Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Gauge your current knowledge
Gauge your current knowledge
Infrastructure as a Service (IaaS) gives you virtualized compute, storage, and networking over the internet. You rent these resources on demand and pay only for what you use, which reduces upfront hardware costs and lets you scale quickly. This flexibility makes IaaS a strong fit for several common scenarios.
Many companies have older applications that cannot be easily rewritten for the cloud. IaaS allows a “lift-and-shift” migration: you move the existing virtual machines and storage into Azure without changing the code. This same approach works for extending an on-premises data center into the cloud, so you can handle traffic bursts or support global users without building more physical facilities.
IaaS helps protect against outages by replicating servers and data to a secondary Azure region. When the primary site fails, you can quickly spin up virtual machines in the backup region and restore operations. This method avoids the cost of maintaining a separate on-premises disaster recovery site and helps meet your recovery time objectives (RTOs).
Teams can provision isolated environments that mirror production in just minutes. They test new features on virtual machines, networks, and storage, then decommission everything when done. Because you only pay for the resources while they run, this practice lowers costs and supports continuous integration and continuous deployment (CI/CD) pipelines.
Workloads such as scientific simulations, financial risk analyses, or large-scale batch jobs need powerful CPUs and GPUs temporarily. IaaS lets you create virtual clusters with specialized hardware, run the job, and then release the resources. You pay for peak performance only when needed, avoiding a permanent investment in supercomputing hardware.
In Azure, IaaS provides virtualized computing resources that you provision and manage yourself. The three main component categories are virtual machines, storage, and networking – each with its own set of services and features.
Virtual machines are the core compute resource in IaaS. They run applications and services inside a virtualized environment that behaves like a physical computer. You create and manage VMs through the Azure portal, where you select the operating system, size, and region. Key capabilities include customizing the software stack, scaling the VM up or down as workload changes, and connecting remotely from anywhere.
Azure IaaS offers several storage options to match different needs. Azure Blob Storage holds unstructured data like images or logs. Azure File Storage provides shared file shares for multiple VMs. Disk storage attaches directly to a VM for its operating system and application data. Storage resources are durable because data is replicated across multiple locations, and you can choose tiers (hot, cool, archive) to balance performance and cost.
Azure Virtual Networks let you create isolated networks for your VMs. Azure DNS manages domain name resolution. To secure traffic, you use Network Security Groups (NSGs) and Azure Firewall to control inbound and outbound rules. For connectivity, you can link virtual networks to your on-premises network for a hybrid setup. Services like Azure Traffic Manager distribute incoming traffic across multiple regions to keep the application available even if one region goes down.
IaaS shifts the responsibility of physical hardware maintenance to the cloud provider, so your team can focus on applications and data. This model brings several clear advantages.
IaaS resources grow or shrink automatically with workload demand. For example, Virtual Machine Scale Sets (VMSS) add or remove VM instances based on CPU utilization or other signals. This ensures your application keeps performing during traffic spikes and does not waste money on idle resources during lulls.
You have full administrative access to the virtual machines, operating systems, network settings, and security configurations. You can choose from a wide range of VM sizes, hardware options, and OS images. This customization makes IaaS ideal for migrating on-premises applications without rewriting them and for running complex enterprise systems.
IaaS uses a pay-as-you-go pricing model. You pay only for the compute time, storage, and networking you actually consume. Additional savings come from Azure Reservations (discounted rates for one- or three-year commitments), Spot VMs (using unused Azure capacity at lower prices), and automatic scaling that reduces resource usage during off-peak periods.
Azure’s global regions and availability zones let you spread VMs across physically separate data centers. This setup protects against localized failures and supports disaster recovery. IaaS also handles high-performance computing and big data workloads by letting you provision large clusters of specialized VMs on demand.
IaaS is one of three main cloud service models. The key difference is who manages each layer of the technology stack.
In an IaaS environment, the cloud provider manages the physical hardware (servers, storage, networking). You are responsible for everything above that: installing and updating the operating system, configuring middleware and runtime environments, deploying applications, managing your data, and securing the environment. This gives you the most control and is best when you need to customize the software stack or move existing systems with minimal changes.
Platform as a Service (PaaS) abstracts the underlying infrastructure and operating system away from you. The provider handles the runtime, middleware, OS, and hardware. You only manage your applications and data. PaaS is great for developers who want to build and deploy code quickly without worrying about server maintenance.
Software as a Service (SaaS) delivers a fully managed application over the internet. The provider takes care of infrastructure, platform, application updates, security, and maintenance. You simply use the software. Common examples include email, customer relationship management (CRM), and office productivity tools. SaaS is ideal when you need a ready-to-use solution with no management overhead.
| Model | What you manage | What the provider manages |
|---|---|---|
| IaaS | OS, middleware, apps, data, security configurations | Physical hardware, networking, storage |
| PaaS | Apps and data | Runtime, middleware, OS, hardware |
| SaaS | Nothing – just use the app | Infrastructure, platform, app updates, security |
When using IaaS in Azure, security and compliance are shared responsibilities. Azure provides the underlying protections, but you must configure your own resources appropriately.
Data protection includes encryption for data at rest (stored on disks) and data in transit (moving across networks). Azure Active Directory (Azure AD) manages user identities and controls who can access your virtual machines and storage. For network security, you use Network Security Groups (NSGs) to filter traffic between VMs and subnets, and Azure Firewall to block threats from the internet. You also have full control to apply patches, configure firewalls, and set up backups.
Azure meets a broad set of regulatory standards, including GDPR, HIPAA, and ISO 27001. This means the platform itself is certified to handle sensitive data. You still need to configure your IaaS resources to follow the rules – for example, ensuring that patient health data is encrypted and access logs are enabled. Azure provides audit and monitoring tools (like Azure Policy and Azure Monitor) that help you track compliance and generate reports for regulators.
Because you manage the operating system and applications in IaaS, you are responsible for security configurations that PaaS and SaaS users never see. For instance, you must install OS updates, restrict administrative access, and set up backup policies. The provider handles physical security of data centers and the hypervisor. Understanding this split helps you choose the right service model based on how much security control you need versus how much management you want to delegate.