IaaS vs PaaS vs SaaS: Cloud Service Models Explained

IaaS, PaaS and SaaS are the three main ways cloud services are offered, and the acronyms turn up everywhere from IT proposals to software sign-up pages. They sound alike, but they hand you very different amounts of control and responsibility. Getting them straight helps you ask better questions before you choose a service or sign off a project.

I've worked from the official definitions here: the US National Institute of Standards and Technology (NIST) publication that most of the industry still points to, plus the explanations from AWS and Microsoft Azure. Here's what each one means in practice.

Where the IaaS, PaaS and SaaS definitions come from

NIST published The NIST Definition of Cloud Computing, Special Publication 800-145, in 2011. It says the cloud model is made up of five essential characteristics, three service models and four deployment models. The three service models are the ones this page covers. The five characteristics are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service, and the four deployment models are private, community, public and hybrid cloud.

IaaS: infrastructure as a service

NIST describes IaaS as the ability to provision processing, storage, networks and other fundamental computing resources, on which you can deploy and run any software, including operating systems and applications. You don't manage the physical data centre, but you do control the operating systems, storage and applications you put there.

AWS calls IaaS the basic building blocks for cloud IT and says it gives you the most control, closest to running your own servers. Microsoft's examples include Azure Virtual Machines, Azure Disk Storage and virtual networks. Choose IaaS when you need full control over the setup, for example to move existing systems to the cloud largely as they are.

PaaS: platform as a service

With PaaS, NIST says you deploy applications you've created or acquired onto the provider's platform, using the languages, libraries, services and tools the provider supports. You don't manage the network, servers, operating systems or storage, but you control your applications and possibly some settings for the environment they run in.

AWS says PaaS removes the need to manage the underlying infrastructure, so you can focus on deploying and managing your applications. Microsoft's examples include Azure App Service, Azure Functions, Azure SQL Database and Azure Storage. PaaS suits developers who want to ship code without looking after servers, and it pairs naturally with an automated release pipeline, which I've explained in what CI/CD is.

SaaS: software as a service

SaaS is the one most of us use daily. NIST describes it as using the provider's applications running on cloud infrastructure, reached through a web browser or a program interface. You don't manage the infrastructure or even most of the application, apart from some user settings.

AWS gives web-based email as its example: you send and receive messages without managing servers, operating systems or feature updates. Microsoft names Microsoft 365 and Dynamics 365 as SaaS examples. Most of the online tools a small business signs up for, from accounting apps to email marketing platforms, are SaaS.

IaaS vs PaaS vs SaaS at a glance

	IaaS	PaaS	SaaS
You get	Computing, storage and networking	A platform to deploy your own apps	A ready-to-use application
You manage	Operating systems, storage, apps and data	Your apps, data and some settings	Your data, users and settings
Provider manages	Physical hosts, network and data centre	Also operating systems and runtimes	Almost everything else
Control	Most	Middle	Least
Examples (Azure)	Azure Virtual Machines	Azure App Service	Microsoft 365
Typical user	IT and infrastructure teams	Developers	Everyone

The pizza analogy for cloud service models

A common way to picture the three is pizza night. It's an illustration, not an official definition, but it helps:

• On-premises is making pizza at home from scratch: your kitchen, your oven, your ingredients, your washing-up.
• IaaS is hiring a kitchen with an oven. You still bring the ingredients and do the cooking.
• PaaS is a take-and-bake pizza. The base and toppings are ready; you just bake and serve it.
• SaaS is going out to a restaurant. You choose from the menu and eat; someone else handles everything else.

Shared responsibility across IaaS, PaaS and SaaS

Moving to the cloud doesn't mean handing over all responsibility. Microsoft's shared responsibility guidance says that for every type of cloud deployment, you own your data and identities. Whatever model you choose, you're always responsible for:

• Data: classifying it, protecting it and meeting data governance requirements.
• Endpoints: the laptops, phones and desktops that access your cloud services.
• Accounts: creating, managing and removing user access.
• Access management: controls such as multifactor authentication and role-based access.

Microsoft takes care of physical security, the physical network, the physical hosts and the virtualisation layer. In PaaS and SaaS, it also manages operating systems, runtime environments and middleware. Applications and network controls are shared in between, and the split shifts depending on the model. In plain terms: the further you move towards SaaS, the less you look after, but your data and logins are always your job.

Choosing between IaaS, PaaS and SaaS

• Pick SaaS when a ready-made tool already does what you need, such as email, accounting or a CRM.
• Pick PaaS when you're building your own app and want to focus on the code rather than servers.
• Pick IaaS when you need full control, have specialist software or are moving existing systems across.
• Mix them when it makes sense. Microsoft notes many solutions combine service models.

Whichever you choose, switch on multifactor authentication, review who has access regularly and know where your data is backed up.

Learning more about cloud service models

NIST SP 800-145 is short and readable, and both AWS and Microsoft Learn publish free introductions to their services. If you advise clients on cloud choices, writing up real decisions and their trade-offs is one of the most useful things you can share.

Cloud architects and consultants can reach readers via cloud computing blogs that publish expert articles.

Frequently asked questions

Is web-based email an example of SaaS?

Yes. Web-based email is the classic SaaS example. AWS and NIST both use it to illustrate software you use without managing servers or operating systems.

What's the main difference between IaaS and PaaS?

With IaaS you manage the operating systems and everything above them. With PaaS the provider manages the operating systems and runtimes, and you just deploy your application.

Who's responsible for security in SaaS?

It's shared. Microsoft's guidance says the provider handles most of the stack, but you're always responsible for your data, user accounts, access controls and the devices people use.

Which cloud model gives the most control?

IaaS gives the most control, because you manage the operating systems, storage and applications. SaaS gives the least, because the provider runs almost everything.

Can a business use IaaS, PaaS and SaaS together?

Yes, and many do. A company might run some systems on IaaS, build a customer app on PaaS and use SaaS tools for email and accounts.