4.1 · Understanding the cloud (SaaS, PaaS, IaaS)

Level 4 · Expert: cloud & Microsoft 365 administration

4.1Understanding the cloud (SaaS, PaaS, IaaS)

Objective: understand the cloud as consuming computing as a service, and tell apart the three service models by how much you manage.
Estimated time: 12 min

The cloud is, at its core, consuming computing as a service: instead of buying and running your own servers, you rent capability from a provider over the internet and pay for what you use. The key distinction is how much you manage, captured by three models. IaaS (Infrastructure as a Service) rents raw infrastructure — virtual servers, storage, networking — and you manage the operating system and everything above it. PaaS (Platform as a Service) rents a ready platform to run your applications, so you manage the app but not the servers under it. SaaS (Software as a Service) is finished software you just use — email, a CRM, a document suite — and you manage almost nothing technical.

The trade-off is simple: the higher you climb toward SaaS, the less you manage but also the less you control. SaaS is fastest and easiest but you accept the provider's choices; IaaS gives the most control but hands you the most responsibility. Most small organizations lean heavily on SaaS (like Microsoft 365, the focus of this level) precisely because it removes the burden of running infrastructure. The cloud also changes the cost model — from big up-front purchases to ongoing subscriptions — and shifts, but does not remove, your responsibilities: security, data and access are still yours to manage. Understanding these models lets you choose the right level for each need and know exactly where your job begins.

Section vocabulary

Cloud
Consuming computing as a service over the internet, paying for what you use.
IaaS
Renting raw infrastructure (virtual servers, storage, network); you manage the OS and up.
PaaS
Renting a ready platform to run your applications; you manage the app, not the servers.
SaaS
Finished software you simply use (email, CRM, office suite); you manage almost nothing technical.
Shared responsibility
The split of duties between provider and customer; security and data stay partly yours.
Check your understanding

What distinguishes SaaS, PaaS and IaaS?

Tutorial 4.1
Tutorials: « 4.1 » cloud computing SaaS PaaS IaaS explained (search)
Click to see up-to-date results ↗

In practice — Classify by service model

  1. List a few services you use and label each SaaS, PaaS or IaaS.
  2. For one of them, state what the provider manages and what you still manage.
  3. Decide, for a small organization, which model fits email and documents best, and why.
  4. Note one responsibility (security, data, access) that stays yours even with SaaS.
You can place a service in the right cloud model and identify where the provider's responsibility ends and yours begins.

Key takeaways

  • The cloud is computing consumed as a service, paid by usage.
  • IaaS → PaaS → SaaS: the higher you go, the less you manage and the less you control.
  • Small organizations lean on SaaS to avoid running infrastructure.
  • Security, data and access stay partly your responsibility even in the cloud.

Frequently asked questions

Is the cloud just « someone else's computer »?

That quip contains a real truth — ultimately your data does run on a provider's servers — but it misses what makes the cloud valuable. You are not just renting a machine; you are renting scale, reliability, and the offloading of work: the provider handles the hardware, the data-center power and cooling, much of the maintenance, and often the software updates, with redundancy and availability far beyond what a small team could build. You trade some control for a great deal less burden and up-front cost. The distinction between IaaS, PaaS and SaaS is precisely about how much of that burden you hand over versus keep.

Does moving to the cloud mean I no longer have to worry about security or backups?

No — and assuming so is a classic, costly mistake. Cloud providers operate on a shared-responsibility model: they secure the underlying infrastructure, but you remain responsible for your accounts, your access controls, your configuration, and often your data. A provider will keep the service running, but it will not stop you from mis-sharing a file, using weak passwords, or skipping multi-factor authentication. Data protection and retention obligations also vary by country, so the rules that apply to you may differ from the provider's defaults. The cloud changes where the work happens; it does not remove your duty to manage access, protect data, and understand what is and is not backed up.

More resources