Cloud Service Types: IaaS, PaaS, and SaaS

Not sure you’re ready?

Take the ~3-minute readiness diagnostic and see where you stand.

When a company decides to build a new factory, executives face a fundamental choice about how much of the underlying infrastructure they want to own and maintain. They could buy the land, pour the concrete, run the electrical grid, and build the assembly lines from scratch—a monumental upfront investment that grants absolute control but demands total responsibility for every broken pipe and blown fuse. Alternatively, they could lease a fully powered, empty warehouse, freeing themselves to focus only on the assembly lines. Or, in the extreme, they could simply contract an existing factory to manufacture their product, paying only for the finished goods rolling off the line.

This spectrum of ownership and responsibility mirrors exactly how modern organizations consume computing power. In an on-premises data center, the customer manages the entire computing stack from physical hardware to the application. Moving to the cloud fundamentally shifts this dynamic, allowing businesses to rent varying degrees of infrastructure, platforms, and software rather than owning them outright. Understanding where the cloud provider's job ends and your job begins is not just a technical detail—it is the financial and operational linchpin of modern IT strategy.

In a traditional on-premises data center, an organization must purchase, power, and maintain all physical server racks and networking equipment themselves.

Before we look at the specific types of cloud services, we must understand the rulebook that governs them all. We call this the shared responsibility model.

The shared responsibility model dictates which security and management tasks are handled by the cloud provider and which are handled by the customer. Think of it as a sliding scale of labor. As you move from owning your own servers to renting cloud software, the cloud provider takes on more of the daily operational burden.

A visual comparison of the shared responsibility model, illustrating how the management burden shifts from the customer to the cloud provider across On-Premises, IaaS, PaaS, and SaaS environments.

However, no matter which cloud model you choose, there are certain assets you can never hand off to Microsoft, Amazon, or Google. The cloud provider will never know who your employees are, what data is highly confidential, or whether your staff is logging in from a secure corporate laptop or an unsecured public kiosk.

The Three Universal Customer Responsibilities Across all cloud service types, the customer always retains responsibility for:

Their data (Classifying and protecting the information itself)

Endpoint devices (Securing the phones, tablets, and laptops used to access the cloud)

Accounts and identities (Managing who gets access to what)

Everything else—from the physical security of the server racks to the patching of the operating systems—shifts depending on whether you choose IaaS, PaaS, or SaaS.

Infrastructure as a Service (IaaS) provides on-demand computing infrastructure over the internet. Rather than purchasing physical servers that depreciate over time, IaaS allows customers to rent virtualized hardware components like servers, storage, and networking.

IaaS relies on hardware virtualization, which abstracts underlying physical components into virtual machines that customers can provision on demand.

In this model, the division of labor is quite literal. In IaaS, the cloud provider manages the physical data center, physical network, and physical hosts. They ensure the building has power, the servers are racked, and the internet cables are plugged in. But the moment that server is turned on and handed over to you virtually, their job is done.

In IaaS, the customer manages operating systems, network configuration, database configuration, and applications. If your virtual server runs out of disk space, or if a hacker exploits a vulnerability in your unpatched Windows or Linux operating system, that is entirely your responsibility to fix.

Because you are responsible for the software from the operating system up, IaaS requires the most customer management effort among the three primary cloud service types.

Why Use IaaS?

Why would an organization choose a model that requires so much work? Because IaaS provides the highest level of flexibility and control over the IT hardware resources among cloud service types. It is best suited for scenarios requiring strict control over the operating system and installed software.

Real-World Use Cases for IaaS:

Lift-and-Shift Migration: This is a common use case for IaaS. Lift-and-shift migration involves moving existing applications to the cloud without redesigning the applications. If your company has a legacy accounting application running on an old on-premises server, you can literally copy that server's image and drop it into an IaaS virtual machine.
Rapid Development Environments: IaaS is commonly used for establishing temporary testing and development environments quickly. If a team needs ten high-powered servers for a two-week stress test, they can spin them up, run the test, and delete them, paying only for the hours they were running.

Azure Example: Azure Virtual Machines are a classic example of an Infrastructure as a Service (IaaS) offering.

If IaaS is renting an empty warehouse, Platform as a Service (PaaS) is renting a fully equipped assembly line.

PaaS provides a complete development and deployment environment in the cloud. It is designed to support the complete web application lifecycle from building and testing to deploying and managing.

Imagine you are a software developer. Your goal is to write code and deliver a brilliant application to your customers. You do not want to spend your Friday night updating the anti-virus software on a server, or patching a database engine. PaaS fundamentally shifts this operational burden.

In PaaS, the cloud provider manages the underlying infrastructure including servers, networking, storage, and operating systems. By taking ownership of the operating system, PaaS eliminates the need for customers to manage software updates and operating system patches. In PaaS, the customer focuses primarily on developing and managing applications and data.

Why Use PaaS?

PaaS is a massive productivity multiplier for engineering teams. By abstracting the servers away, PaaS is best suited for development teams that want to focus purely on application code.

Furthermore, PaaS allows organizations to use sophisticated development tools and frameworks without purchasing expensive software licenses. Instead of buying a $50,000 enterprise database license upfront, you can rent access to a globally distributed, highly available database engine by the hour.

Real-World Use Cases for PaaS:

Modern App Development: PaaS is commonly used by developers to create web or mobile applications without setting up servers. They simply write the code, push it to the platform, and the cloud provider handles the computing power required to run it.

Azure Examples:

Azure App Service is an example of a Platform as a Service (PaaS) offering, allowing developers to host web applications effortlessly.
Azure SQL Database is an example of a Platform as a Service (PaaS) offering, providing a fully managed relational database where Microsoft handles the backups, patching, and tuning.

Finally, we arrive at the top of the cloud computing stack. Software as a Service (SaaS) delivers centrally hosted applications to users over the internet.

In this model, you are not managing servers, and you are not deploying code. In SaaS, the cloud provider manages the entire computing stack including the application, middleware, and underlying infrastructure. The software is already built, fully patched, and ready to use.

In a typical SaaS architecture, the cloud provider maintains a centrally hosted platform where all customers run the same version of the software simultaneously.

Because the provider does almost all the heavy lifting, SaaS requires the least customer management effort among the three primary cloud service types. SaaS customers are responsible only for configuring the software to fit their needs and managing user access.

SaaS operates on a subscription software model where customers rent the use of the app for their organization, typically paying a monthly or annual fee per user. Furthermore, SaaS applications are typically accessed by end-users through a web browser, meaning there is often no complex software to install on local machines.

Why Use SaaS?

SaaS is best suited for organizations that want to use out-of-the-box software quickly without development effort. Why spend millions of dollars and years of engineering time trying to build your own proprietary corporate email system when you can simply rent a world-class system instantly?

Real-World Use Cases for SaaS:

Corporate Utilities: A common use case for SaaS is providing email and communication tools to an organization. When you hire a new employee, you simply create an account, assign a license, and they instantly have access to their inbox, calendar, and chat applications.

Examples:

Microsoft 365 (which includes Exchange, Teams, Word, and Excel online) is an example of a Software as a Service (SaaS) offering.
Microsoft Dynamics 365 (Microsoft's suite of enterprise resource planning and customer relationship management applications) is an example of a Software as a Service (SaaS) offering.

To pass the AZ-900 and to make sound IT decisions in the real world, you must evaluate trade-offs. The choice between IaaS, PaaS, and SaaS is always a trade-off between control and convenience.

Feature	IaaS (Infrastructure)	PaaS (Platform)	SaaS (Software)
What it is	Virtualized hardware (Servers, Storage)	Complete development environment	Centrally hosted web application
Who it is for	IT Administrators	Software Developers	End Users / Entire Organizations
Management Effort	Most customer effort	Moderate customer effort	Least customer effort
Provider Manages	Physical hardware & facility	Hardware + Operating Systems	Entire stack (Hardware, OS, App, Middleware)
Customer Manages	OS, Network/DB config, Apps, Data	Applications, Data	Software configuration, User Access, Data
Ideal Use Case	Lift-and-shift migrations; strict OS control	Focusing purely on app code without server setup	Out-of-the-box communication tools instantly
Azure Example	Azure Virtual Machines	Azure App Service, Azure SQL	Microsoft 365, Dynamics 365

Notice how, as we move from left to right across this table, the cloud provider does more, and you do less. By strategically mixing these three models, a modern organization can retain absolute control where their business requires it, while aggressively offloading mundane operational tasks to the cloud.