Cloud deployment models
What they are
Public, private, and hybrid describe where infrastructure runs and how environments relate. A public cloud uses a provider’s shared infrastructure with logical isolation. A private cloud dedicates cloud-style infrastructure to one organization. A hybrid cloud connects a private environment and a public cloud so users, applications, or data can cross the boundary.
Why the distinction matters
The deployment model answers “where is the environment and who owns the underlying infrastructure?” It is different from IaaS, PaaS, and SaaS, which answer “which layers does the provider operate?” A private cloud can still offer IaaS or PaaS; a public cloud can host IaaS, PaaS, or SaaS.
Choice and mechanics
Choose public cloud for on-demand capacity and managed services when provider-hosted infrastructure meets the requirements. Choose private cloud when dedicated control, isolation, or an existing investment requires it. Choose hybrid when a workload must retain an on-premises dependency while using Azure capacity or managed services. Hybrid adds an operating boundary: identity, routing, DNS, data synchronization, monitoring, and recovery must work across both sides.
Common confusion and failure
Hybrid does not mean that every component is automatically portable or redundant. A VPN or ExpressRoute connection can be unavailable, DNS can resolve to the wrong side, or identities can lack trust across the boundary. IaaS/PaaS/SaaS does not classify the deployment as public/private/hybrid.
Example and route
Northwind keeps a legacy warehouse database on-premises, connects it to an Azure App Service through private networking, and uses Azure Blob Storage for product images. That is a hybrid deployment with a PaaS application and managed storage. It still needs a tested network, name-resolution, identity, and failure plan; the word “hybrid” does not supply those automatically. Learn this in AZ-900 cloud foundations, then revisit the boundary in AZ-104 networking.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- Shared responsibility in the cloud.
Re-audit when Microsoft changes deployment-model or shared-responsibility guidance.
Related
cloud-computing · shared-responsibility · vnet · private-endpoint · azure-region