AZ-900 Cloud Service Models: IaaS vs PaaS vs SaaS Made Simple
Cloud service models are a core topic on the Microsoft AZ-900 exam. You need to understand the differences between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), and how the shared responsibility model applies. This guide breaks down each model with real Azure examples, exam tips, and common pitfalls.
The Shared Responsibility Model
Before comparing models, understand who manages what. The cloud provider (Microsoft) is always responsible for the physical infrastructure: datacenters, networking, power, and physical security. The customer's responsibility varies by model.
- IaaS: You manage everything above the hypervisor: OS, applications, data, network configuration.
- PaaS: You manage only your applications and data; the platform (runtime, middleware, OS) is managed by Azure.
- SaaS: You manage only your data and access; everything else is managed by the provider.
Infrastructure as a Service (IaaS)
Definition: IaaS provides virtualized computing resources over the internet. You rent virtual machines (VMs), storage, and networks, and have full control over the OS and software.
Azure examples:
- Azure Virtual Machines (VMs) – create a Windows or Linux VM, install any software, configure firewalls.
- Azure Virtual Network (VNet) – define subnets, IP ranges, route tables, and network security groups (NSGs).
- Azure Blob Storage – store unstructured data, accessible via HTTPS (port 443) or SMB (port 445).
Typical use cases:
- Lift-and-shift migration of on-premises servers.
- Running custom applications that require specific OS configurations.
- Hosting a database server like SQL Server on a VM (you manage backups, patches).
Exam tip: IaaS gives you the most control but also the most management overhead. Expect questions about when to choose IaaS over PaaS (e.g., need to install custom drivers or use a legacy OS).
Platform as a Service (PaaS)
Definition: PaaS provides a managed platform to run applications without managing the underlying infrastructure. You deploy your code; Azure handles the OS, runtime, scaling, and patching.
Azure examples:
- Azure App Service – deploy web apps using .NET, Java, Python, Node.js, etc. No VM management; you can scale out automatically.
- Azure SQL Database – fully managed SQL Server database with built-in high availability, automatic backups, and patching. Connection uses port 1433 (TDS protocol).
- Azure Functions – serverless compute for event-driven code; you only pay per execution.
Typical use cases:
- Web applications that need auto-scaling and high availability.
- API backends where you don't want to manage IIS or Nginx.
- Data processing pipelines using Azure Data Factory.
Exam tip: PaaS reduces operational overhead but may limit customization. For example, Azure SQL Database does not allow sysadmin access, so you cannot change certain configuration settings. Questions often test whether the customer can still manage the OS (no, they cannot).
Software as a Service (SaaS)
Definition: SaaS delivers fully functional software over the internet. You access it via a web browser or client; the provider manages everything.
Azure examples:
- Microsoft 365 (formerly Office 365) – email (Exchange Online), Teams, SharePoint, OneDrive.
- Dynamics 365 – CRM and ERP applications.
- Azure DevOps – source control, CI/CD pipelines, project boards.
Typical use cases:
- Email and collaboration tools.
- Customer relationship management (CRM).
- Enterprise resource planning (ERP).
Exam tip: With SaaS, you are responsible for data classification, user access (identity management), and compliance. The provider handles security patches, uptime, and infrastructure. Expect questions about what you control: only data and users.
How Each Model Appears on the AZ-900 Exam
The AZ-900 exam tests your ability to:
Identify the model based on a scenario. Example: "A company wants to migrate a custom application that requires a specific OS version. Which model?" Answer: IaaS.
Understand the shared responsibility for each model. Know exactly what the customer manages vs. Microsoft.
Match Azure services to the correct model. For instance, Azure SQL Database is PaaS, SQL Server on a VM is IaaS, and Exchange Online is SaaS.
Recognize trade-offs: Control vs. management overhead. IaaS gives most control, SaaS least.
Exam Tips: What to Watch For
- Ports and protocols: Not heavily tested, but know that Azure SQL Database uses port 1433 (TDS), web apps use 80/443 (HTTP/HTTPS), and RDP uses 3389.
- Scaling: PaaS often supports auto-scaling; IaaS requires manual scaling or using VM scale sets.
- Pricing: IaaS is pay-per-use for VMs and storage; PaaS often charges per resource consumption (e.g., App Service plan); SaaS is per-user subscription.
- Hybrid scenarios: Azure Arc extends management to on-premises, but the service model still applies.
Common mistake: Thinking that PaaS means you don't manage anything. You still manage your application code and data. SaaS means you don't manage the application itself.
Conclusion
Mastering IaaS, PaaS, and SaaS is essential for the AZ-900 exam. Focus on the shared responsibility model and real Azure examples. Remember: IaaS = you manage the OS; PaaS = you manage only code/data; SaaS = you manage only data/access. Use this framework to answer scenario-based questions.
To reinforce your knowledge, practice with sample questions that ask you to identify the correct model for a given workload. The more you apply these concepts, the more intuitive they become.
Ready to test yourself? Try free AZ-900 practice questions at example.com/practice to solidify your understanding of cloud service models.