IaaS, PaaS, and SaaS Explained
The three service types define how much you manage versus how much the cloud provider manages. Understanding IaaS, PaaS, and SaaS is essential for the AZ-900 exam.
What are cloud service types?
Think of three ways to get dinner.
IaaS (Infrastructure as a Service) = you rent a kitchen. You bring your own ingredients, cook the meal yourself, and clean up. Maximum control, maximum effort.
PaaS (Platform as a Service) = you use a meal kit service. Ingredients are pre-measured and delivered. You still cook, but the prep is done for you.
SaaS (Software as a Service) = you order takeaway. Someone else cooks, packages, and delivers it. You just eat. Minimum effort, minimum control.
Each level trades control for convenience. The more the provider manages, the less you worry about — but the less you can customise.
The three service types compared
| Feature | IaaS | PaaS | SaaS |
|---|---|---|---|
| You manage | OS, apps, data, middleware, runtime | Apps and data only | Data and configuration only |
| Provider manages | Physical hardware, networking, virtualisation | Hardware, OS, middleware, runtime | Everything — hardware, OS, apps, updates |
| Flexibility | Most flexible — full control | Moderate — control your code | Least flexible — configured, not customised |
| Complexity | Highest — you manage the most | Medium — focus on development | Lowest — just use the app |
| Azure example | Azure Virtual Machines | Azure App Service, Azure SQL Database | Microsoft 365, Dynamics 365 |
| Analogy | Rent a kitchen | Use a meal kit | Order takeaway |
IaaS — Infrastructure as a Service
IaaS gives you the raw building blocks of cloud computing. You get virtual machines, storage, and networking — and you manage everything on top.
What’s included: Virtual machines, virtual networks, storage disks, firewalls
What you manage: Operating system, patches, middleware, runtime, applications, data
Azure IaaS examples:
- Azure Virtual Machines — run Windows or Linux servers
- Azure Virtual Network — create private networks
- Azure Disk Storage — attach storage disks to VMs
Summit Construction’s IaaS scenario
Summit Construction migrates their legacy project management software to Azure. The software only runs on Windows Server 2019 with specific configurations. They deploy it on Azure VMs — same OS, same setup, just running in the cloud instead of their old server room.
IaaS is perfect here because:
- They need full control over the OS and software configuration
- The legacy app can’t run on PaaS (it’s not a modern web app)
- They want to migrate quickly without rewriting the application
Lift-and-shift migration
Moving an on-premises application to IaaS without changing it is called lift-and-shift migration. You “lift” the app from your server room and “shift” it to a cloud VM.
This is the fastest migration path but doesn’t take full advantage of cloud-native features. Many organisations start with lift-and-shift and then gradually modernise to PaaS over time.
PaaS — Platform as a Service
PaaS gives you a ready-made platform for building and deploying applications. The cloud provider manages the infrastructure, OS, and middleware — you focus on your code.
What’s included: Everything in IaaS PLUS operating system, middleware, runtime, development tools
What you manage: Your application code and your data
Azure PaaS examples:
- Azure App Service — host web apps without managing servers
- Azure SQL Database — managed database service
- Azure Functions — serverless compute (also PaaS)
- Azure Cosmos DB — globally distributed database
Kai’s PaaS project
Kai builds a web app for their university coursework using Azure App Service. They write the code in Python, push it to Azure, and it’s live in minutes. They never touch a VM, configure an OS, or install a web server.
PaaS is perfect here because:
- Kai wants to focus on code, not infrastructure
- No need to patch operating systems or configure web servers
- Built-in scaling handles traffic spikes during assignment deadlines
- Lower cost than running a full VM
SaaS — Software as a Service
SaaS delivers complete, ready-to-use applications over the internet. You don’t build or deploy anything — you just sign in and use it.
What’s included: The entire application, fully managed
What you manage: Your data and some configuration settings
SaaS examples:
- Microsoft 365 (Outlook, Teams, SharePoint, Word)
- Dynamics 365 (CRM, ERP)
- Salesforce
- Dropbox
Peak Roasters uses SaaS every day
Peak Roasters doesn’t build their own email system or collaboration tools. They subscribe to Microsoft 365:
- Outlook for email
- Teams for messaging and video calls
- SharePoint for shared documents
- OneDrive for personal file storage
They pay per user per month. Microsoft handles all updates, security patches, and infrastructure. Peak Roasters just logs in and works.
Shared responsibility by service type
This is where Module 1’s shared responsibility concept gets specific. The more the provider manages, the less you manage:
| Responsibility | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical security | Provider | Provider | Provider |
| Physical network | Provider | Provider | Provider |
| Physical hosts | Provider | Provider | Provider |
| Operating system | You | Provider | Provider |
| Network controls | You | Shared | Provider |
| Applications | You | You | Provider |
| Identity and access | You | You | Shared |
| Data | You | You | You |
Key exam concept: No matter which service type you use, you are always responsible for your data, your identities, and your access management. This never shifts to the provider.
Exam tip: Shared responsibility questions
The exam frequently asks: “In a PaaS model, who is responsible for operating system patching?”
Answer: The cloud provider. In PaaS, the provider manages the OS. You only manage your application code and data.
Quick rules:
- IaaS: You manage from the OS up
- PaaS: You manage apps and data only
- SaaS: You manage data and some configuration only
- Always you: Data + identity/access
🎬 Video walkthrough
Flashcards
Knowledge Check
Summit Construction wants to migrate their legacy Windows Server application to Azure WITHOUT rewriting any code. Which service model should they use?
Kai deploys a Python web app to Azure App Service. They push their code and it runs — they never configure an OS or install a web server. Which service model is Azure App Service?
In a PaaS deployment, who is responsible for patching the operating system?
Next up: Choosing the right cloud service — decision scenarios for when to use IaaS, PaaS, or SaaS.