Who is responsible for security configuration — Microsoft, my CSP partner, or me?

This follows Microsoft's broader "shared responsibility model": Microsoft secures the underlying cloud infrastructure, but you (the customer) are responsible for how you configure identity, access, and data protection within your tenant. A CSP partner can help implement and manage that configuration on your behalf if you grant them the access to do so, but ultimate accountability for your organization's security posture remains with you as the customer, regardless of who's doing the day-to-day configuration work.