Nobody understand the (Azure) Cloud

Subj. quote from a movie 

Trying to ‘understand’ and pass on What Azure and the ‘Concepts’ is (besides all the IaaS, PaaS, SaaS)

There’s a lot more than this of course 🙂 - but can it  be 'boiled' down to this quick explanation:

Azure is ‘Subscription’ based (one or more subscriptions) - a lot of services is offered in Azure - allows to deployed various ‘resources/groups’ which have more than 1 or more resources - access to these should be ‘controlled’ with an RBAC model 

1) the Security resides in the Deployed ‘resource’ as MS secure the overall Platform?

2) if a firewall is deployed as a ‘resource’ -then besides which ports that are opened - it’s still about who has access to the ‘resource’?

3) If a VM is deployed as a resource the ‘security’ is still ‘Who has access’?

4)Traditional ‘pen-test’ are ‘obsolete’ in regards to Azure Ressources?

can anyone assist? - Maybe with some easy reading/drawing links?