Azure Infrastructure as a Service: Virtual Machines, Networks and Backup, Designed and Priced on Purpose

Azure infrastructure as a service (IaaS) means renting servers, storage and networking in Microsoft's datacenters instead of owning them. You choose the virtual machine, its operating system and its disks; Microsoft runs the physical hosts, network and buildings. Lightray Solutions designs that setup, builds it in your Azure subscription and documents how to run it.

IaaS is the right home for some workloads and an expensive habit for others. A server that holds only files, or a database whose features fit Azure SQL, usually costs less to run elsewhere. Sorting that out, workload by workload, is most of the value.

Start with a free 30-minute strategy call with Edward Pinela, MBA, arranged by hand after you send the form or call. Lightray's work is quoted after a free strategy call; Microsoft bills your Azure usage directly, and the estimate shows both.

Which Azure building blocks does one server need?

An Azure IaaS setup has five building blocks: virtual machines that run your software, a virtual network that connects them, managed disks that store their data, a secure way for administrators to sign in, and backup. Each one has choices that change both reliability and the monthly bill, so each is decided rather than left on defaults.

• Virtual machines. Windows Server or Linux, sized by processor and memory from what the workload measurably uses, not from the old server's specification.
• Virtual network. Private address space, subnets and network security groups that decide which traffic may reach each machine. In IaaS this part is yours to configure.
• Managed disks. Microsoft offers five types, from Standard HDD for backup-style storage to Ultra Disk for heavy databases. Most small-business servers land on Standard SSD or Premium SSD. Standard HDD stops being usable as an operating-system disk on September 8, 2028.
• Administrator access. Azure Bastion gives remote-desktop and SSH sessions over TLS from the browser, so the virtual machines need no public IP address and no open RDP port.
• Backup. Azure Backup snapshots each machine on a schedule and stores the copies in a Recovery Services vault, separate from the machine itself.

IaaS, PaaS or SaaS: which does each workload need?

The difference is who looks after what. With IaaS you manage the operating system, network controls and applications. With PaaS, such as Azure SQL Database or App Service, Microsoft runs the operating system. With SaaS, such as Microsoft 365, you mostly manage users and settings. In every model you still own your data and identities.

That last point comes straight from Microsoft's shared responsibility model: accounts, access control, multifactor sign-in and data protection stay with the customer whichever model you pick. The table shows how the rest divides, and what each model tends to suit.

When does lifting a server into Azure make sense?

Lift a server as it is when the software needs a full Windows or Linux machine you cannot change: a vendor application supported only on a specific server version, legacy line-of-business software, or anything that needs local administrator control. It also suits test environments that run only part of the week and a quick exit from failing hardware.

It makes less sense for workloads that already have a managed home. A file server is often better as SharePoint, OneDrive or Azure Files. A SQL Server database whose features fit Azure SQL avoids operating-system patching altogether. Email belongs in Microsoft 365. When several servers have to move together, the Azure cloud migration services page covers assessment, sequencing and cutover.

What does an Azure virtual machine cost to run?

A virtual machine's bill has several parts: compute by the hour while it is allocated, disks by provisioned size, backup storage, outbound data transfer, and extras such as Bastion. Microsoft's pricing calculator estimates each one for your region, and the estimate is built with you before anything is deployed.

A few billing rules from Microsoft's documentation explain most surprises on a first invoice:

• Stopped is not the same as deallocated. A machine shut down from inside Windows stays allocated and keeps billing for compute. Only a deallocated machine stops compute charges, and its disks and networking still bill.
• Disks bill by size tier, not by data stored. A 200 GiB Standard SSD is billed as the 256 GiB tier, whether it holds 10 GiB or 200 GiB.
• Backup bills until the data is gone. Charges start after the first successful backup and continue while recovery points are kept, even if protection is stopped.
• Bastion bills from deployment. Its hourly charge runs whether or not anyone connects, so its tier is chosen to match how often administrators sign in.
• Data leaving Azure is charged. Large downloads to the office or to users add bandwidth costs.

How do you keep Azure IaaS servers secure and recoverable?

Close every door the internet does not need, keep the operating system patched, and prove the backups restore. In practice that means no public remote-desktop ports, network security groups that allow only the traffic each server needs, least-privilege Azure roles, a monthly patch routine, and a restore test before anyone relies on the backup.

Backup detail matters for databases. On Windows, Azure Backup uses Volume Shadow Copy for application-consistent snapshots, but a virtual machine backup restores the whole machine. If you need to roll a SQL Server database back to a specific point in time, Microsoft's separate SQL Server workload backup is configured as well. Each server's recovery steps go into a written runbook.

How does an Azure IaaS engagement with Lightray work?

It runs in three steps: design and estimate, build and test, then hand over. You approve the design and the monthly Azure estimate before anything is deployed, and the work happens remotely in your own Azure subscription over video and screen share, so the environment is yours from the first resource onward.

You work directly with Edward Pinela, MBA, who brings 20+ years of experience and 200+ projects delivered; Lightray holds a 4.9 rating on Google and replies within 4 business hours. Lightray is not a 24/7 support desk: day-to-day monitoring and patching go to your staff or IT provider, with a runbook and a walkthrough. Wider Azure architecture, reviews and cost work sit on the Azure consulting services hub. If you would rather hand ongoing operations to a provider, compare the options on Azure managed services, and for the identity and Microsoft 365 side of the same tenant see Microsoft 365 consulting.

Further reading: Microsoft Learn — Shared responsibility in the cloud.