AZ-900
Deep Dive
Service models are the heart of the AZ-900. They're not just definitions — they're architecture decisions with real implications for cost, responsibilities, and development speed.
Contents
Interactive diagram — hover over each row
The question that defines the model
The IaaS, PaaS, and SaaS models aren't about capabilities — they're about who manages which layer of the stack and how much of your team's time you're going to invest in infrastructure instead of in your product.
IaaS
Land with basic services
You have the land (infrastructure). You build the house (OS, runtime, app) from scratch. Maximum control, maximum work.
PaaS
Empty house ready to move into
The house is already built (OS, runtime). You just bring the furniture (your code and data). Less control, much less work.
SaaS
Furnished apartment for rent
Everything included. You just live in it (use the app). You don't decide how it's built or what furniture it has. Minimum control, zero infrastructure work.
Exact definition (AZ-900)
IaaS provides IT infrastructure (virtual servers, storage, networking) on demand over the internet. The provider manages the physical hardware; the customer manages the operating system, middleware, runtime, and application.
When IaaS is the right answer
The hidden cost of IaaS
An IaaS server isn't "cheap". Calculate the TOTAL cost:
IaaS on Azure — main services
Azure Virtual Machines
Windows and Linux VMs. Dozens of sizes (general, compute, memory, storage, GPU)
Azure Virtual Machine Scale Sets
Groups of identical VMs with horizontal auto-scaling
Azure Managed Disks
SSD/HDD disks for VMs. Premium SSD, Ultra Disk, Standard SSD
Azure Virtual Network
Private network for VMs. Subnets, NSGs, Route Tables
Exact definition (AZ-900)
PaaS provides an environment for developing, testing, and deploying applications without managing the underlying infrastructure. The provider manages the hardware, OS, middleware, and runtime; the customer manages the code and the data.
What PaaS delivers (not marketing, reality)
The real limitations of PaaS
PaaS on Azure — main services
Azure App Service
Hosting for web apps, REST APIs, backends. .NET, Node, Python, Java, PHP, Ruby.
Azure SQL Database
Managed SQL Server. Automatic patching, automatic backups, scaling.
Azure Kubernetes Service (AKS)
Managed Kubernetes. Microsoft manages the control plane. You manage the nodes.
Azure Cosmos DB
Globally distributed multi-model database. 99.999% SLA.
Azure Service Bus
Enterprise message queue and pub/sub. For decoupling microservices.
Azure Event Hub
Ingestion of millions of events/second. For IoT and telemetry.
Exact definition (AZ-900)
SaaS lets users connect to and use cloud-based applications over the internet. The provider manages all the infrastructure, middleware, software, and application data. The user simply accesses the app.
What you gain with SaaS
What you lose with SaaS
Microsoft SaaS — exam examples
Microsoft 365 (Office 365)
Word, Excel, PowerPoint online + Exchange + SharePoint + Teams. Complete productivity suite.
Microsoft Teams
Communication and collaboration. Chat, video calls, shared docs.
Microsoft Intune
Mobile device management (MDM). SaaS for managing endpoints.
Microsoft Defender for Business
Endpoint security as a service. No antivirus infrastructure to manage.
Power BI (cloud service)
Business Intelligence as a service. Dashboards and reports without servers.
Dynamics 365
CRM and ERP as a service. Sales, finance, operations in SaaS.
Serverless is technically a subset of PaaS, but different enough in billing model and operation that it deserves its own section. The AZ-900 mentions it as part of PaaS.
What is serverless really?
"Serverless" doesn't mean there are no servers — the servers exist. It means you don't manage servers, not even conceptually. You don't define how many instances, you don't define the OS, you don't define the runtime (just the language). And you only pay for executions, not for servers on standby.
Billing unit
PaaS
Per hour of active server
Serverless
Per execution + GB-second
Idle server
PaaS
You pay even without requests
Serverless
$0 if there are no executions
Scaling
PaaS
Manual or auto-scale rules
Serverless
Automatic and instant
Management
PaaS
You configure app plan, instances
Serverless
You just write code
Cold start
PaaS
No cold start (server always active)
Serverless
100-500ms if it was idle
Ideal for
PaaS
Apps with constant traffic
Serverless
Sporadic APIs, events, automation
Serverless services in Azure
Azure Functions
Individual functions triggered by events (HTTP, queue, timer, blob). Pay per execution.
Azure Logic Apps
Serverless visual workflows. Connect services without code.
Azure Container Apps
Serverless containers — no Kubernetes to manage. Scales to zero.
Azure SQL Serverless
Database that pauses automatically when there's no activity. $0 when idle.
The exam may ask you which category a specific service falls into.
| Azure service | IaaS | PaaS | SaaS | Note |
|---|---|---|---|---|
| Azure Virtual Machines | ✓ | Pure IaaS. You manage the OS. | ||
| Azure Managed Disks | ✓ | Storage for VMs. | ||
| Azure Virtual Network | ✓ | Virtual network, IaaS. | ||
| Azure App Service | ✓ | PaaS. Microsoft manages OS/runtime. | ||
| Azure SQL Database | ✓ | PaaS. Microsoft manages SQL Server. | ||
| Azure Kubernetes Service | ✓ | PaaS (managed control plane). Nodes are IaaS. | ||
| Azure Functions | ✓ | Serverless, subset of PaaS. | ||
| Azure Cosmos DB | ✓ | PaaS. Fully managed DB. | ||
| Microsoft 365 | ✓ | SaaS. Everything managed by Microsoft. | ||
| Microsoft Teams | ✓ | SaaS (part of M365). | ||
| Dynamics 365 | ✓ | SaaS. Fully managed CRM/ERP. | ||
| Power BI (cloud) | ✓ | SaaS. Managed BI service. | ||
| Azure Blob Storage | ✓ | PaaS. Managed storage (not IaaS). |
Web app with 10k users/day, 500 GB data, 99.9% SLA. Team of 5 developers.
| Cost component | IaaS (VMs) | PaaS (App Service) |
|---|---|---|
| Cloud infrastructure | ~$15,000/year (5 B4ms VMs) | ~$8,000/year (P2v3 × 2) |
| OS patches and updates | ~$3,000/year (8h/month × SRE) | $0 (automatic) |
| Monitoring and observability | ~$1,200/year (Azure Monitor + agents) | ~$600/year (App Insights) |
| Backups and DR | ~$1,500/year (Azure Backup) | ~$500/year (built-in + retention) |
| Antivirus / Defender | ~$600/year (5 VMs) | $0 (no OS access) |
| Dedicated ops staff | 0.5 FTE SRE = ~$40,000/year | 0.1 FTE = ~$8,000/year |
| Annual total | ~$61,300/year | ~$17,100/year |
Conclusion: PaaS is 72% cheaper in this scenario
The difference isn't in the cloud price — it's in the ops staff cost. PaaS eliminates ~0.4 FTE of operations by eliminating OS management. At $100k/year for an SRE, that's $40k in savings. Plus the developers' time not spent on infrastructure.
The AZ-900 golden rule: always start from the least control necessary.
Decision process → from SaaS toward IaaS
Does a SaaS exist that solves exactly your need?
YES → Use SaaS. (e.g., you need corporate email → Microsoft 365)
Can you deploy your app without managing the OS?
YES → Use PaaS. (e.g., a Node.js web app → Azure App Service)
Do you have an event-driven workload with highly variable traffic?
YES → Consider Serverless before full PaaS. (e.g., image processing on upload → Azure Functions)
Do you need OS control, specific drivers, or special licensing?
YES → Use IaaS. (e.g., a legacy app that only runs on Windows Server 2016 with a specific config)
Golden rule for the exam: The AZ-900 always expects you to choose the model that requires the LEAST work on your part, unless there's an explicit reason to need more control. If the scenario doesn't mention a specific reason to need the OS → PaaS. If it doesn't mention a reason for PaaS → SaaS (if the SaaS option exists for that case).
Did you get this topic?
Test what you just learned
A development team wants to deploy its application without worrying about the operating system, patches, or servers. Which service model should they choose?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.