whatever the model: classify data, turn on MFA, and configure access — that part never moves.
Azure Advisor and Microsoft Defender for Cloud check your side of the line: open management ports, missing MFA, unencrypted storage, idle resources.