IaaS vs PaaS vs SaaS: what's the difference?

IaaS vs PaaS vs SaaS is a question of how much of the technology the cloud provider runs for you. With IaaS you rent servers, storage and networking and manage what runs on them. With PaaS you bring only your app, and with SaaS you use a finished app, such as web-based email.

Last updated November 12, 2026

Dark title card reading "IaaS vs PaaS vs SaaS" under the label Cloud Guide

The short version

IaaS (infrastructure as a service) gives you virtual servers, storage and networks. You manage the operating system, apps and data.
PaaS (platform as a service) gives developers a ready environment to deploy their own code. The provider manages the servers and operating systems.
SaaS (software as a service) is a complete app you use over the internet, usually in a browser and on a subscription.
In every model you stay responsible for your own data, user accounts and access settings.
Examples: Azure Virtual Machines and Amazon EC2 (IaaS), Azure App Service and Google App Engine (PaaS), Microsoft 365 and Google Workspace (SaaS).

What are IaaS, PaaS and SaaS?

IaaS, PaaS and SaaS are the 3 service models in the US National Institute of Standards and Technology's definition of cloud computing, published in September 2011. AWS and Google also call them the 3 main models, though AWS notes that definitions vary from company to company. Each model answers the same question differently: which parts of the system do you run, and which parts does the provider run?

If you're new to the cloud itself, our guide to what cloud computing is covers the basics first.

Infrastructure as a service (IaaS)

IaaS is the most basic layer. NIST describes it as the ability to provision basic computing resources, such as processing power, storage and networks, and run any software you like on them, including your own operating system. You don't manage the physical hardware, but you do control the operating system, storage and the apps you deploy.

In practice, IaaS usually means virtual machines. The physical machines stay in the provider's data centers, and Microsoft says you control your share of them online, through a web portal or programmatically through an API. AWS says IaaS offers the most flexibility and control of the 3 models and is the type most like the IT resources many IT teams already use.

Platform as a service (PaaS)

PaaS sits a level higher. You deploy an app you wrote or acquired, and the provider runs everything underneath it. According to NIST, you don't manage the network, servers, operating systems or storage, only your app and possibly some settings for the environment that hosts it.

Microsoft describes PaaS as a platform for developers to build, deploy and manage apps, with the provider managing the operating system, runtime and middleware. Microsoft says the provider also applies security patches. AWS frames the benefit as skipping the "undifferentiated heavy lifting," such as capacity planning and software patching, so you can focus on the app.

Software as a service (SaaS)

SaaS is a finished app. NIST says you use the provider's applications through a web browser or a program interface, and you don't control the underlying infrastructure or even the app's features, apart from some settings for your own account. NIST's own example is web-based email.

Microsoft adds that SaaS is usually sold as a subscription and that the provider takes care of updates, security and maintenance. Microsoft also says most SaaS companies are multitenant. In plain terms, one copy of the software serves every customer, and each customer's data is kept apart from the others.

IaaS vs PaaS vs SaaS: who manages what

The clearest way to compare the 3 models is a shared responsibility model, which lists who looks after each layer of the system. Microsoft and AWS both publish one. Here is Microsoft's version for Azure:

Area	On-premises	IaaS	PaaS	SaaS
Customer data	You	You	You	You
Configurations and settings	You	You	You	You
Identities and users	You	You	You	You
Client devices	You	You	You	Shared
Applications	You	You	Shared	Shared
Network controls	You	You	Shared	Microsoft
Operating system	You	You	Microsoft	Microsoft
Physical hosts, network and data center	You	Microsoft	Microsoft	Microsoft

The table shows 2 things. First, the line moves up the stack as you go from IaaS to SaaS: with IaaS you still look after the operating system, while with PaaS and SaaS the provider does. Second, some jobs never move. Microsoft says that in every model you keep responsibility for your data, user accounts and access controls such as multifactor authentication. Our guide to two-factor authentication explains that last part.

Devices look like an exception in the table, but they aren't. Microsoft marks client devices as shared for SaaS because it can provide some device management tools, yet it lists protecting the devices that connect to its services as always your job.

AWS describes the same split with 2 labels: "Security of the Cloud" is its responsibility, and "Security in the Cloud" is the customer's. AWS classes Amazon EC2 as IaaS, so EC2 customers maintain the guest operating system themselves, patches included, along with the software they install and the firewall settings AWS calls security groups.

IaaS vs PaaS vs SaaS examples

Here's how Microsoft and Google label some of their own services. Microsoft notes that many Azure solutions combine several service models.

Model	Microsoft	Google
IaaS	Azure Virtual Machines, Azure Disk Storage, virtual networks	Compute Engine
PaaS	Azure App Service, Azure Functions, Azure SQL Database	App Engine, Cloud Run
SaaS	Microsoft 365, Dynamics 365	Google Workspace

Microsoft's typical SaaS examples are everyday business software: email, CRM apps for tracking customers and office suites.

Is AWS IaaS, PaaS or SaaS?

AWS doesn't put itself in one box. It says it uses the traditional IaaS, PaaS and SaaS grouping on its overview page to help customers decide, while its own focus is on solutions that can span many service types. It does call Amazon EC2 IaaS.

Amazon S3 and Amazon DynamoDB work differently. AWS calls them "abstracted services," and for these it operates "the infrastructure layer, the operating system, and platforms." Your side of the deal is the data you put in, its encryption settings and who has permission to reach it.

Microsoft gives a similar answer for its own cloud: it says Azure isn't just a PaaS but offers IaaS, PaaS and SaaS.

What about CaaS, FaaS and other "as a service" terms?

Google lists containers as a service (CaaS) alongside the other 3 as a core model and says it is sometimes seen as an extension of IaaS that uses containers instead of virtual machines. The provider runs the environment that hosts your containers, and you bring the containerized app. Google's example is Google Kubernetes Engine, and our guide to what Kubernetes is explains the technology underneath.

Google also describes function as a service (FaaS), where you deploy a small function that does a single job. Google says the provider adds capacity when the function runs, if it's needed. Its example is Cloud Functions. For the wider idea of code that runs only when triggered, see our guide to serverless computing.

Microsoft's pages also mention model as a service (MaaS), a cloud model built around machine learning models so businesses can add AI features without building models from scratch.

Pros and cons of each model

Google's comparison shows the trade-off: the more the provider manages, the less control you have.

IaaS. Among the advantages, Google lists the "highest level of control over infrastructure" and scaling on demand. Among the drawbacks, it says you're responsible for securing and recovering your own data, and you have to configure and maintain the systems yourself.
PaaS. You get a complete development platform, and the provider maintains and secures the infrastructure. Among the drawbacks, Google lists less control over operations, fewer customization options and possible vendor lock-in.
SaaS. Google counts easy setup among its advantages and says the provider looks after the whole stack, hardware and software alike. The cost is control: Google says you get "little to no customization" and no control over the infrastructure or its security controls. Google also lists problems connecting SaaS apps to your existing tools.

How to choose between IaaS, PaaS and SaaS

Start with what you're trying to do, not with the acronym.

You need an app that already exists, such as email, documents or a CRM. Choose SaaS. You don't build or host anything, though your data and accounts are still yours to manage.
You're building your own web or mobile app and don't want to manage servers. PaaS fits. Microsoft says teams use PaaS as a development framework when they want to build an app quickly without running the infrastructure.
You need full control over the operating system and software, or you're moving existing servers to the cloud as they are. Choose IaaS. Microsoft calls this lift-and-shift migration and says it's the quickest and cheapest way to move a workload to the cloud.

You don't have to pick just one. Google says the models aren't mutually exclusive, and you can mix all 3 with your own on-premises systems.

Frequently asked questions

What is the difference between IaaS, PaaS and SaaS in simple terms?

It comes down to how much the provider runs for you. With IaaS you rent the hardware and run everything on top of it. With PaaS you provide only your app's code. With SaaS you use a finished app and manage only your data and settings.

Is Microsoft 365 SaaS or PaaS?

Microsoft says Microsoft 365 is SaaS, not PaaS. It's a fully managed set of productivity apps, including Word, Excel, Outlook and Teams, rather than a platform for building software.

Which is cheaper: IaaS, PaaS or SaaS?

There's no single answer, because prices depend on the provider and on how much you use. Google says all 3 let you pay a subscription or pay for what you use instead of buying hardware. Google also lists the work of configuring and maintaining the systems yourself as a drawback of IaaS, so the bill isn't the only cost to weigh.

Is serverless the same as PaaS?

Not quite. Google says that with PaaS, the resources you're given stay active even when no one is using them, and it's up to you to scale capacity or set your app up to scale. Serverless code gets resources only when an event triggers it. Microsoft expects the line between the 2 to blur as more platforms add event-driven features.

Which model is the most secure?

Each model divides the security work differently. Microsoft's table shows the provider taking on more layers as you move from IaaS to SaaS, but your data, accounts and access settings stay your job in all 3.