Delivery of computing services — servers, storage, databases, networking, software — over the internet on demand.
Cloud computing is the delivery of computing services — servers, storage, databases, networking, software, and analytics — over the internet through a provider’s globally distributed datacenters. Microsoft Azure is one such provider, offering over 200 products and services on demand without customers owning physical hardware. The AZ-900 exam contrasts cloud with traditional on-premises infrastructure, where a business owns, operates, and maintains its own servers; cloud shifts much of that responsibility to the provider. This underpins the shared-responsibility model and explains why capital expenditure (CapEx) becomes operational expenditure (OpEx) in the cloud.
Infrastructure as a Service — the cloud provider supplies virtualized compute, storage, and networking; you manage the OS and up.
Infrastructure as a Service (IaaS) is the model where the provider owns and manages the physical hardware, networking, and virtualization layer, while the customer controls the operating system, middleware, and applications. Azure Virtual Machines are the textbook IaaS example: Azure provisions the host, but you choose the OS, install updates, and configure security. The key exam distinction is the shared-responsibility boundary—in IaaS the customer handles OS patching, identity configuration, and application security, duties that shift to the provider in PaaS and SaaS. A common AZ-900 trap: Azure App Service is PaaS, because Azure manages the OS and runtime.
Platform as a Service, where Azure patches the OS, runtime and middleware (App Service, Azure SQL Database) so you manage only your code and data.
Platform as a Service sits between IaaS and SaaS: Microsoft manages the underlying infrastructure, operating system, and runtime, while the customer deploys and configures applications and data. Azure App Service, Azure SQL Database, and Azure Functions are canonical PaaS examples. The key exam distinction is the responsibility boundary. With IaaS, such as Azure Virtual Machines, the customer patches and maintains the OS; with PaaS that shifts entirely to Microsoft, cutting operational overhead but reducing control. If a question lists OS patching as a customer task, that is IaaS, not PaaS.
Software as a Service — fully managed applications you simply use, such as Microsoft 365.
Software as a Service delivers complete, ready-to-run applications over the internet, with the cloud provider owning every layer — physical infrastructure, operating systems, middleware, and the application itself. Customers simply authenticate and use the software; nothing is installed or patched locally. Microsoft 365 (Word, Excel, Teams, Exchange Online) is the canonical AZ-900 SaaS example. The exam distinction is the shared-responsibility boundary: in SaaS the customer is responsible only for their own data and user access. This contrasts with PaaS, where the customer still owns deployed application code, and IaaS, where the customer manages the OS and above.
Cloud services offered over the public internet and shared across many organizations (tenants).
A public cloud is a computing environment owned and operated by a third-party provider — Microsoft in Azure’s case — and delivered over the public internet to multiple organizations. Each customer’s workloads are logically isolated through virtualization and identity boundaries, even though the underlying physical hardware is shared. This multi-tenancy lets Microsoft spread costs across many customers, enabling pay-as-you-go pricing. The key exam distinction is between public, private, and hybrid cloud: public requires no capital expenditure on hardware and no data center to manage, but customers cannot exclusively own the servers, which drives some regulated industries toward private or hybrid deployments.
Cloud computing resources used exclusively by a single organization, on-premises or hosted.
A private cloud is a cloud environment dedicated entirely to one organization, where the underlying hardware is not shared with other tenants. It can be hosted on-premises in the organization’s own datacenter or in a colocation facility. The exam trade-off: private cloud gives greater control, customization, and the ability to meet strict regulatory or data-residency requirements, but the organization bears full responsibility for purchasing, provisioning, and maintaining all hardware. This contrasts with the public cloud, where Microsoft owns and operates the infrastructure. Azure Stack HCI and Azure Stack Hub bring Azure-consistent services on-premises.
A computing environment that combines public and private clouds so workloads can move between them.
A hybrid cloud combines an organization’s on-premises or private cloud infrastructure with a public cloud like Azure, letting workloads and data move between them. It suits organizations that must keep regulated data on-premises while still scaling non-sensitive workloads out to Azure on demand. For the AZ-900 exam, do not confuse hybrid with multi-cloud: multi-cloud means using several public providers, whereas hybrid mixes on-premises or private infrastructure with a public cloud. Azure Arc is Microsoft’s tool for extending Azure management, governance, and Azure Policy to servers and Kubernetes clusters running outside Azure, enabling a consistent hybrid strategy.
The split of security duties between the cloud provider and the customer, which shifts by service model.
The shared responsibility model defines which security tasks Microsoft handles and which fall to the customer, with the boundary shifting by service type. In IaaS, Microsoft secures the physical datacenter, network, and hypervisor while the customer manages the operating system, applications, and data. In PaaS, Microsoft also maintains the OS and runtime, leaving the customer apps and data. In SaaS, Microsoft manages nearly the whole stack. Regardless of model, the customer always owns its data and controls access through identity management — moving to SaaS reduces obligations but never eliminates data classification and identity governance.
Paying only for the resources you actually use, with no upfront cost.
The consumption-based model means you pay only for the cloud resources you actually use — compute seconds, storage gigabytes, network egress — rather than buying fixed capacity upfront. In Azure this is pay-as-you-go billing, where costs rise and fall with real demand and you stop paying once a resource is deleted, avoiding over-provisioned idle hardware. The key exam nuance is CapEx versus OpEx: on-premises infrastructure is a capital expense (large upfront investment, depreciated over time), while the consumption model shifts spend to an operational expense recorded in the period it occurs.