2.1 SaaS, PaaS, and IaaS
Key Takeaways
- Microsoft 365, Dynamics 365, and Microsoft 365 Copilot are software as a service (SaaS): Microsoft hosts the application, while customers still own data, identities, accounts, and device access.
- Azure Virtual Machines, Azure Disk Storage, and Azure Virtual Network are infrastructure as a service (IaaS): customers install, patch, and configure the guest operating system.
- Azure App Service, Azure Functions, and Azure SQL Database are platform as a service (PaaS): Microsoft patches the operating system and runtime; customers deploy code and manage data.
- In Microsoft's shared responsibility model, the customer always retains data, identities, accounts, and access management; Microsoft's share of the stack grows from IaaS to PaaS to SaaS.
- Typical MS-900 mapping: email and collaboration without servers → Microsoft 365 SaaS; a custom app without virtual machines → PaaS; full operating-system control without owning hardware → IaaS.
The first Microsoft 365 Fundamentals skill is not a trivia list of Azure product names. It is a decision skill: given a business need, pick the cloud service model that matches how much of the stack Microsoft should run for you. Exam MS-900 sits this skill under Describe cloud concepts because every later Microsoft 365 topic — Exchange Online, Teams, Intune, Copilot — is easier once you can say, without hesitation, Microsoft 365 is software as a service.
Why this matters in the real tenant, not just on the exam: the same company often uses all three models at once. Knowledge workers live in Microsoft 365 (SaaS). Developers publish a custom expense app on Azure App Service (PaaS). A line-of-business system that still needs a specific Windows Server role runs on Azure Virtual Machines (IaaS). If you treat “the cloud” as one blob, you will mis-assign who patches the operating system, who backs up the database, and who is still on the hook when a laptop is stolen.
The three models, defined with Microsoft products
Infrastructure as a service (IaaS) is the most flexible cloud model and the closest to “we still have servers, we just do not own the building.” Microsoft provides virtualized compute, storage, and networking. You rent capacity in a Microsoft datacenter; you decide what runs on it. Official Microsoft examples you should memorize for MS-900 are Azure Virtual Machines, Azure Disk Storage, and Azure Virtual Network. Microsoft is responsible for the physical hosts, physical network, physical datacenter, and the hypervisor. You are responsible for the guest operating system (OS) — installing it, patching it, hardening it — plus the runtime, applications, network configuration inside the virtual network, and the data.
Think of IaaS as moving the hardware off your balance sheet without giving up administrative control. Lift-and-shift migrations, labs you can turn off at night, and workloads that need custom kernel settings or third-party agents all land here. The exam phrase that points to IaaS is almost always full control of the operating system or we do not want to own physical servers, but we still need to install and patch Windows or Linux ourselves.
Platform as a service (PaaS) is the middle ground. Microsoft maintains the physical infrastructure and the operating system, middleware, runtime, and many platform services. You bring application code, configuration, and data. You do not remote-desktop into a server to install a cumulative update. Official Microsoft examples for this exam are Azure App Service (host a web app), Azure Functions (run event-driven code without managing servers), and Azure SQL Database (a managed relational database). Microsoft’s own cloud-service training also lists Azure Storage in the PaaS column when you consume it as a managed storage platform rather than as disks attached to a virtual machine.
PaaS is the right answer when the scenario says a development team wants to build and deploy a custom application without managing virtual machines or operating-system patches. The team still writes the app, still secures the code, still decides who can call the API, and still owns the data. They just stop being part-time sysadmins.
Software as a service (SaaS) is the most complete product from the user’s point of view. You rent a finished application. You sign in, configure the tenant, assign licenses, and work. Microsoft (or another SaaS vendor) patches the app, the runtime, the OS, and the hardware. Official Microsoft examples that MS-900 expects are Microsoft 365, Dynamics 365, and other ready-made cloud applications. Microsoft 365 Copilot sits in the same SaaS family: it is not an Azure virtual machine you patch, and it is not a platform where you deploy your own Copilot binary. You consume it as a licensed experience on top of Microsoft 365 data and apps.
SaaS is the least flexible model and the easiest to start. The exam phrase that points here is email and collaboration without deploying servers, use Word/Excel/Teams in the browser or as installed apps without hosting Exchange, or the provider manages the application.
Side-by-side comparison
| Model | What you rent | Microsoft examples | You still manage | Microsoft manages |
|---|---|---|---|---|
| IaaS | Virtual machines, disks, virtual networks | Azure Virtual Machines, Azure Disk Storage, Azure Virtual Network | Guest OS, patches, runtime, apps, data, identities | Physical hosts, physical network, datacenter, hypervisor |
| PaaS | A managed platform to build and run apps | Azure App Service, Azure Functions, Azure SQL Database | App code, app configuration, data, identities | Hardware, OS, runtime, middleware, much of the platform |
| SaaS | A finished application | Microsoft 365, Dynamics 365, Microsoft 365 Copilot | Data, identities, accounts, device access, tenant settings | Hardware, OS, runtime, and the application itself |
Two habits will save points. First, name the Microsoft product and the model in the same breath: “Microsoft 365 is SaaS,” not “Microsoft 365 is the cloud.” Second, do not let brand names fool you. Azure is not automatically IaaS. Azure contains IaaS and PaaS (and some SaaS-style services). Microsoft 365 is not IaaS just because users install desktop apps; those desktop apps still connect to a Microsoft-hosted SaaS tenant.
Shared responsibility, the way fundamentals exams test it
Microsoft’s published shared responsibility model is the scoring key behind almost every “who patches what?” item. On-premises, you own the entire stack. As you move into the cloud, responsibilities transfer to Microsoft — more of them as you go from IaaS to PaaS to SaaS. The official matrix is worth committing to memory at the category level, not as a 40-cell spreadsheet you try to recite.
| Responsibility area | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Customer data | Customer | Customer | Customer | Customer |
| Configurations and settings | Customer | Customer | Customer | Customer |
| Identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts | Customer | Microsoft | Microsoft | Microsoft |
| Physical network | Customer | Microsoft | Microsoft | Microsoft |
| Physical datacenter | Customer | Microsoft | Microsoft | Microsoft |
The rows that never flip to Microsoft are the ones MS-900 loves. Regardless of IaaS, PaaS, or SaaS, you always retain:
- Data — classification, protection, encryption decisions you control, and whether a file should have been shared.
- Endpoints — the laptops, phones, and kiosks that sign in to the cloud service.
- Accounts — creating, managing, and removing user access.
- Access management — role-based access control, multifactor authentication, and Conditional Access.
That is why “Microsoft 365 is SaaS, so Microsoft is responsible for our data” is a trap. Microsoft is responsible for the security of the service — datacenters, the Exchange Online platform, the Teams service. You are still responsible for your mailbox contents, your sharing links, your guest accounts, and your unmanaged personal PC that syncs OneDrive.
Read the shared cells carefully. In PaaS, applications and network controls are shared: Microsoft hardens the platform; you still write secure code and configure the firewall rules the platform exposes. In SaaS, client devices and applications are shared: Microsoft can provide device-management capabilities (you will meet Microsoft Intune later), but you still enroll devices, set compliance policy, and decide who is allowed to sign in from a jailbroken phone.
Microsoft-specific scenarios the exam will paraphrase
Translate business language into a model before you look at the answer choices.
- “We want company email, calendars, file sharing, and meetings. We do not want to run Exchange or SharePoint servers.” → SaaS → Microsoft 365. Dynamics 365 is also SaaS, but it is a business-application suite (customer engagement, finance and operations), not the default answer for email and collaboration.
- “Developers need to publish a custom web app. They should not patch Windows or manage IIS on a virtual machine.” → PaaS → Azure App Service (or Azure Functions if the story is event-driven, serverless code).
- “The finance system needs a specific Windows Server feature and a vendor agent that must be installed on the OS. We will not buy more rack space.” → IaaS → Azure Virtual Machines.
- “We need a relational database but do not want to patch SQL Server on a VM.” → PaaS → Azure SQL Database, not a SQL Server installer on an Azure VM (that second option is IaaS again).
- “Users should draft documents with Copilot inside Word and Teams.” → SaaS → Microsoft 365 Copilot on a Microsoft 365 tenant. Copilot is not IaaS just because a GPU exists somewhere in Azure.
Organizations mix models. A retailer might run Microsoft 365 for every employee (SaaS), host the public site on Azure App Service (PaaS), and keep a specialized inventory appliance as an Azure VM (IaaS). That mix is normal. The exam is testing whether you can pick the right model for the stated requirement, not whether a company is “100 percent SaaS.”
Exam traps
- SaaS does not mean Microsoft owns your data. Customer data, identities, and accounts stay with the customer in every model.
- IaaS is not “Microsoft patches Windows for you.” On Azure Virtual Machines, you patch the guest OS. Microsoft patches the physical host and hypervisor.
- Azure SQL Database is PaaS; SQL Server on an Azure VM is IaaS. Same database engine family, different responsibility line.
- Installing Microsoft 365 Apps on a laptop does not turn Microsoft 365 into IaaS. The apps run locally, but the service you subscribe to — mail, OneDrive, Teams, license activation — is still SaaS.
- PaaS is not “no security work.” You still secure application code, secrets, identities, and data. You just stop owning OS patch Tuesday for that workload.
- Do not pick IaaS for “we do not want to manage servers” and do not pick SaaS for “we need to install a custom OS role.” Match the verb in the scenario: use an app (SaaS), deploy code (PaaS), control the OS (IaaS).
A company wants corporate email, calendaring, and document collaboration without deploying or patching any mail or file servers. Which Microsoft cloud service model should it choose?
A development team wants to host a custom line-of-business web app and does not want to manage virtual machines or operating-system patches. Which Microsoft service best matches that requirement?
In Microsoft's shared responsibility model, which responsibility does the customer always retain across IaaS, PaaS, and SaaS?
An organization needs full control of the guest operating system, including custom kernel settings and a vendor agent, but it does not want to own physical servers. Which option fits?