Azure managed services: what's included and who runs what

Azure managed services covers two things: services Microsoft operates for you, such as Azure SQL Managed Instance, Managed Disks and serverless Functions, and the day-to-day operations a managed service provider (MSP) runs on top: monitoring, patching, security, backup testing and cost control. Most production estates need both, because Microsoft never manages your data, identities or configuration.

Key takeaways

• "Managed" in Azure works at three layers: Microsoft-run platform services, Microsoft support contracts, and a partner that operates the estate under an SLA.
• Platform services remove host and OS work, but under Microsoft's shared responsibility model you always keep data, endpoints, accounts and access management.
• The core features of a managed Azure service are 24/7 monitoring, incident response, patching, tested backups, security posture, identity governance, FinOps and compliance evidence.
• For EU entities in scope of NIS2, your MSP is part of your supply chain and must support the 24-hour early warning and 72-hour incident notification steps.
• Small, fully serverless estates with an on-call team may not need an external MSP; hybrid, regulated or fast-growing estates usually do.

What are Azure managed services?

The term is used for two different things, and mixing them up is where outages, compliance gaps and surprise bills start. In practice it applies at three layers.

Layer 1: platform services Microsoft manages

Here Microsoft owns host patching, availability and the infrastructure underneath. You configure and consume the service, but you do not log in to a server to fix it. Common examples:

• Azure SQL Managed Instance: a PaaS database with near-complete SQL Server compatibility. Microsoft handles OS patching, automated backups and high availability. The trade-off is less low-level control than SQL Server on your own VM.
• Managed Disks: block storage for VMs without managing storage accounts yourself. Encryption at rest and snapshots are built in.
• Azure Managed Applications: a publisher deploys a packaged application into your subscription and keeps operational control of its managed resource group. Useful for internal platforms, but scope RBAC carefully.
• Azure Functions: serverless compute. You own the code, triggers and bindings; on the Premium plan you also own VNet integration and pre-warmed instances.

Layer 2: Microsoft support and advisory

Microsoft sells support contracts and onboarding help such as FastTrack for eligible workloads. These are reactive and advisory. They help with break/fix issues and migration planning, but they do not watch your environment around the clock, answer a security alert at 03:00 or tune your spend.

Layer 3: a managed service provider

An Azure MSP takes operational responsibility for your environment under a defined SLA: monitoring, alert routing, incident response, patching, backup validation, security posture, cost optimisation and compliance documentation. It fills the gap between what Microsoft runs and what your internal team can cover.

The most common mistake we see in onboarding assessments is assuming Layer 1 removes the need for Layer 3. PaaS removes infrastructure chores. It does not remove application monitoring, security configuration, cost governance or audit evidence.

What does Microsoft manage, and what do you still own?

Microsoft manages the physical datacentre, network and hosts in every model; the rest shifts with IaaS, PaaS or SaaS. Microsoft's shared responsibility guidance is explicit that, regardless of deployment type, the customer always keeps responsibility for data, endpoints, accounts and access management. That is the work an MSP picks up.

Core features of a managed Azure service

A provider that only answers tickets is a help desk, not a managed service. These are the features to expect in a real Azure operations contract.

Managed infrastructure services

Day-to-day care of VMs, virtual networks, storage, App Service plans and AKS clusters: guest OS patching, image updates, AKS version upgrades, scaling rules, network security group reviews and ExpressRoute or VPN health. This is what most people mean by "Azure managed infrastructure services".

24/7 monitoring and incident response

Azure Monitor and Log Analytics collect platform telemetry; alerts are routed to an on-call engineer with documented runbooks and P1–P4 response targets. See how we approach cloud monitoring and support.

Security and identity

Microsoft Defender for Cloud for posture and threat detection, Microsoft Sentinel as SIEM, Conditional Access and privileged-access reviews in Entra ID, and an agreed path to managed detection and response for security events.

Backup and disaster recovery

Azure Backup and Site Recovery policies designed around your recovery targets, with restore tests on a schedule. A backup that has never been restored is an assumption, not a control. Our Azure backup service page describes the test cadence we use.

Governance and landing zones

Azure Policy, management groups, tagging and RBAC built on the Cloud Adoption Framework landing zone pattern, so new subscriptions start compliant instead of being cleaned up later.

Delegated, auditable access

Providers should work through Azure Lighthouse, which lets a service provider manage resources across customer tenants while the customer controls who has access and can remove it. Shared admin passwords are a red flag.

FinOps

Weekly anomaly reviews, rightsizing, Azure Hybrid Benefit and a managed reservation portfolio. Microsoft states that reserved VM instances can cost up to 72% less than pay-as-you-go, but only if someone keeps the commitments matched to real usage.

Benefits that show up in production

• Less operational toil. Advisor alerts, Defender recommendations, AKS upgrades and NSG audits create a steady stream of work that does not fit sprint planning. An MSP absorbs it under a fixed scope.
• Faster detection. Without 24/7 monitoring, incidents are often found when a customer complains. With routed alerts and an on-call engineer, detection moves from hours to minutes.
• Compliance as a running process. Evidence is collected continuously instead of rebuilt before each audit.
• Cost control. In Flexera's 2025 State of the Cloud report, 84% of respondents named managing cloud spend as a top challenge, and respondents estimated 27% of cloud spend is wasted. See our cloud cost optimisation service for how we work on that.

How do Azure managed services support NIS2 and GDPR?

They support compliance by running the controls and producing the evidence, but accountability stays with you. NIS2 covers 18 critical sectors across the EU. According to the European Commission's NIS2 FAQ, an in-scope entity must send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month.

Your MSP needs a 24/7 process that feeds those deadlines, and it is itself part of your supply chain. Under GDPR it acts as a data processor, so the contract needs a data processing agreement (Article 28), a sub-processor list, breach notification timelines and audit rights. If a provider cannot show these on request, walk away. India's DPDP Act 2023 places similar obligations on organisations processing Indian personal data. More on scope in our NIS2 guide.

Typical scenarios

These are common patterns from onboarding assessments, not named customers.

• EU SaaS company in an NIS2 sector. Production in EU regions only, enforced with an allowedLocations policy; SQL Managed Instance with customer-managed keys in Key Vault; a 24/7 incident process mapped to the CSIRT notification steps.
• Indian fintech. Production in Central India with DR in South India; AKS with managed upgrades; Defender for Cloud compliance dashboards mapped to DPDP Act and RBI requirements; weekly restore tests logged for audit.
• Multi-cloud enterprise. Azure for Entra ID, Microsoft 365 and .NET workloads, AWS for containers or data platforms. The MSP runs one monitoring and incident process across both and reports total cloud spend, not two separate bills. Our AWS vs Azure vs GCP comparison covers where each fits.

ASM vs ARM: why it still comes up

Azure Service Management (ASM) is the old "classic" deployment model; Azure Resource Manager (ARM) is the current one. Classic resources have no resource groups, RBAC, tags or Azure Policy. Microsoft has retired classic services in stages, and Cloud Services (classic) was deprecated for all customers on 1 September 2024. If an assessment still finds classic resources, migrating them is a security and supportability task, not a nice-to-have.

Tooling a managed Azure service typically uses

Common pitfalls

• Lift-and-shift sizing. VMs keep on-premises sizes. If average CPU sits in the low teens, dropping one size is an easy saving.
• Defender for Cloud left on the free tier. The free tier gives basic posture only; the paid plans add threat detection and vulnerability assessment for servers, SQL, containers and storage.
• Flat networks. One VNet, one subnet, permissive NSGs. Use a hub-and-spoke design, flow logs and Azure Firewall or an NVA for east-west traffic.
• Untested backups. Azure Backup runs reliably; the restore is what matters.

When you don't need an MSP

You may not need one if your estate is small and watched by a capable platform engineer, if workloads are fully serverless with no compliance obligations, or if you already staff a 24/7 on-call rotation. You probably do need one if the estate has outgrown business-hours monitoring, if NIS2, GDPR, SOC 2 or DPDP Act duties require continuous controls, if you run hybrid or multi-cloud, or if the Azure bill grows faster than revenue and nobody can say why.

How Opsio helps

Opsio runs Azure estates for Nordic, EU and Indian organisations from Karlstad and Bangalore: 24/7 monitoring, patching, security operations, backup testing and FinOps under one SLA. Our Azure managed service provider page lists the scope and published price tiers; what an Azure MSP does and costs explains how to compare providers.

The same split between platform-managed services and partner-run operations shows up in our Branäsgruppen case, which is on AWS rather than Azure: the ski resort group's servers and databases moved to managed equivalents, with daily incremental and weekly full backups kept for 60 days under Opsio's managed service. The case reports 40% better average page responsiveness, a 40% lower total cost of ownership and 99.9%+ application uptime.

Frequently asked questions

What is Azure managed services?

It means both Microsoft's platform-managed offerings, such as Azure SQL Managed Instance, Managed Disks and Managed Applications, where Microsoft runs the infrastructure, and the work of third-party providers who monitor, secure and optimise your Azure environment under an SLA. Most production environments use both.

What is the difference between an Azure managed service and an Azure MSP?

A managed service is a product Microsoft operates, like a PaaS database. An MSP is a company that operates your whole estate, including the parts Microsoft leaves to you: configuration, identities, data protection, cost and incident response.

What are the five types of managed services?

The usual grouping is managed infrastructure (compute, network, storage), managed security (SOC, SIEM, detection and response), managed databases, managed applications (deployment, scaling, patching) and managed cloud financial operations (FinOps).

What is the difference between ASM and ARM?

ASM was Azure's original classic deployment model, without resource groups, RBAC or policy. ARM replaced it and is the supported model today, with templates (JSON or Bicep), fine-grained RBAC, tags and Azure Policy. Remaining classic resources should be migrated.

What is a managed device in Azure?

A managed device is a laptop, phone or tablet enrolled in Microsoft Intune. Enrolment lets you enforce compliance rules such as encryption and OS version, apply Conditional Access and wipe the device remotely.

How do Azure managed services help with NIS2 compliance?

A provider with 24/7 security monitoring, documented incident runbooks and audit-ready reporting supports NIS2 risk-management and reporting duties, provided it is contractually bound as part of your supply chain and can show its own certifications.