Lab: Exploring Cloud Service Types (IaaS vs. PaaS) on Azure

This hands-on lab introduces the practical differences between Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) within Microsoft Azure. By the end of this lab, you will understand how the Shared Responsibility Model shifts depending on the service type you choose.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges to your Azure account.

Prerequisites

An active Azure Subscription (Free or Paid).
Azure CLI installed locally OR access to the Azure Cloud Shell (https://shell.azure.com).
Basic familiarity with terminal commands.
Permissions to create Resource Groups, Virtual Machines, and App Services.

Learning Objectives

Provision an Azure Virtual Machine to represent an IaaS model.
Provision an Azure App Service to represent a PaaS model.
Identify the management differences (OS updates, runtime environment) between the two services.
Apply the Shared Responsibility Model to real-world cloud resources.

Architecture Overview

In this lab, we deploy two separate compute resources into a single Resource Group to compare their configurations.

Loading Diagram...

Step-by-Step Instructions

Step 1: Create a Resource Group

All Azure resources must reside in a Resource Group. We will create one in a region close to you.

bash

az group create --name brainybee-lab-rg --location eastus

▶Console alternative

Search for Resource Groups in the top search bar.
Click + Create.
Subscription: Select your subscription.
Resource Group: brainybee-lab-rg.
Region: (US) East US.
Click Review + Create, then Create.

Step 2: Deploy an IaaS Resource (Virtual Machine)

An Azure VM is the primary example of IaaS. You are responsible for the OS and the software stack.

bash

az vm create \
  --resource-group brainybee-lab-rg \
  --name lab-iaas-vm \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

[!TIP] Note how long this takes compared to the next step. IaaS requires provisioning virtual hardware and installing an operating system image.

▶Console alternative

Search for Virtual Machines.
Click Create > Azure virtual machine.
Name: lab-iaas-vm.
Image: Ubuntu Server 22.04 LTS.
Size: Standard_B1s (eligible for free tier).
Authentication: SSH Public Key.
Click Review + Create, then Create.

Step 3: Deploy a PaaS Resource (App Service)

Azure App Service is a PaaS offering. Azure manages the OS, web server, and runtime; you only provide the code.

First, create an App Service Plan (the underlying compute tier):

bash

az appservice plan create --name lab-paas-plan --resource-group brainybee-lab-rg --sku F1

Then, create the Web App:

bash

az webapp create --name brainybee-app-$RANDOM --resource-group brainybee-lab-rg --plan lab-paas-plan

▶Console alternative

Search for App Services.
Click + Create > Web App.
Name: brainybee-app-[unique-id].
Publish: Code.
Runtime stack: Node 18 LTS (or any other).
Pricing Plan: Free F1.
Click Review + Create, then Create.

Checkpoints

Checkpoint 1: Verify the IaaS VM

Run the following command to see the details of your VM. Look for the powerState.

bash

az vm get-instance-view --name lab-iaas-vm --resource-group brainybee-lab-rg --query "instanceView.statuses[1].displayStatus"

Expected Result: "VM running".

Checkpoint 2: Verify the PaaS Web App

Check the state of your web app:

bash

az webapp show --name <YOUR_APP_NAME> --resource-group brainybee-lab-rg --query "state"

Expected Result: "Running".

Concept Review

Feature	IaaS (Virtual Machine)	PaaS (App Service)
OS Management	You (Patching, Updates)	Azure (Automated)
Scalability	Manual / Scale Sets	Built-in / Autoscale
Control	Maximum (Root access)	Restricted (App level only)
Responsibility	OS, Middleware, Runtime, Data, App	Data and Application only

Troubleshooting

Error	Cause	Fix
`SubscriptionNotFound`	Logged into wrong account	Run `az login` and `az account set --subscription <id>`
`SkuNotAvailable`	Region is at capacity	Change the `--location` to `westus` or `centralus`
`Conflict` / `AlreadyExists`	Resource name must be unique	Web app names must be globally unique; add numbers to the end

Clean-Up / Teardown

To ensure you are not charged for these resources, delete the entire Resource Group. This will remove the VM, the App Service, and all associated networking components.

bash

az group delete --name brainybee-lab-rg --yes --no-wait

[!IMPORTANT] It may take 5–10 minutes for the deletion to complete in the background. You can verify it is gone by running az group list.

Stretch Challenge

The "SaaS" Experience: Azure doesn't "provision" SaaS in the same way, but Microsoft 365 or Azure DevOps are SaaS examples. To simulate a SaaS-like experience in Azure, try enabling Azure Advisor.

Notice that you don't manage the advisor software, you don't choose an OS for it, and you don't see any servers. You simply consume the service's output (recommendations).