IaaS vs PaaS vs SaaS: What Is the Actual Difference?

AZ-900 · Updated June 2026

IaaS, PaaS, and SaaS are the three cloud service models. They appear in the very first domain of the AZ-900 exam and come up again throughout because they affect how you think about every Azure service. The concept is simple once you understand what changes between them: the amount of control you hand over to the cloud provider.

The one question that explains all three

The question is: who manages what? In any cloud setup, there is a stack of layers starting from physical hardware at the bottom and ending with the application and data at the top. The cloud provider always manages the physical infrastructure. What varies is where their responsibility ends and yours begins.

IaaS: Infrastructure as a Service

With IaaS, you rent the infrastructure and manage everything above it. The cloud provider gives you virtual machines, storage, and networking. You install the operating system, configure the software, deploy your application, and maintain all of it. You have maximum control, but maximum responsibility too.

The most common Azure IaaS examples are Azure Virtual Machines and Azure Managed Disks. When you spin up a VM, you choose the OS, install your software, apply patches, and handle security configuration. Microsoft handles the physical host, the hypervisor, and the network infrastructure underneath.

IaaS is the right choice when you need full control over the environment. It is common for legacy applications that cannot run on a managed platform, for custom configurations that a PaaS service does not support, or for lift-and-shift migrations where you move an existing setup to the cloud without changing it.

PaaS: Platform as a Service

With PaaS, the cloud provider manages the operating system, runtime, middleware, and infrastructure. You focus entirely on your application and your data. You do not patch servers, you do not configure networking at the OS level, and you do not worry about the underlying hardware.

Azure App Service is the clearest PaaS example. You deploy your web application code and Azure handles the rest: scaling, OS updates, load balancing, SSL certificates. Azure SQL Database is another: you get a fully managed relational database without managing a SQL Server instance. Azure Functions takes it further by abstracting away even the server concept entirely.

PaaS is the right choice for most modern applications. You build faster, spend less time on infrastructure maintenance, and can scale more easily. The trade-off is less control over the underlying environment.

SaaS: Software as a Service

With SaaS, you use a finished application delivered over the internet. You do not manage any infrastructure, any platform, or any application code. The provider manages everything. You configure the application and manage who has access to it and what data goes into it.

Microsoft 365 is the most familiar SaaS example: Outlook, Teams, Word, and Excel delivered as a subscription without any installation or server management. Dynamics 365 (CRM and ERP) is another. From an Azure exam perspective, Microsoft Entra ID can also be considered SaaS since it is a fully managed identity service you consume rather than operate.

How this connects to the shared responsibility model

The shared responsibility model is a direct extension of IaaS, PaaS, and SaaS. It defines exactly who is responsible for each layer of the stack depending on the service model you are using.

• arrow_rightPhysical security of datacenters is always the cloud provider's responsibility regardless of service model.
• arrow_rightOperating system patching is your responsibility with IaaS, the provider's with PaaS and SaaS.
• arrow_rightApplication code is always your responsibility in IaaS and PaaS. With SaaS the provider owns the code.
• arrow_rightData and identities are always your responsibility, in every service model.

The AZ-900 exam tests the shared responsibility model in combination with service type questions. A scenario asking who is responsible for applying OS updates when using Azure App Service points to PaaS: the answer is Microsoft. The same scenario on a VM points to IaaS: the answer is you.

How to answer IaaS vs PaaS vs SaaS questions on the exam

AZ-900 rarely asks you to define IaaS, PaaS, or SaaS directly. It asks you to identify which model fits a scenario, or which Azure service is an example of each. The two patterns you will see most often:

1. 1

   Scenario matching

   A company needs to run a web application without managing the underlying servers. The answer is PaaS (Azure App Service). A company needs to migrate an existing Windows Server application to the cloud without any changes. The answer is IaaS (Azure Virtual Machines).

2. 2

   Service classification

   You are given a list of Azure services and asked which model each one represents. Know that VMs are IaaS, App Service and Azure SQL are PaaS, and Microsoft 365 is SaaS. Azure Functions is PaaS even though it is often called serverless. Serverless is a delivery pattern within PaaS, not a separate model.

Frequently asked questions

IaaS, PaaS, and SaaS appear in the cloud concepts domain of AZ-900 but their implications run through the entire exam. Every time you see an Azure service, it is worth asking yourself which model it belongs to and what that means for shared responsibility. That habit alone will help you with a significant portion of the questions you face.

The best way to make this click is to practise with scenario questions. Reading about the difference is useful; recognising it quickly under exam conditions is what actually gets you through.