IaaS: you still run (and secure) the workload
In IaaS, Microsoft protects the foundation, but you secure the VM and what's inside it. Microsoft: datacenter, physical infrastructure, core platform. You: VM guest OS patching and hardening. You: applications, configs, and network choices you control. You: identities, access, and data protection.