Start with control versus management effort
Cloud service models describe how much of the technology stack the provider manages for you. Moving from on-premises to IaaS, PaaS and SaaS normally reduces the infrastructure and platform work performed by the customer. It does not remove the customer's responsibility for using the service securely.
IaaS
Rent virtualized infrastructure and keep control of the guest operating system, applications and workload configuration.
PaaS
Deploy code or data services on a managed platform without operating the underlying virtual machines or guest operating system.
SaaS
Use a complete application while the provider operates most of the application and platform stack.
AZ-900 decision rule
Maximum OS control or lift-and-shift: consider IaaS. Build and deploy without managing servers: consider PaaS. Use a finished business application: consider SaaS.
Compare IaaS, PaaS and SaaS by requirement
These are broad categories. Always verify the responsibilities and configuration model of the individual Azure service rather than assuming every service in a category behaves identically.
Shared responsibility does not mean equal responsibility
Microsoft secures and operates the physical datacenter, physical network, physical hosts and virtualization layer for Azure cloud services. Additional layers move to Microsoft as the customer moves from IaaS toward PaaS and SaaS.
- Customer data: the customer remains responsible for classification, protection choices, governance and compliant use.
- Identities and users: the customer manages accounts, access, authentication choices and removal of access.
- Configurations and settings: secure service configuration remains a customer responsibility.
- IaaS operating system: the customer configures, hardens and patches the guest OS.
- PaaS platform: Microsoft manages the underlying OS and runtime infrastructure; the customer manages application code, data, identities and exposed configuration.
- SaaS usage: Microsoft runs the application, but the customer still controls data, user access and tenant configuration.
Responsibility also applies to reliability: Microsoft provides platform capabilities, while the customer chooses and configures the features needed to meet workload requirements.
Recognize common Microsoft examples
A real solution can combine all three. For example, a business might use Microsoft 365 as SaaS, Azure App Service as PaaS for a customer portal and an Azure VM as IaaS for a legacy component.
Worked scenario: modernize a three-tier application
A company has a legacy web application running on servers it patches manually. It wants to reduce management effort, but one vendor component requires administrator access to a Windows operating system.
- Place the vendor component on an Azure virtual machine because the organization still needs guest-OS control. This is IaaS.
- Move the web front end to Azure App Service so developers can deploy code without maintaining web-server virtual machines. This is PaaS.
- Use Azure SQL Database where compatible to reduce database-server and operating-system management. This is PaaS.
- Use Microsoft 365 for employee productivity rather than building and operating an office suite. This is SaaS.
- Continue protecting data, identities, secrets, application code and service configuration across the solution.
- Patch and harden the guest OS on the IaaS virtual machine; Microsoft's management of physical hosts does not patch the customer guest OS.
The correct answer is often a combination, not a rule that one service model is always better. Choose based on required control, compatibility, management effort and business outcome.
Common AZ-900 mistakes
- Assuming IaaS means Microsoft manages the guest operating system.
- Calling every hosted application PaaS.
- Assuming SaaS removes customer responsibility for users and data.
- Choosing PaaS when a workload requires unsupported OS-level customization.
- Choosing IaaS simply because it feels familiar, without considering operational effort.
- Memorizing one example while ignoring the requirement in the scenario.
- Treating shared responsibility as a fixed 50/50 split.
- Ignoring that one architecture can combine IaaS, PaaS and SaaS.
AZ-900 practice checks with explanations
A developer wants to deploy web code without patching operating systems. Which model best fits?
Best answer: PaaS, such as Azure App Service, because Microsoft manages the underlying virtual machines and operating system while the customer manages the application and configuration.
A legacy application requires a custom Windows service and administrator access. Which model provides the required control?
Best answer: IaaS using an Azure virtual machine. The customer gains guest-OS control and also accepts responsibility for its configuration, patching and applications.
A company adopts Microsoft 365. Who manages employee accounts and access?
Best answer: the customer. Microsoft operates the SaaS platform, while the customer retains responsibility for identities, accounts, access and tenant configuration.
Does moving an application from IaaS to PaaS transfer responsibility for customer data to Microsoft?
Best answer: no. More platform operations move to Microsoft, but the customer remains responsible for its data and how access is configured.
Frequently asked questions
What is the main difference between IaaS, PaaS and SaaS?
IaaS gives the customer the most control over virtualized infrastructure, including guest operating systems and applications. PaaS provides a managed application platform, while SaaS provides a ready-to-use application. Customer management decreases from IaaS to PaaS to SaaS.
Who manages the operating system in Azure IaaS?
For an Azure virtual machine, Microsoft manages the physical datacenter, host and virtualization layer, while the customer manages the guest operating system, including its configuration and patching.
Is customer data always the customer's responsibility?
Microsoft's shared-responsibility guidance identifies customer data, identities, accounts, access management, configurations and settings as customer responsibilities across cloud service models, although the exact controls available vary by service.
Is Azure App Service IaaS or PaaS?
Azure App Service is a platform-as-a-service offering. Microsoft manages the underlying virtual machines and operating systems while the customer deploys and secures application code, data, identities and service configuration.
Does SaaS remove all customer security responsibilities?
No. SaaS shifts more platform management to the provider, but customers still manage areas such as data, identities, accounts, access and configuration. Endpoint responsibilities can also remain shared.
Official Microsoft references
- Current AZ-900 study guide
- Describe cloud service types
- Shared responsibility in the cloud
- Shared responsibility for reliability
Confirm the current configuration and responsibility model for each service before making production decisions. ITCertPath uses original learning scenarios and does not reproduce confidential Microsoft exam questions.