Cloud service types: IaaS, PaaS and SaaS, and when each fits

Why this matters

Every workload that goes into the cloud lands in one of three service types, and the choice decides who does the work afterwards. Pick infrastructure and your administrators keep patching operating systems. Pick a platform and your developers lose the ability to install whatever they like on the server. Pick finished software and you get it working today, but you can only configure what the vendor offers. A manager approving a migration plan, a salesperson matching a customer to a product, and a junior administrator asked "can we install this agent?" all need to know which type they are dealing with.

Getting it wrong is expensive in both directions. A team that rebuilds every application as a platform service before a datacenter lease ends runs out of time. A team that puts a simple web app on virtual machines spends years maintaining servers it never needed. This lesson defines the three types, shows how the shared responsibility model (lesson 1) shifts between them, and gives the patterns for choosing.

The lesson

Describe infrastructure as a service (IaaS)

Infrastructure as a service (IaaS) rents out the basic building blocks of computing: compute, storage and networking. The customer builds and manages everything it runs on them.

Azure examples:

• Azure Virtual Machines, where the customer picks the size and the operating system;
• Azure Virtual Network, the private network the VMs connect to;
• Azure Disk Storage, the disks attached to VMs.

The split of duties:

• Microsoft manages the physical datacenter, the physical network, the physical hosts and the virtualisation layer. It replaces failed disks in host servers. Its responsibility stops at the hypervisor.
• The customer manages everything inside each VM: the guest operating system and all its updates, any middleware, the applications it installs, and their configuration. It also configures network controls, such as the security rules that allow or block traffic to its VMs. Microsoft owns the network hardware, but deciding which traffic may reach the company's machines is the company's job. And, as always, the customer owns its data, devices, and accounts and identities.

If a company installs SQL Server itself on an Azure VM so that it can control the operating system and instance settings, that is IaaS. Azure hosts the server, but Azure hosts every service type. What makes it IaaS is that the customer runs the VM and everything on it. The customer installs and configures the database software; neither Microsoft nor the database vendor does.

IaaS is the most flexible service type. The trade-off is simple: more control, but more management work.

Describe platform as a service (PaaS)

Platform as a service (PaaS) gives the customer a managed environment on which to build and run its own applications. Microsoft runs the servers, the operating system, the runtime and the middleware. The customer brings its code and its data.

Azure examples:

• Azure App Service hosts web apps and APIs. It has built-in scaling, load balancing and deployment slots, so developers spend their time on features. As an app gets busier, the company sets scale rules or picks a larger plan, and the platform adds instances. App Service runs on virtual machines underneath, but the team never manages them, so it is still PaaS.
• Azure SQL Database is a managed relational database. Microsoft handles the operating system, engine patching and backups. The company designs its tables and schema and controls who can reach its data.
• Managed analytics services, where the provider operates the platform and the team brings its data and queries.

The split of duties:

• Microsoft manages everything IaaS gives it, plus the operating system and runtime. The team does no OS or runtime patching.
• The customer manages its application code (writing, testing and deploying it), its data, and who can access the application.

The limit is the other side of that convenience. In PaaS the provider hides the operating system. Customers generally cannot install kernel modules, get administrator rights on the host, or install software such as a monitoring agent that needs those rights. Where that is needed, IaaS is the answer.

Azure Functions (lesson 2) builds on the PaaS idea and goes further: the provider runs the platform and also decides how much compute to supply, so the developer manages no servers at all and, on a consumption plan, pays only when the code runs.

The PaaS trade-off: less control, and less management work.

Describe software as a service (SaaS)

Software as a service (SaaS) delivers a complete application that the provider runs and updates. Users reach it through a browser or a client app, usually on a subscription.

Examples:

• Microsoft 365 for email, calendars and document collaboration;
• Outlook on the web for reading email in a browser;
• Microsoft Teams for video meetings and chat;
• Microsoft Dynamics 365 for customer relationship management (CRM) and other business applications;
• third-party subscriptions for HR, finance or expense tracking.

The split of duties:

• The provider manages the whole stack: the application code, the platform, the infrastructure, patching the servers and scaling them for demand. New features appear without any upgrade project on the customer's side.
• The customer manages its information and data, the devices that connect to the service, and its accounts and identities, including which employees can sign in. It can configure the application, but it cannot change the application's code or its platform.

SaaS is the most complete service type. Its trade-off: least to manage, but least room to customise.

Choosing IaaS, PaaS or SaaS for a workload

The three types form a range. Moving from IaaS to PaaS to SaaS, Microsoft takes on more of the work and the customer gives up more of the control.

Three things are the same in every column: the provider looks after the physical datacenters, network and hosts; the customer looks after its data, its devices, and its accounts and identities.

IaaS fits when:

• lift-and-shift migration: a company must move dozens of servers quickly, for example because its datacenter lease ends in three months, and redesign the applications later. Rehosting them as Azure VMs moves them with little change;
• a legacy application must move without changing its code, and the administrators must keep control of its operating system and patches;
• testing and development needs environments that mirror production, with a specific OS version or custom drivers, created and deleted on demand;
• software must be installed with administrator rights, such as a third-party backup or monitoring agent;
• the workload needs the most control over the operating system, middleware and installed software.

PaaS fits when:

• developers want to write and control their own code without managing servers, operating systems or patching;
• a team builds a custom web app or API and releases updates often, perhaps several times a day;
• a company has developers but a small operations team: it owns its code and data, and Azure runs the platform;
• a team wants a relational database without managing the database server's operating system, patching or backups;
• a data team wants to analyse large datasets with managed tools rather than build its own cluster.

SaaS fits when:

• the need is standard and someone already sells it: email, calendars, meetings, CRM, HR, expenses;
• the organisation has no developers and wants to start quickly, on a subscription;
• it wants no software to install, host or maintain.

A worked mapping: a company needs to host a custom web app, give staff email, and run a legacy server that needs a specific OS build. That is App Service (PaaS), Microsoft 365 (SaaS) and Azure Virtual Machines (IaaS), in that order.

Service types are chosen per workload, not per company. One organisation commonly runs IaaS for legacy servers, PaaS for new applications and SaaS for email, all at once. Nothing in Azure ties an organisation to a single type, and mixing them needs no private cloud.

What the exam is really asking

• Name the type from the duty. If the customer patches the guest operating system, it is IaaS. If Microsoft patches the OS but the customer writes the code, it is PaaS. If the provider updates the application itself, it is SaaS.
• Hosted by Azure is not a clue. Azure hosts every type. SQL Server on a VM is IaaS; Azure SQL Database is PaaS. App Service runs on VMs but is PaaS, because the customer never manages them.
• Constants across all three. Physical datacenters, network and hosts are always the provider's. Data, devices, and accounts and identities are always the customer's. In SaaS the customer still decides who can sign in; in PaaS it still owns the data it stores.
• The trade-offs. IaaS: more control, more work. PaaS: less control, less work. SaaS: least to manage, least room to customise. The customer's responsibility is largest with IaaS.
• Know what blocks PaaS. A custom kernel module, administrator rights on the OS, or a pinned OS build all point to IaaS.
• Read the scenario's constraint. "Lease ends soon, redesign later" is lift-and-shift onto VMs. "No developers, standard features, start next month" is SaaS. "Developers but few operations staff" is PaaS.
• Examples to recognise. IaaS: Azure Virtual Machines, Azure Virtual Network, Azure Disk Storage. PaaS: Azure App Service, Azure SQL Database. SaaS: Microsoft 365, Outlook on the web, Microsoft Teams, Dynamics 365.