A cloud model, sometimes called a deployment model, describes where cloud resources run and who uses them. The Microsoft Azure Fundamentals exam (AZ-900) expects you to recognize three main models, public, private and hybrid, and the related term multicloud. You also need to know where Azure Arc fits, because it is Microsoft's answer to managing resources that live outside Azure. These models are about location and ownership; they are separate from the service types IaaS, PaaS and SaaS, and any model can host any service type.
A public cloud is built, owned and run by a third-party provider such as Microsoft, and its services are offered to anyone over the internet. Many customers, called tenants, share the same physical infrastructure, although each tenant's resources are logically isolated. Public cloud has no upfront hardware cost, you can provision resources in minutes, you can scale quickly, and you pay for what you use. The trade-off is that you do not control the physical hardware or exactly where every component lives beyond choosing a region, and you work within the provider's security and compliance options.
A private cloud is used by a single organization. It can run in the organization's own datacenter or be hosted by a third party, but the resources are dedicated to that one organization. Private cloud gives the most control over hardware, security and configuration, which can help with strict compliance or legacy needs. However, the organization must buy, maintain and eventually replace the hardware, so it keeps the capital expenditure (CapEx) and loses much of the cost and speed advantage of public cloud. What makes it a cloud rather than just a datacenter is self-service provisioning and automation for internal users.
A hybrid cloud combines public and private clouds and lets data and applications work together between them. A common reason is regulation or latency: a hospital might keep patient records on hardware it owns while running its public website and analytics in Azure, connected by a secure link such as a site-to-site VPN or ExpressRoute. Hybrid also helps companies migrate gradually, or burst into the public cloud when on-premises capacity runs out. Hybrid gives the most flexibility, because the organization decides where each workload runs, but it also brings the most complexity to operate. Multicloud means using services from more than one public cloud provider, for example Azure together with another provider, perhaps because different teams chose different platforms, a company was acquired, or one provider offers a feature the others do not. Multicloud is about several providers; hybrid is about mixing private and public. An organization can be both at once, for example with its own datacenter, Azure and a second public cloud.
Managing resources spread across on-premises and several clouds is hard, because each place has its own tools. Azure Arc addresses this. It projects servers, Kubernetes clusters, SQL Server instances and some data services that run outside Azure into Azure Resource Manager, so they appear in the Azure portal as resources and can be governed with the same tools you use for Azure: Azure Policy, role-based access control (RBAC), tags and monitoring. Arc does not move the workload; it stays where it is. For a server, you install the Connected Machine agent, and the machine then shows up in a resource group like any VM.
Consider a worked example. A manufacturer keeps its factory control systems in its own datacenter because they need very low latency to the machines, runs its customer portal in Azure, and inherited a set of Linux servers in another public cloud after buying a smaller company. That is hybrid and multicloud at the same time. The security team wants every server, wherever it runs, to meet one baseline and report compliance in one place. They onboard the on-premises and other-cloud servers to Azure Arc and assign an Azure Policy initiative at the management group, so all servers are evaluated together.
Common mistakes: calling any use of two clouds 'hybrid'; thinking a private cloud must be in your own building; and confusing Azure Arc with Azure Migrate. Migrate helps you move workloads into Azure; Arc manages them where they already are.
Exam questions give clue words: 'shared by many customers' or 'no upfront cost' means public; 'single organization' or 'full control of hardware' means private; 'keep some data on-premises while using Azure' means hybrid; 'two or more cloud providers' means multicloud; 'manage non-Azure servers from the Azure portal without moving them' means Azure Arc.
Key terms
- Public cloud
- Cloud services owned and run by a provider and offered to many customers over the internet.
- Private cloud
- Cloud resources dedicated to a single organization, whether in its own datacenter or hosted by a third party.
- Hybrid cloud
- A combination of private and public cloud that lets data and applications work across both.
- Multicloud
- Using services from two or more public cloud providers.
- Azure Arc
- A service that projects servers, Kubernetes clusters and data services outside Azure into Azure Resource Manager so they can be managed and governed from Azure.
- Tenant
- A customer's isolated slice of a shared cloud, with its own resources and identities.
A bank must keep certain transaction records on hardware it owns for regulatory reasons, but wants to use Azure for its mobile app back end and reporting. It connects its datacenter to Azure with a private link, which makes it a hybrid cloud. To apply one set of security policies to both its on-premises servers and its Azure VMs, it onboards the on-premises servers to Azure Arc and manages them in the Azure portal alongside everything else.
Check yourself
Which cloud model gives the most control over the physical hardware?
Private cloud, because the resources are dedicated to one organization, which chooses and manages the hardware.
A company uses Azure and a second public cloud provider but has no datacenter of its own. Which model is this?
Multicloud, because it uses more than one public provider; there is no private cloud involved, so it is not hybrid.
What does Azure Arc do with an on-premises server?
It projects the server into Azure Resource Manager so it can be managed with Azure tools such as Policy, RBAC and tags; the server itself stays on-premises.
Why might an organization choose hybrid cloud?
To keep some workloads or data on-premises for regulation, latency or legacy reasons while using public cloud for others, or to migrate gradually.