Cloud computing & service models (IaaS / PaaS / SaaS)
What it is
Cloud computing is renting computing capability—servers, storage, databases, networking, or complete software—when you need it instead of buying and running every physical machine yourself. You still make choices about data, identity, configuration, cost, and recovery.
The service model tells you how much of the technical stack Azure operates and how much your team operates.
| You manage | Provider manages | Example | |
|---|---|---|---|
| IaaS (infrastructure) | Guest OS, patches, app, data, much of the configuration | Physical datacenter and underlying host infrastructure | [[azure-vm |
| PaaS (platform) | App code, data, access, settings | The managed runtime and underlying infrastructure | [[app-service |
| SaaS (software) | Users, data, access, configuration choices | The application and its platform | Microsoft 365, Azure DevOps |
Why it exists
You can use on-demand capacity and managed services instead of operating all physical infrastructure yourself. Pricing depends on each service’s meter, tier, and any commitment; estimate and monitor cost before creating resources.
Key ideas
Choose IaaS when the application genuinely needs control of the operating system or a configuration the platform does not offer. Choose PaaS when the team wants to spend more time on its application and less on server maintenance. Choose SaaS when a ready-made application meets the business need. More managed does not mean “no work”; it moves operational work to Azure and leaves your organization responsible for safe use.
Northwind example
Northwind could run its ordering site on a VM (IaaS). Luis would choose and patch the guest operating system. If he instead uses App Service (PaaS), he deploys the application and configures its settings while Azure operates the underlying web platform. Priya uses a SaaS finance application: she manages who can use it and the business data, not its servers.
Shared-responsibility check
Before assuming Azure handles something, name the task: applying security updates to a VM guest OS is normally Northwind’s IaaS responsibility; controlling who can read order data remains Northwind’s responsibility in every model. The exact split varies by service, configuration, and agreement, so use the service documentation for a production design.
Common confusion
- “Cloud” does not mean a resource has no physical location. Regional services are still deployed in Azure regions.
- “Serverless” does not mean an application has no servers; it means the provider manages the server infrastructure exposed to you.
- IaaS, PaaS, and SaaS are responsibility models, not a security ranking. Any model can be unsafe when identities, data, or configuration are mishandled.
Related
azure-vm · app-service · azure-functions · azure-region · resource-group · arm · northwind-traders-case-study
📘 Source: Microsoft Learn — Shared responsibility in the cloud, checked 2026-09-16.