IaaS vs PaaS vs SaaS: the Azure service models, sorted

The service model a question describes decides who manages what. Eight AZ-900 questions that tie IaaS, PaaS, and SaaS to concrete Azure services and the responsibility line between you and Microsoft, 2026 edition.

Try 8 free IaaS-versus-PaaS-versus-SaaS questions in the exam's own style — every answer explained, no sign-up — part of our 300-question bank.

Straight to the 8 free questions ↓

The one-line verdict: the service model tells you who manages what — IaaS you manage the most, SaaS you manage the least, and PaaS sits in between. Nail that sliding responsibility line and every AZ-900 service-model question falls into place.

The spectrum, not three boxes

Beginners picture IaaS, PaaS, and SaaS as three unrelated products. The exam wants you to see a spectrum of responsibility. Start with everything on-premises — you own the building, the servers, the OS, the app. Now hand layers to Microsoft, one group at a time, and you slide across the diagram above: from IaaS (most control, most work for you) through PaaS to SaaS (least work, least control). The layers never change; only the line dividing “yours” from “Microsoft’s” moves.

IaaS: you rent the machine

With Infrastructure as a Service, Microsoft gives you the raw building blocks — virtual machines, storage, networking — and you manage everything above the hypervisor. The flagship Azure service is Azure Virtual Machines. Install whatever OS you like, patch it yourself, run any software on it. That freedom is the selling point and the burden: a VM is the answer whenever a scenario stresses full control, a specific operating system, or a lift-and-shift migration that keeps an app as-is.

PaaS: you rent the platform

Platform as a Service hands the operating system and runtime to Microsoft too, leaving you responsible only for your application and data. Azure App Service hosts your web apps and APIs without a server to patch. Azure SQL Database is the one to know cold: it is a managed database — Microsoft runs the OS and the SQL engine — which makes it PaaS, not IaaS. Contrast it with SQL Server that you install on an Azure VM yourself: same database, but now you own the OS and patching, so that version is IaaS. This managed-versus-installed edge case is a favourite exam trap.

SaaS: you rent the software

Software as a Service is finished software you sign in and use — Microsoft runs the entire stack. Microsoft 365 (email, documents, collaboration) and Dynamics 365 (business applications) are the AZ-900 examples. You write no code and host nothing; you manage only your users, data, and settings. Whenever a scenario is “the team just uses the product,” it is SaaS.

Reading a question fast

Look for who owns the operating system, because that single layer usually decides the model:

You patch the OS → IaaS (Azure Virtual Machines).
The platform manages the OS, you deploy your own code → PaaS (Azure App Service, Azure SQL Database).
You write no code, just use the app → SaaS (Microsoft 365, Dynamics 365).

Answer each sample question above before you open the explanation, and when you miss, read why the distractors are wrong — the traps here are usually the right service pinned to the wrong model. For the bigger picture, see the cloud concepts domain, the Azure compute summary, and how the models tie to spending in CapEx vs OpEx.

A horizontal responsibility spectrum across three cloud service models. On the left, IaaS gives you the most control: you manage the operating system, runtime, and application while Microsoft manages the physical hardware, network, and virtualization; the concrete Azure example is Azure Virtual Machines. In the middle, PaaS: Microsoft additionally manages the operating system and runtime, leaving you responsible only for your application and data; the examples are Azure App Service and Azure SQL Database. On the right, SaaS gives you the least to manage: Microsoft runs the entire stack and you only configure and use the software; the examples are Microsoft 365 and Dynamics 365. An arrow beneath reads 'more control' pointing left and 'less management' pointing right.

8 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 8

Your team wants to deploy a website without patching operating systems, installing runtimes, or sizing servers by hand — they will upload code and let the platform run it. Which cloud service model is this?

Answer: A — Platform as a Service (PaaS)

When you bring only your application and data and the platform handles the OS, runtime, and patching, that is PaaS — Azure App Service is the classic example. Why not the others: IaaS would still leave your team owning the operating system and its patches; SaaS is finished software you use, not a place to deploy your own code; on-premises means you own everything down to the hardware. Pro tip: if the scenario says 'deploy my own app but don't manage servers,' think PaaS.

AZ-900 Question 2 of 8

A company subscribes to Microsoft 365 for email, documents, and collaboration. Users just sign in and work. Which service model does Microsoft 365 represent?

Answer: A — Software as a Service (SaaS)

Microsoft 365 is finished software you consume over the internet with nothing to build or host — that is the definition of SaaS. Why not the others: PaaS is for deploying your own applications, not using someone else's; IaaS gives you raw virtual machines and networking to build on; hybrid cloud is a deployment model (mixing on-premises and cloud), not a service model. Pro tip: SaaS = 'just sign in and use it' — Microsoft 365 and Dynamics 365 are the AZ-900 poster children.

AZ-900 Question 3 of 8

You provision an Azure Virtual Machine, install SQL Server on it yourself, and are responsible for OS updates and database patching. Which service model are you using?

Answer: A — Infrastructure as a Service (IaaS)

Renting a virtual machine and being responsible for everything above the hypervisor — OS, patching, the database engine you installed — is IaaS. Azure Virtual Machines is the canonical IaaS service. Why not the others: PaaS would mean the platform manages the OS and database engine for you; SaaS is ready-to-use software with no VM to manage; 'serverless' describes an execution style, not this VM-based ownership. Pro tip: the moment you are responsible for patching the guest OS, you are in IaaS.

AZ-900 Question 4 of 8

You need a relational database in Azure but do not want to manage the operating system, install the database engine, or apply engine patches. Which option fits, and which model is it?

Answer: A — Azure SQL Database — a PaaS managed database service

Azure SQL Database is a fully managed PaaS database: Microsoft runs the OS and the SQL engine and applies patches, so you manage only your data and database design. Why not the others: SQL Server on a VM is IaaS, not PaaS, because you own the OS and engine patching; calling Azure SQL Database 'IaaS' misplaces it — a managed database is PaaS; Microsoft 365 is office productivity software, not a relational database you build against. Pro tip: managed database = PaaS, database you install on a VM = IaaS. The AZ-900 exam loves this exact trap.

AZ-900 Question 5 of 8

Across the three service models, in which one do YOU manage the most layers of the stack?

Answer: A — IaaS

IaaS leaves you responsible for the most — the operating system, runtime, applications, and data — while Microsoft handles only the physical infrastructure and virtualization. Why not the others: PaaS hands the OS and runtime to Microsoft, so you manage fewer layers; SaaS leaves you managing almost nothing but your configuration and data; and the models are deliberately not equal — that sliding responsibility line is the whole point. Pro tip: picture the spectrum in the diagram — control is highest on the IaaS end, management burden is lowest on the SaaS end.

AZ-900 Question 6 of 8

In which cloud service model does Microsoft take responsibility for the largest share of the stack, leaving the customer to manage the least?

Answer: A — SaaS

In SaaS, Microsoft runs the entire stack — hardware, OS, runtime, and the application itself — so the customer manages only their own data, users, and settings. Why not the others: IaaS is the opposite extreme, where you manage the most; PaaS sits in the middle; private cloud is a deployment model describing where infrastructure lives, not how much of the stack a provider manages. Pro tip: least effort for the customer always points to SaaS.

AZ-900 Question 7 of 8

A migration team wants to 'lift and shift' an existing on-premises server into Azure with as few application changes as possible, keeping the same operating system they run today. Which service model best supports this?

Answer: A — IaaS — recreate the server as an Azure Virtual Machine

Lift and shift means moving a workload as-is, and IaaS virtual machines let you keep the same OS and app with minimal rework — the fastest migration path. Why not the others: PaaS often requires re-architecting the application to fit the platform; SaaS means abandoning your app for a ready-made product entirely; and lift and shift is very much possible — it is a common first cloud step. Pro tip: 'lift and shift with minimal changes' is an exam signal for IaaS.

AZ-900 Question 8 of 8

You are told: 'the provider manages the operating system and runtime, but the customer still writes and deploys their own application code.' Which service model is being described?

Answer: A — PaaS

A provider-managed OS and runtime combined with customer-written, customer-deployed code is exactly the PaaS split — think Azure App Service hosting your own web app. Why not the others: in IaaS the customer, not the provider, manages the OS; in SaaS the customer writes no application code at all; public cloud is a deployment model about ownership of the datacentre, not the responsibility split you are describing. Pro tip: 'they manage the platform, I bring the code' is the one-line test for PaaS.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 8 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is Azure SQL Database IaaS or PaaS?

Azure SQL Database is PaaS — a fully managed database service. Microsoft runs the operating system and the SQL engine and applies patches, so you manage only your data and schema. The contrast the exam tests is SQL Server installed on an Azure Virtual Machine, which is IaaS because you own the OS and engine patching yourself. Managed database = PaaS; database you install on a VM = IaaS.

Which service model gives the most control, and which needs the least management?

IaaS gives the most control: you manage the operating system, runtime, apps, and data, while Microsoft handles only the physical infrastructure. SaaS needs the least management: Microsoft runs the whole stack and you just configure and use the software. PaaS sits between them — you keep your app and data, the platform takes the OS and runtime. The diagram above shows this as a spectrum from most control on the left to least management on the right.

Are these real AZ-900 exam questions?

No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items violates the Microsoft certification agreement and can cost you your certification, and a copied item teaches you nothing about the next one. Our full bank holds 300 questions across 6 practice tests, so you learn the reasoning rather than one answer key.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.