Cloud service models are one of the core topics on the AZ-900 exam. IaaS, PaaS, and SaaS — these three acronyms can look similar at first, but once you understand how to tell them apart, you can answer "which model fits this scenario?" questions with confidence. The kitchen analogy makes all three crystal clear.
Understanding All Three Models at a Glance — The Kitchen Analogy
Imagine you want to cook a meal. You have three options.
Option one, renting an empty kitchen (IaaS): You rented a bare kitchen. It has a stove, knives, pots, and an oven. But you have to buy the ingredients yourself at the grocery store, develop your own recipe, and wash up after cooking. Maximum freedom — but a lot of work.
Option two, meal kit service (PaaS): You ordered a meal kit. Pre-cut ingredients and step-by-step recipe cards arrive together. You need to know how to use a knife, but there is no shopping or recipe development required. You focus purely on the cooking itself.
Option three, going to a restaurant (SaaS): You walked into a restaurant. All you do is choose from the menu. The restaurant cooks, serves, and cleans up. Maximally convenient, but you cannot change the menu or modify the recipe.
This analogy maps directly onto Azure services.
!IaaS, PaaS, and SaaS compared
IaaS — Infrastructure as a Service
IaaS is a model in which the cloud provider delivers physical hardware (servers, networking, storage) over the internet. The customer installs an operating system (OS) directly on top of that infrastructure, then builds the software stack above it. This gives the highest level of flexibility and control.
What the customer manages in IaaS
Operating system installation and patching (Windows updates, Linux kernel upgrades) Runtime environment (Java, Python, .NET, etc.) Middleware and application servers (Apache, Nginx, IIS) Application code and data Network firewall rules and security groups
Key Azure IaaS services
Azure Virtual Machines: Create and operate Windows or Linux virtual servers in the cloud. Freely choose OS, memory, CPU, and disk size. Azure Virtual Network (VNet): Build a virtual private network. Control subnets, IP ranges, and routing tables. Azure Disk Storage (Managed Disks): Block storage attached to virtual machines. Choose SSD or HDD. Azure Load Balancer: Distribute traffic across multiple VMs.
When IaaS is the right choice
Migrating existing on-premises servers to the cloud exactly as they are (Lift and Shift migration) When a specific OS version or custom software configuration is required When fine-grained performance tuning is needed, such as for game servers When you need to manage specific software licenses directly
PaaS — Platform as a Service
PaaS provides a fully built development environment (platform) where developers can create applications. Azure manages the operating system, runtime, middleware, and database engine. Developers focus entirely on writing and deploying code. They never need to worry about server patches or OS upgrades.
What the customer manages in PaaS
Application code Application configuration (environment variables, connection strings) Data (database contents, files) Access control (who can access the application)
Key Azure PaaS services
Azure App Service: Deploy web apps, REST APIs, and mobile backends by uploading code — automatic deployment follows. Supports Node.js, Python, Java, .NET, and PHP. OS patching, load balancing, and auto-scaling are all automatic. Azure SQL Database: A fully managed relational database built on the SQL Server engine. No need to install, operate, or patch SQL Server yourself. Azure Functions: Serverless computing that runs code at the function level. Code executes on an event-driven basis with no server provisioning required. Azure Kubernetes Service (AKS): Container orchestration platform for running containers at scale. Azure manages the Kubernetes control plane. Azure Cosmos DB: Globally distributed NoSQL database. Multi-region replication with guaranteed low latency.
When PaaS is the right choice
When rapid application development and deployment are required When the team lacks dedicated infrastructure specialists When traffic is highly variable and auto-scaling is needed When building DevOps pipelines and automating CI/CD
SaaS — Software as a Service
SaaS is a model in which fully completed software is delivered over the internet. The provider handles installation, patching, updates, backups, and maintenance. Users simply log in through a web browser or app. No IT expertise is required at all.
What the customer manages in SaaS
Data (documents, files, records) User accounts and access permission settings How the software is used (within the configuration and customization options provided)
Key Azure / Microsoft SaaS services
Microsoft 365 (Word, Excel, PowerPoint, Outlook, OneNote): Work on documents in a web browser with no installation. Always the latest version automatically. Microsoft Teams: Video meetings, chat, file sharing, and collaboration. Accessible from anywhere in the world. Dynamics 365: CRM (Customer Relationship Management) and ERP (Enterprise Resource Planning) business solutions. Microsoft Intune: Device management solution. Remotely manage employee smartphones and laptops. Microsoft Power BI: Data visualization and business intelligence platform.
When SaaS is the right choice
Companies that need general-purpose business tools such as email and document editing Small startups without an IT department When rapid deployment is needed and software customization is not critical When remote teams need collaboration tools
Responsibility Comparison Table — Who Manages What
This is the most important concept in the cloud shared responsibility model. You must understand exactly which layers the provider manages and which layers the customer manages.
| Responsibility | On-premises | IaaS | PaaS | SaaS | |--------------|-------------|------|------|------| | Physical data center | Customer | Provider | Provider | Provider | | Physical network hardware | Customer | Provider | Provider | Provider | | Physical server hardware | Customer | Provider | Provider | Provider | | Virtualization layer | Customer | Provider | Provider | Provider | | Operating System (OS) | Customer | Customer | Provider | Provider | | Network settings / firewall | Customer | Customer | Provider | Provider | | Middleware / Runtime | Customer | Customer | Provider | Provider | | Application code | Customer | Customer | Customer | Provider | | Data | Customer | Customer | Customer | Customer | | User accounts / access management | Customer | Customer | Customer | Customer |
Core rule: Moving from IaaS to PaaS to SaaS, the number of items the customer must manage decreases steadily. However, data and user account management are always the customer's responsibility in every model. Remember this without exception.
Quick Comparison of the Three Models
| Comparison | IaaS | PaaS | SaaS | |-----------|------|------|------| | Kitchen analogy | Empty kitchen rental | Meal kit service | Restaurant | | Control level | Highest | Medium | Lowest | | Management burden | Most | Medium | Least | | Flexibility | Highest | Medium | Lowest | | Deployment speed | Slow | Fast | Immediate | | Azure examples | Virtual Machines | App Service, Azure SQL Database | Microsoft 365, Teams | | Target user | Infrastructure engineers | Developers | General users |
Tricky Service Classifications
Here are services that are frequently confused on the exam.
Azure Functions is PaaS. The word "serverless" might suggest a separate category, but serverless is simply one form of PaaS. Developers write code only, and the platform manages the entire execution environment.
Azure Kubernetes Service (AKS) is PaaS. Even though it is a container orchestration platform, Azure manages the Kubernetes master nodes (control plane). Users are responsible only for worker nodes and app deployments.
Azure Virtual Machine Scale Sets is IaaS. Although it automatically adjusts the number of VMs, the customer is still responsible for the OS and software on each VM.
Exam Key Points
"Install the OS yourself, patch it yourself, configure the runtime yourself" -- IaaS
"Deploy code only, Azure manages the OS and runtime" -- PaaS
"Log in via browser and use immediately, no installation or updates needed" -- SaaS
"Azure Virtual Machines, Azure Virtual Network, Azure Disk Storage" -- Core IaaS services
"Azure App Service, Azure SQL Database, Azure Functions, AKS" -- Core PaaS services
"Microsoft 365, Microsoft Teams, Dynamics 365" -- Core SaaS services
"Move existing on-premises app to the cloud as-is (Lift and Shift)" -- Scenario where IaaS is the answer
"Data and user account management are always the customer's responsibility in every model" -- Core shared responsibility rule
"Serverless (Azure Functions) falls under the PaaS category" -- Commonly confused classification