What 'the cloud' actually is — Microsoft 365 vs Azure, in plain English

"We're in the cloud" is one of those things that sounds like an answer but isn't really. In the cloud where? Doing what? Who's looking after it?

If your business uses Microsoft tools, there's a good chance you're using two different parts of Microsoft's cloud without quite realizing it — and they come with different security considerations.

What 'the cloud' actually means

Strip away the marketing and the cloud is simple: computers you rent over the internet instead of owning them yourself.

Instead of buying a server, plugging it into a closet, and hoping someone remembers to update it, you're paying a company to run that hardware for you. The files, the software, the settings — they all live on that company's computers. You access everything through a browser or an app.

That's it. The word "cloud" has accumulated a lot of mystique, but the underlying idea is just renting computing resources instead of buying them.

Microsoft 365: the apps your team uses every day

Microsoft 365 (often written M365) is the package of everyday business tools — Outlook for email, Teams for chat and calls, SharePoint and OneDrive for storing and sharing files, Word and Excel and the rest.

If you have a 20-person company and everyone has an @yourcompany.com email address that runs through Microsoft, you're using Microsoft 365. Your email, your documents, your chat history — all of it is stored on Microsoft's servers, not on a hard drive under someone's desk.

That's genuinely convenient. It also means that the settings controlling who can access what live in Microsoft's admin center, not on a device you can physically see and touch. "Someone left and I just took their laptop" doesn't cover it anymore.

Azure: the rentable infrastructure underneath

Azure is a different layer entirely. It's Microsoft's platform for building things — servers, databases, storage buckets, custom apps, networking infrastructure. A software company might use Azure to host the application they sell. A business with custom internal tools might run them on Azure.

Many small businesses never use Azure directly at all. But if your company's website is hosted there, if your IT provider set up a virtual server for you, or if you use line-of-business software that runs on it, you have an Azure footprint worth knowing about.

The distinction matters because the two services have separate admin controls, separate permission systems, and separate places where things can go wrong.

The part that surprises most business owners

Here's the thing Microsoft is clear about — though not always in ways that are easy to find. When your data lives in their cloud, security is a shared job.

Microsoft's job: keep the physical buildings safe, make sure the servers run, patch the underlying infrastructure, maintain the platform. They are very good at this.

Your job: configure the settings correctly, manage who has access, turn on the protections that are off by default, and revoke access when someone leaves.

This is sometimes called the shared responsibility model. The simplified version: Microsoft secures the building. You have to lock your own office.

The settings that control your office — who can log in, what they can see, which apps are connected — are your responsibility. And on a freshly set-up Microsoft 365 account, quite a few of those settings lean toward "easy to use" rather than "hard to break into."

Why this matters in practice

A business owner who assumes "we use Microsoft, so we're secure" is only half right. They're using a platform with serious security capabilities. But capability and configuration are not the same thing.

The risk isn't usually Microsoft's infrastructure. It's an admin account with no multi-factor authentication (MFA — the extra code or prompt after your password), a file-sharing link that never expires, an old employee's login that was never disabled. Those are your settings to manage.

Knowing which cloud services you use — and that securing them is partly your job — is the starting point for everything else.

Tenant Strike connects to your Microsoft 365 and Azure environment in read-only mode, maps out what's configured and what's been left open, and gives you a plain-English list of what to address. A five-minute scan is usually enough to find the gaps that matter.