N
.NET
Microsoft development framework; full .NET Framework apps needing OS access go on VMs, while .NET on App Service supports auto-instrumentation.
#
3DES (Triple Data Encryption Standard)
Legacy symmetric cipher; not a valid storage customer-managed key type.
5-tuple
Source IP, source port, destination IP, destination port and protocol; the default Load Balancer hash and the input IP flow verify tests.
_backup.filter
File in the app's site\wwwroot folder listing paths to exclude from custom App Service backups; excluded content is left untouched on restore.
A
A record
DNS record mapping a name to an IPv4 address; used to map a root domain to an app.
Access package
Entitlement management bundle of groups, apps and sites with request policies and expiry; when the assignment expires its resource access is removed.
Access reviews
Entra ID Governance feature for recurring attestation of guests, app users or group members, with self-review and auto-removal of non-responders; not PIM, which covers privileged roles only.
Access tier
Blob-level Hot, Cool, Cold or Archive setting that trades storage price against access price; applies to block blobs in standard accounts only.
Account SAS
SAS signed with the account key that can span several services (ss), resource types (srt) and permissions (sp), including service-level operations; denied when Shared Key is disabled.
ACR Tasks
ACR feature that builds, pushes and patches images in Azure (quick tasks via az acr build, triggered and multi-step tasks); available in every SKU.
AcrPull
Built-in ACR data-plane role to pull images and read tags; it must be on the identity that actually pulls, which for ACI is a user-assigned managed identity.
Action groups
Azure Monitor notification targets; they deliver alerts but do not detect problems themselves.
Activity log
Subscription log of management-plane operations (deployments, Policy events), kept 90 days; it records no data-plane access such as Key Vault reads.
Activity log alert
Stateless alert rule that fires when an Activity log event matches its condition (for example Delete management lock); it needs a scope, a condition and an action group, and no Log Analytics workspace.
AD DS (Active Directory Domain Services)
The on-premises Windows domain service with domain controllers; see also Microsoft Entra Domain Services for the managed version.
AD FS (Active Directory Federation Services)
On-premises federation server; Web Application Proxy is its older publishing role, not Entra Application Proxy.
Additional local administrators (Microsoft Entra Joined Device Local Administrator)
Device setting (Entra ID P1) that makes the chosen users local admins on every Entra joined device; it can't be scoped to some devices.
Address space
CIDR range(s) assigned to a VNet; a new range outside it must be added to the address space before a subnet can use it, and it can be changed freely while unused.
ADLS Gen2 (Azure Data Lake Storage Gen2)
Standard GPv2 storage with hierarchical namespace enabled, giving real directories and POSIX-style ACLs for analytics.
Admin user (ACR)
Registry admin account, disabled by default, with a username and two regenerable passwords on the Access keys blade; gives full push and pull as one shared identity.
Administrative (Activity log category)
Activity log event category holding all create, update, delete and action (write) operations through Resource Manager, such as creating a resource group, adding a tag or attaching a disk.
Administrative units
Entra containers that scope directory administration; not Azure Policy scopes or cost groupings.
ADUC (Active Directory Users and Computers)
On-premises AD console for editing users one at a time; doesn't scale for bulk sync fixes.
AES (Advanced Encryption Standard)
Symmetric cipher; AES-256 is the TDE data encryption key that the RSA TDE protector wraps.
AKS (Azure Kubernetes Service)
Managed Kubernetes with full cluster and node-pool control; autoscales with HPA and the cluster autoscaler; has no built-in user sign-in.
Alert processing rules (action rules)
Rules that add or suppress action groups on fired alerts, optionally on a schedule; the alert rule still exists and still fires, only its notifications change.
Alert rule
Azure Monitor rule combining a scope (target resources), a condition (signal and logic) and optional action groups; each distinct signal with its own recipients needs its own rule.
AllowAzureLoadBalancerInBound
Default inbound NSG rule (priority 65001) allowing Azure Load Balancer health probes.
Allowed resource types
Built-in Azure Policy (Deny) that blocks every resource type not on its list.
AllowInternetOutBound
Default outbound NSG rule (priority 65001) allowing outbound internet; override with a lower-numbered outbound deny.
AllowVNetInBound
Default inbound NSG rule (priority 65000) allowing traffic from the VirtualNetwork tag, including peered VNets.
AllowVnetOutBound
Default outbound NSG rule (priority 65000) letting VMs start connections to the VNet and peered VNets; the destination NSG must still allow the port.
APM (application performance monitoring)
Request, failure, dependency and exception telemetry; the core function of Application Insights.
App Configuration (Azure App Configuration)
Service for central app settings and feature flags; its key-value read-only locks aren't Resource Manager locks.
App registration
Entra ID object defining an application's identity, permissions and supported account types; used for OpenID Connect sign-in and multi-tenant apps.
App Service
Managed PaaS web hosting (web apps, Web App for Containers) in a sandbox with no OS access; autoscale and slots from Standard.
App Service backup
Custom on-demand or scheduled backup of an app's content and configuration written as blobs to a storage container in the same subscription; set per app or slot and restorable to another app or slot.
App Service Environment (ASE)
Single-tenant, network-isolated App Service (Isolated plan); far dearer, so only for isolation requirements.
App Service plan
Compute (region, OS, instance size and count, pricing tier) that hosts one or more apps and is the unit of billing; Windows and Linux apps need separate plans in the app's region.
App settings
Name/value pairs passed to an App Service app as environment variables, overriding Web.config or appsettings.json values; they can be made slot-specific.
Append a tag and its value to resources
Built-in tag policy (Append) that adds a tag on create or update and keeps user tags; it doesn't apply to resource groups.
Append blob
Blob of blocks optimised for append-only writes such as logs; can't be tiered.
Application Gateway
Regional layer-7 load balancer with SSL offload, URL routing, cookie affinity and optional WAF; plays no part in Entra SSO to on-premises apps.
Application Gateway WAF tier
Application Gateway tier (WAF_v2; the v1 WAF tier retired on 28 April 2026) adding OWASP Core Rule Set protection; the Standard tier has no WAF.
Application groups
Azure Virtual Desktop groupings of desktops or RemoteApp apps assigned to users; not an alerting or network construct.
Application Insights
Azure Monitor APM service for app telemetry, Application Map, availability tests and usage analytics; workspace-based instances store data in Log Analytics.
Application Insights Profiler
Application Insights feature that captures performance traces of a live app to show slow requests and hot code paths; it profiles code, not user activity.
Application security group (ASG)
Group of VM network interfaces used as a source or destination in NSG rules instead of IP addresses; it can't trigger alert actions.
Archive
Offline blob tier with the lowest storage and highest access price; blobs must be rehydrated (up to 15 hours) before reading.
ARM template
Declarative JSON IaC file for Azure deployments; fire-and-forget, with no live link like Blueprints (which is being retired in phases, fully on 31 January 2027).
ASM (Azure Service Manager)
The classic deployment model that preceded Azure Resource Manager; don't use it for new resources.
AssignableScopes
Role-definition list of where a custom role can be assigned: a management group, subscription, named resource group or resource.
Assigned group
Entra group whose members are added manually by owners or admins, as opposed to a dynamic rule.
Authentication Administrator
Entra role that manages individual users' authentication methods but not the tenant-wide SSPR or methods policy.
Authentication Policy Administrator
Least-privileged Entra role that configures the authentication methods policy and tenant SSPR settings; Authentication Administrator can't.
Auto-shutdown
Azure VM setting that stops (deallocates) a VM at a set daily time to save cost; backups still run while the VM is off.
Automatic backups (Azure SQL)
Built-in backups giving point-in-time restore for 1–35 days; LTR is needed for longer.
Automatic scaling (App Service)
Scale-out option for Premium v2–v4 plans that adds instances from HTTP traffic with prewarmed instances and no rules; it can't scale on a CPU threshold.
Automation account
Azure Automation container for runbooks, assets and configurations; not needed for extension-based installs.
Autoscale
Azure Monitor feature that scales out or in (adds or removes instances) when a metric rule holds for its whole duration or on a schedule; the maximum instance count is only a cap and never forces scaling.
Availability set
VMs spread over fault domains (up to 3) and update domains (up to 20) in one datacentre; 99.95% SLA; no autoscale or zone spread.
Availability zones
Physically separate datacentres within a region; VMs across two or more give a 99.99% SLA.
az acr build
Azure CLI command that runs an ACR quick task: it uploads the build context, builds the image in Azure and pushes it to an existing registry.
az acr credential
Azure CLI command group that shows or regenerates a registry's admin-user credentials.
az acr login
Azure CLI command that authenticates Docker to a registry with your Entra identity before docker push or pull.
az aks
Azure CLI command group for AKS; az aks update or az aks nodepool update with --enable-cluster-autoscaler --min-count --max-count turns on autoscaling, and az aks install-cli installs kubectl.
az container create
Azure CLI command that deploys an ACI container group, with options for image, registry credentials or --acr-identity, ports, VNet subnet and restart policy.
az deployment group create
Azure CLI command that deploys a template to an existing resource group.
az deployment sub create
Azure CLI command that deploys a template at subscription scope, e.g. to create resource groups.
az network bastion
Azure CLI command group (rdp, ssh, tunnel) that opens a Bastion tunnel; az network bastion rdp launches mstsc to a VM without a public IP.
az network dns zone import
Azure CLI command that creates or merges an Azure DNS zone from a BIND zone file in one step.
az storage blob
Azure CLI command group for blob data, including upload-batch for local folders and copy start-batch for server-side copies between containers.
AzCopy
Command-line copy tool for storage data; cannot manage queues or copy running VMs.
Azure ABAC (attribute-based access control)
Role assignment conditions layered on RBAC, e.g. by blob index tag; supported for blobs (including ADLS Gen2) and queues, not Files or Tables.
Azure AD B2C
Customer identity service, no longer sold to new customers since 1 May 2025 (Microsoft Entra External ID is the successor); APIM validate-jwt can validate its tokens through its OpenID configuration.
Azure Advisor
Best-practice recommendations (cost, performance, reliability, security) for existing Azure resources; cannot estimate pre-migration cost or evaluate NSG rules.
Azure Arc
Manages non-Azure servers in place through the Azure Connected Machine agent; not a migration tool.
Azure Arc-enabled servers
Windows and Linux machines outside Azure connected through the Azure Connected Machine agent so they appear as Azure resources and can run AMA with DCRs.
Azure Automation
Runbook service for imperative scripts, e.g. AVD scaling; not IaC and cannot revoke access in reviews.
Azure Automation State Configuration
Automation service that compiles DSC configurations, assigns them to onboarded running machines and reports compliance; it retires on 30 September 2027.
Azure Backup
Backup service storing recovery points in a Recovery Services vault, including long-term retention; not DR failover like Site Recovery.
Azure Backup reports (Backup Reports)
Azure Backup reporting built on vault diagnostic settings sending data to Log Analytics workspaces, which can be in any region; a storage account destination must be in the vault's region.
Azure Bastion
Brokers RDP and SSH over TLS on port 443 from the portal, so VMs need no public IPs; unlike JIT, which opens 3389/22.
Azure Batch
Schedules and autoscales compute node pools for parallel, HPC and render jobs, with multi-instance tasks for MPI.
Azure CLI (CLI)
Cross-platform command line, e.g. az policy state trigger-scan or az storage queue.
Azure Compute Gallery
Repository for sharing VM image versions; publishing to it needs write on the gallery.
Azure Connected Machine agent
The Azure Arc agent for non-Azure servers; it does not collect VM logs.
Azure Container Apps
Serverless, KEDA-based container hosting with autoscale and zone redundancy and no cluster admin.
Azure Container Instances (ACI)
Per-second-billed container groups with no cluster; no autoscale or zone spread.
Azure Container Registry (ACR)
Private container image registry with geo-replication, retention and ACR Tasks; webhooks drive continuous deployment.
Azure Container Registry SKUs
Basic, Standard and Premium registry tiers; all include ACR Tasks and the admin user, while private endpoints, dedicated data endpoints, connected registries and content trust need Premium.
Azure Content Delivery Network (CDN)
Caches static web content at edge points of presence near users; Azure CDN Standard from Microsoft (classic) accepts no new profiles and retires on 30 September 2027, so new deployments use Azure Front Door Standard or Premium.
Azure Disk Encryption (ADE)
In-guest encryption of OS and data disks with BitLocker or DM-Crypt and keys in Key Vault; no ephemeral OS disks, Write Accelerator disks or dynamic volumes, and it retires on 15 September 2028.
Azure Disk Encryption for volume encryption
Key Vault access policy (enabled-for-disk-encryption) that ADE requires before it can write keys and secrets to the vault, which must be in the VM's region.
Azure DNS
Azure's DNS hosting and resolution family: public zones, private zones and DNS Private Resolver; it is not a domain registrar.
Azure Event Hubs
High-volume telemetry ingestion over HTTPS/AMQP; a destination for diagnostic settings.
Azure File Sync
Agent on on-premises Windows Server that caches an Azure file share locally with cloud tiering and two-way sync.
Azure Files
Managed SMB/NFS file shares; no Archive tier and one account-wide encryption key.
Azure Files backup
Azure Backup protection of file shares through a Recovery Services vault in the storage account's region; policies run daily or hourly at set intervals (4, 6, 8 or 12 hours; newer policies also offer 1 or 2).
Azure Firewall
Managed stateful network firewall, deployable in Virtual WAN hubs and managed by Firewall Manager.
Azure Functions
Serverless event-driven code (Consumption, Premium or Dedicated plan) run by triggers such as timer, HTTP, Blob or Event Grid.
Azure Government
Physically isolated US-government Azure cloud; VNets can't be peered between it and Azure public.
Azure Key Vault (Key Vault)
Store for secrets, keys and certificates; where a same-geography pair exists it replicates there, with best-effort Microsoft-initiated failover during which the vault is read-only.
Azure Load Balancer
Regional layer-4 load balancer (Standard is zone-redundant); no WAF, TLS termination or URL routing.
Azure Machine Configuration (guest configuration)
Azure Policy feature that audits or applies OS settings inside Azure and Arc-enabled machines; the successor to the DSC extension and State Configuration.
Azure Migrate
Discovery, assessment and server migration of on-premises VMs via an on-premises appliance; the project lives in the target subscription.
Azure Migrate appliance
On-premises VM (VHD for Hyper-V, OVA for VMware, or installer script) registered to one Azure Migrate project that discovers servers agentlessly and collects performance data for assessments.
Azure Migrate project
The Azure resource (in the target subscription) that holds discovery and assessment data; not the on-premises appliance.
Azure Monitor
Azure's unified observability service that collects, analyses and alerts on metrics, logs and traces from Azure and hybrid resources.
Azure Monitor agent (AMA)
Current agent collecting guest-OS logs according to DCRs; replaced the Log Analytics agent (MMA).
Azure Monitor alerts
Rules that notify or act when metric, log or activity-log conditions are met; they don't enforce SAS expiry or storage access.
Azure Monitor Logs
The log half of the Azure Monitor data platform, storing log and performance data in Log Analytics workspaces and queried with KQL.
Azure Monitor Metrics
The metrics half of the Azure Monitor data platform, a time-series store of numeric values; platform metrics are collected automatically and kept 93 days.
Azure Monitor Private Link Scope (AMPLS)
Connects Azure Monitor resources to private endpoints; use one per shared DNS, with peered VNets sharing an endpoint.
Azure Policy
Enforces and audits resource configuration (location, SKU, tags) through definitions and assignments; not a deployment tool or access control.
Azure PowerShell (Az PowerShell module)
Microsoft's PowerShell modules (Az.*) for managing Azure resources, for example Set-AzStorageAccount.
Azure Private Link (Private Link)
Platform that exposes PaaS services such as Azure Storage on a private endpoint in your VNet over the Microsoft backbone; needs VNet and DNS setup and does not admit a public IP.
Azure Relay
Messaging service that relays connections between cloud and on-premises endpoints outbound over 443; used by the on-premises data gateway and App Service Hybrid Connections, with no VPN or VNet routing.
Azure Site Recovery (ASR)
Replicates VMs to another site or region for DR with RTO in minutes and recovery points kept at most 15 days; does not raise the SLA.
Azure Site Recovery Provider
Agent installed on each Hyper-V host (or the VMM server) that registers it with the Recovery Services vault and orchestrates replication; it plays no part in sizing.
Azure SQL Database
PaaS single database or elastic pool; up to 4 TB (128 TB Hyperscale); no cross-database queries, SQL Agent or CLR.
Azure Storage Explorer (Storage Explorer)
Desktop app for working with data in existing storage accounts (blobs, tiers, file shares, tables, queues, SAS URLs); it can't create storage accounts.
Azure Storage firewall
Storage account network rules (Public network access set to selected networks) that admit only listed VNet subnets, IP ranges, resource instances and trusted services to the public endpoint and deny everything else.
Azure Stream Analytics
Serverless SQL-like stream processing with windows and built-in anomaly detection.
Azure Update Manager
Service that assesses and installs guest OS updates on Azure and Arc-enabled machines on demand or on maintenance schedules; it never moves the VM.
Azure Virtual Desktop (Windows Virtual Desktop)
Hosted Windows desktops; host pools scale with Automation runbooks or an Autoscale scaling plan.
Azure Virtual Machines for deployment
Key Vault access policy (enabled-for-deployment) that lets Microsoft.Compute retrieve certificates stored as secrets when VMs are created; not needed for ADE.
Azure Virtual Network Manager
Central management of connectivity (hub-and-spoke or mesh) and security admin rules across VNets and subscriptions; not a packet capture or diagnostic tool.
Azure VM Agent
In-guest process that talks to the Azure fabric controller and runs VM extensions; without it extensions can't be installed.
Azure Windows VM Agent (Windows VM agent)
Lightweight process in Windows VMs that talks to the Azure fabric and runs VM extensions (including the backup extension); it collects no monitoring telemetry itself.
Azure-provided DNS
Default VNet resolver at 168.63.129.16 that returns private DNS zone records to linked VNets; custom DNS servers must forward to it to see them.
AzureBackupReport (Azure Backup Reporting Data)
Legacy vault diagnostics log category for Backup reports, supported only in Azure diagnostics mode; the resource-specific Core Azure Backup Data events replace it.
AzureBastionSubnet
Required name of Azure Bastion's dedicated subnet, /26 or larger for every SKU since 2 November 2021 (/27 was accepted before).
AzureFirewallSubnet
Required name of the dedicated subnet (/26 or larger) that Azure Firewall is deployed into.
AzureKeyVault (service tag)
Outbound service tag for Azure Key Vault's IP ranges, optionally regional.
AzureLoadBalancer (service tag)
Service tag for the Azure infrastructure load balancer (168.63.129.16) health probes only, not client traffic.
AzureRM
Retired Azure PowerShell module (deprecated 29 February 2024) replaced by Az; e.g. Get-AzureRmRoleDefinition became Get-AzRoleDefinition.
B
Backend pool
Load balancer targets by NIC IP configuration (or IP); limited to one VNet, and a Standard pool can't include a VM with a Basic public IP.
Backlogged Input Events
Stream Analytics metric counting input events received but not yet processed; a value that stays above zero means the job can't keep up and needs more streaming units.
Backup Contributor
Azure role that manages backups in a Recovery Services vault but can't create vaults or grant access.
Backup policy
Azure Backup setting inside a vault that defines the schedule and retention for one workload type; policies are vault-scoped, so each vault needs its own VM and Azure Files policies.
Backup storage redundancy (storage replication type)
Recovery Services vault setting (GRS by default, LRS or ZRS) that must be chosen before any item is protected; after backup is configured it can't be changed.
Backup vault
Azure Backup vault for newer workloads (Azure Blobs, managed disks, Azure Database for PostgreSQL, AKS); it can't protect Azure VMs, Azure Files or MARS backups.
Basic Load Balancer
Retired (30 September 2025) Load Balancer SKU with a backend pool limited to one availability set, scale set or standalone VM, no zones or HA Ports, Basic public IPs only and open by default.
Basic SKU public IP
Retired public IP SKU (static or dynamic, open by default) that couldn't be used with Standard Load Balancer, Bastion or Azure Firewall; retired 30 September 2025.
BGP (Border Gateway Protocol)
Dynamic routing protocol used over ExpressRoute and VPN; over ExpressRoute private peering, the only way routes (including a forced-tunnelling 0.0.0.0/0) are exchanged.
BIND zone file
Standard text file of a zone's records; Azure CLI az network dns zone import (or the portal) imports it, but Azure PowerShell has no import cmdlet.
BitLocker (BitLocker Drive Encryption)
Windows full-volume encryption; Import/Export drives are AES-256 BitLocker-encrypted.
Blob index tags
Key-value attributes on blobs that are indexed for search and can drive lifecycle filters (blobIndexMatch) and ABAC conditions; a SAS cannot filter by them.
Blob storage
Object storage for unstructured data such as video and images; block blobs up to about 190.7 TiB.
BlobStorage (legacy account)
Legacy blob-only standard account kind with access tiers; retiring on 13 October 2026, so upgrade to GPv2.
Block blob
Blob made of blocks for text and binary data, up to about 190.7 TiB; the only blob type that supports access tiers and object replication.
BlockBlobStorage
Premium SSD account for block and append blobs with lowest latency; LRS or ZRS only, no access tiers.
Bulk operations
Entra admin-centre actions that take a downloaded CSV template (not XML): Bulk create (members), Bulk invite (guests), Bulk delete (UserPrincipalName column only) and Download users.
C
CanNotDelete (Delete lock)
Resource lock level that allows reads and changes but blocks deletion; it doesn't block moves.
Change feed
Ordered log of blob changes; needed for point-in-time restore and retains rather than purges data.
Child zone
Separate DNS zone for a subdomain (e.g. research.adatum.com) delegated by an NS record set of that name in the parent zone.
CIDR (Classless Inter-Domain Routing)
IP address range notation, e.g. an AKS overlay pod range.
Client address pool
Private IP range, not overlapping the VNet or on-premises, from which P2S VPN clients get addresses; configured after the VPN gateway exists.
ClusterIP
Default Kubernetes Service type that gets an internal IP from the service CIDR, reachable only inside the cluster.
CNAME (canonical name record)
DNS alias record mapping a name to another name, such as www to <app>.azurewebsites.net; not allowed at a zone apex.
Cold
Online blob tier cheaper to store than Cool but dearer to access; still immediately accessible.
Company branding
Customises the Entra sign-in page (logo, background, text) only; it doesn't name groups or verify domains.
Conditional Access
Entra ID P1 policy engine that grants access with controls such as MFA or compliant device, based on conditions like named locations or risk.
Conditional forwarder
DNS server rule forwarding queries for one domain to specific servers; it gives no network reachability.
Confidential disk encryption
OS-disk encryption for confidential VMs only that binds keys to the VM's TPM so only that VM can read the disk.
Configuration server
Classic on-premises Site Recovery component, deployed on vSphere from an OVF template, that coordinated VMware replication; the classic experience retired in March 2026.
Connected organization
Partner directory registered in entitlement management so access-package policies can target its users.
Connected registry
Premium ACR feature: an on-premises or edge replica (ReadOnly by default, or ReadWrite) that synchronises images with its cloud parent registry.
Connection Monitor
Network Watcher test of network paths between sources and destinations over time; source VMs must be in the monitor's region, so you need one monitor per source region.
Connection troubleshoot
Network Watcher one-off test from a VM to a VM, FQDN, URI or IP:port that reports reachability, latency and the failing hop (NSG or route).
Consumption-only environment
Legacy (v1) Container Apps environment type with only the Consumption plan; a custom VNet subnet must be at least /23 and not delegated.
Container Apps environments
Isolation boundary (own VNet) for Container Apps, with Consumption and Dedicated workload profiles.
Container group
Top-level ACI resource: containers on one host sharing lifecycle, IP, ports and volumes, like a Kubernetes pod; multi-container groups are Linux only.
Cooldown
Autoscale setting (default 5 minutes) for how long a rule waits after a scale action before acting again; separate from the duration the metric is evaluated over.
copy (ARM template)
Loop element that creates multiple resources, properties (such as storageProfile.dataDisks), variables or outputs, up to 800 iterations.
copyIndex()
ARM template function returning the zero-based iteration of a copy loop; in a property loop pass the loop name, e.g. copyIndex('dataDisks'), to give each disk a unique LUN and name.
CoreDNS (kube-dns)
Default AKS cluster DNS service (pods in kube-system) for internal name resolution and service discovery; its service IP is internal only.
Cost analysis
Cost Management tool for exploring costs by period, scope, service or tag.
Cost Management
Azure cost analysis, budgets and tag-based reports for resources already in Azure; cannot estimate pre-migration costs.
Crash-consistent snapshot
Snapshot capturing only data already on disk, taken when a VM is shut down or deallocated at backup time or when app-consistent snapshots fail; the VM still gets a recovery point.
Create new (restore option)
Azure VM restore option that builds a new VM, or restores disks, from a recovery point in the same region while the original keeps running.
CSV (comma-separated values)
Flat text export format, e.g. an HR file for API-driven provisioning.
Custom DNS server
DNS server IPs set on a VNet (or overriding per NIC) instead of Azure-provided DNS, e.g. domain controllers for AD DS; VMs must be able to reach its private IP.
Custom domain
Verified domain in an Entra tenant (add it, create the TXT or MX record at the public DNS host, then verify); each on-premises UPN suffix used for sign-in must be one, and .local can't be verified.
Custom roles (Azure custom roles)
Azure RBAC roles you define with your own actions when built-in roles don't fit; up to 5,000 per tenant, and not the mechanism behind multi-user authorization.
Custom Script Extension
VM extension that downloads scripts from Azure Storage, GitHub or other reachable locations and runs them (PowerShell or Bash) to install software such as IIS or NGINX.
Customer-managed account failover
Promotes a geo-redundant storage secondary to primary, keeping DNS names; after an unplanned failover the account is LRS until geo-replication is reconfigured, while a planned failover keeps geo-redundancy.
Customer-managed keys (CMK)
Your own RSA or RSA-HSM key (2048, 3072 or 4096 bits) in Key Vault or Managed HSM that wraps the storage account encryption key; can be enabled after creation, but CMK support for tables and queues is creation-only.
D
D-series
General-purpose VM family balancing CPU and memory for enterprise apps, web servers and dev/test.
Data collection endpoint (DCE)
Endpoint receiving Logs Ingestion API data; can be added to AMPLS for private ingestion.
Data collection rule (DCR)
Defines what AMA or the Logs Ingestion API collects (e.g. XPath event filters) and where it goes.
Data Collector Set
Performance Monitor collection of counters, ETW traces and configuration data logged on a schedule.
Data disk
Managed disk attached to a VM at a LUN for application data; attaching one to a running VM causes no downtime.
DataActions
Role-definition list of data-plane operations such as blob reads or VM login/action; data actions put in Actions don't work.
DC (domain controller)
Server hosting AD DS; keep DCs on-premises and in Azure for sync and sign-in resilience.
DCR transformation (transformation)
KQL query in a data collection rule that filters or reshapes each record at ingestion before it's stored; it doesn't choose which Windows events the agent collects (XPath does).
Dedicated data endpoints
Premium ACR feature giving registry-specific, per-region data URLs (<registry>.<region>.data.azurecr.io) for tightly scoped firewall rules; it grants no permissions.
Default outbound access
Implicit Microsoft-owned public IP for outbound internet from VMs with no explicit outbound method; not provided in private subnets, which are the default for VNets created after 31 March 2026.
Default to Microsoft Entra authorization in the Azure portal
Storage account setting that makes the portal use the user's Entra credentials for data access by default; it is not the prerequisite for identity-based SMB access.
Default user permissions
Entra User settings such as Users can register applications and Restrict access to the Microsoft Entra administration portal; the portal restriction is UI-only, not a security boundary.
Deny assignments
Azure RBAC denials that override role assignments; historically only Azure services (such as deployment stacks) created them, today you can also create user-assigned ones with New-AzDenyAssignment or az role deny-assignment create (write, delete and action operations only, not groups).
Deny settings (DenyDelete, DenyWriteAndDelete)
Deployment-stack option that creates deny assignments on its managed resources for all principals, Owners included, unless excluded.
DenyAllInBound
Default inbound NSG rule (priority 65500) denying everything not allowed earlier, including internet traffic.
dependsOn
ARM template element listing resource names or IDs (usually via resourceId()) that must deploy first; it sets order only and doesn't loop.
DeployIfNotExists
Deploys an ARM template when a related resource is missing; fixes existing resources only through a remediation task.
Deployment credentials (FTPS, basic authentication)
App Service username/password credentials for FTP/S and local Git; they're basic auth, not Entra identities.
Deployment modes (Incremental, Complete)
Incremental (default) adds or updates and leaves unlisted resources alone; Complete deletes resources in the group that aren't in the template.
Deployment slots
App Service staging slots (Standard and above) swapped into production with warm-up and rollback.
Deployment stacks
Resources that manage a group of resources deployed together as one unit; with Template Specs, the replacement for Blueprints.
DevTest Labs User
Azure role for creating and using your own VMs inside a DevTest Labs lab only.
DHCP (Dynamic Host Configuration Protocol)
Azure's DHCP service hands the NIC's private IP to the guest OS, so leave the OS on DHCP and set static IPs on the Azure NIC instead.
Diagnostic setting
Routes a resource's logs and metrics to storage, Log Analytics, Event Hubs or a partner; up to five per resource.
DirectAccess
Windows Server always-on remote-client access technology (superseded by Always On VPN); not site-to-site or VNet connectivity.
Disconnected (peering state)
Peering status meaning the link from the other VNet was deleted and no traffic flows; fix by deleting and re-creating the peering on both VNets (not by changing address space).
Disk Backup Reader
Azure built-in role the Backup vault's managed identity needs on the source managed disk so Azure Disk Backup can read it.
Disk Snapshot Contributor
Azure built-in role the Backup vault's managed identity needs on the snapshot resource group so Azure Disk Backup can create and delete disk snapshots.
Distribution group (distribution list)
Mail-enabled Exchange group used only to send email to its members; it can't grant access or act as an Azure Monitor alert target.
DM-Crypt
Linux disk-encryption subsystem that Azure Disk Encryption uses inside Linux VMs.
DNS (Domain Name System)
Name resolution; private endpoints rely on private DNS zones reached through 168.63.129.16.
Docker bridge address
Node-local docker0 network range (for example 172.17.0.1/16), used for neither pod nor service IPs; the AKS dockerBridgeCidr setting is deprecated and no longer has any effect.
Docker Content Trust (DCT)
Premium ACR feature (Notary v1) for pushing and pulling signed images; deprecated since 31 March 2025, not enableable on new registries from 31 May 2026, removed 31 March 2028.
docker push
Docker CLI command that uploads a tagged local image to a registry, after az acr login and docker tag with the login server.
Domain verification ID
App-specific value shown on the App Service Custom domains page that goes in the asuid TXT record.
DSC (Desired State Configuration)
PowerShell configuration management applied to VMs; does not create VMs.
Dynamic groups
Entra groups with rule-based membership from user attributes; not an access review.
Dynamic membership rules
Rule syntax for dynamic groups using hyphenated operators (-eq, -in, -notIn, -match, -startsWith, -and, -or); case-insensitive, and a rule can't mix user and device attributes.
Dynamics 365 Customer Insights (Customer Insights)
Dynamics 365 customer data platform and journey orchestration app; it is not an Azure monitoring or cost tool.
E
EC (elliptic curve)
Key Vault key type (P-256, P-384, P-521); not supported for storage customer-managed keys.
Effective security rules
Network Watcher view listing the combined NIC and subnet NSG rules on a NIC; tests no flow.
Elevate access (Access management for Azure resources)
Entra Properties toggle that gives the signed-in Global Administrator User Access Administrator at root scope (/); it applies only to that admin.
enabledForTemplateDeployment
Key Vault setting (Azure Resource Manager for template deployment) that lets Resource Manager read secrets during deployments; the deployer also needs Microsoft.KeyVault/vaults/deploy/action.
Encryption at host
VM option that encrypts temp disks, ephemeral OS disks and caches on the host so data flows encrypted to storage; it can't be combined with ADE and is the ADE replacement.
Encryption scopes
Per-container or per-blob encryption keys on top of account encryption; blob only.
Endpoint type (Standard / Azure DNS zone endpoints)
Creation-time storage setting that controls how endpoint names are formed (Azure DNS zone endpoints add a zone identifier to allow many accounts); it does not affect access or network cost.
Enterprise State Roaming (ESR)
Syncs Windows settings across a user's Entra devices; management moved to Windows Backup for Organizations and it controls no join or admin rights.
Entitlement management
Entra ID Governance access packages with approvals, expirations and connected organizations.
Entra ID P1
Entra licence needed for Conditional Access and Password Protection for on-premises AD.
Entra ID Protection (Identity Protection)
Entra ID P2 service evaluating user and sign-in risk and running the MFA registration policy.
Ephemeral OS disk
OS disk on the VM's local storage rather than Azure Storage; stateless, reprovisioned on redeploy or resize, can't be stop-deallocated, and unsupported by ADE, Azure Backup and Site Recovery.
ETW (Event Tracing for Windows)
Kernel-level Windows tracing of application and driver events; not a network packet capture.
Event Grid
Event router that pushes events to handlers; not a store and not a diagnostic-setting destination for Entra.
Export template (Automation script)
Generates a template from resources' current state, unlike the history copy of what was deployed; formerly called Automation script.
ExpressRoute
Private dedicated connection from on-premises to Azure via private or Microsoft peering.
extensionProfile
Scale set model section listing VM extensions (such as Custom Script or DSC) so every instance gets them at provisioning.
External collaboration settings
Entra settings for guest user access, who can invite guests (admins and Guest Inviter, members, or everyone) and allowed or blocked domains.
External user lifecycle
Entitlement management setting that blocks and then removes (default 30 days) a guest from the directory after their last access-package assignment ends.
F
Fault domain (FD)
Group of VMs sharing a power source and network switch; an availability set spreads VMs over up to 3 (2 in some regions) to limit rack failures.
File recovery (item-level restore)
Azure VM backup option that downloads a time-limited script which mounts a recovery point's disks over iSCSI on any compatible machine so you can copy individual files, then Unmount Disks.
Find-RoleCapability (JEA)
PowerShellGet cmdlet that finds Just Enough Administration role capabilities; unrelated to Azure RBAC.
Floating IP (direct server return)
Load-balancing rule option that keeps the frontend IP as the packet's destination so backend ports can be reused; gives no session affinity.
FQDN (fully qualified domain name)
Complete DNS name including the zone, such as www.contoso.com.
Frontend IP configuration
Load balancer IP address clients connect to, public or private; rules and inbound NAT rules reference it.
G
Gateway transit
Peering setting (Allow gateway transit on the hub, Use remote gateways on the spoke) letting peered VNets share the hub's route-based VPN or ExpressRoute gateway.
GatewaySubnet
Dedicated subnet for VPN or ExpressRoute gateways; /27 recommended minimum.
General-purpose v1 (GPv1, Storage)
Legacy storage account kind (kind Storage) with no access tiers, Archive or premium file shares, retiring by October 2026; upgrade to GPv2 (irreversible) before converting to ZRS.
Get (secret permission)
Reads one Key Vault secret; enough for App Service Key Vault references.
Get-AzRoleDefinition
Az cmdlet that returns a role definition; piped to ConvertTo-Json it gives the starting file for a custom role.
Get-AzureADDirectoryRole
Deprecated AzureAD PowerShell cmdlet for Entra directory roles (now Get-MgDirectoryRole); unrelated to Azure RBAC definitions.
Global Administrator
Microsoft Entra role with full directory administration; it grants no Azure data-plane access unless the holder elevates access to manage subscriptions.
Global VNet peering (global virtual network peering)
VNet peering between different Azure regions; works within one cloud but not between Azure public, Azure Government and Azure operated by 21Vianet.
Group naming policy
Prefix-suffix and blocked-words policy for Microsoft 365 groups, where prefixes can be strings or attributes such as [Department], [Company] or [Office].
Group-based licensing
Assigns licences to a security-enabled group's direct members (Entra ID P1 or P2); nested groups aren't expanded and inherited licences can't be removed from the user directly.
GRS (geo-redundant storage)
Six copies, LRS in the primary and paired region; secondary readable only after failover.
Guest Inviter
Entra role that can invite guests even when invitations are limited to admins in external collaboration settings.
Guest user
Entra user with UserType Guest, created by a B2B invitation with a UPN in the #EXT# format; the UPN isn't the sign-in identity.
Guest user access restrictions
External collaboration setting that controls what guests can see in the directory after they join, not who can invite them.
GZRS / RA-GZRS (geo-zone-redundant storage)
ZRS primary plus LRS secondary region; RA- adds a readable secondary.
H
HA Ports (high availability ports)
Internal Standard Load Balancer rule (protocol All, port 0) balancing all TCP/UDP flows on all ports, e.g. for active-active NVAs.
Health probe
Load balancer check (TCP, HTTP or HTTPS) marking backends healthy; an HTTP probe needs HTTP 200 from its path.
Hierarchical namespace (HNS)
Storage setting that turns GPv2 into ADLS Gen2 with directories and ACLs.
Host caching
Per-disk VM cache setting: ReadOnly (data-disk default, safe for reads), ReadWrite (cached writes can be lost if the host fails) or None (write-heavy disks).
Hybrid Connections
App Service feature reaching a single on-premises host:port over Azure Relay via the Hybrid Connection Manager; no VNet or routing effect.
Hybrid identity
User identity that exists in on-premises AD DS and is synced to Microsoft Entra ID; required to use Azure Files AD DS authentication.
Hyper-V Replica
Built-in Windows Server Hyper-V feature that asynchronously replicates VMs between Hyper-V hosts for disaster recovery; not an Azure sizing tool.
I
IAM (identity and access management)
Portal Access control (IAM) blade for RBAC role assignments.
ICMP (Internet Control Message Protocol)
Protocol used by ping; an NSG rule for TCP 3389 doesn't block it.
IdFix
Microsoft tool that finds and fixes on-premises AD attribute errors (duplicates, invalid characters in userPrincipalName, proxyAddresses) before directory sync.
Idle timeout
How long an idle TCP flow stays open on a load balancer rule (default 4 minutes); creates no stickiness.
imageReference
VM storageProfile property (publisher, offer, sku, version) that selects a Marketplace or platform image; custom images and VHD URIs use other properties.
Immutable Blob storage
WORM protection for blobs via time-based retention or legal hold.
Import/Export
One-time shipping of disks to load or export Azure storage; not ongoing ingestion.
Inbound NAT rule
Port forwarding from a frontend IP:port to one VM's NIC; needs no pool, rule or probe, and two rules can't share a frontend port on the same frontend IP.
Infrastructure encryption (double encryption)
Second AES-256 layer at the storage infrastructure level with a separate Microsoft-managed key; can only be enabled when the account or encryption scope is created.
Instant Restore (snapshot tier)
Azure VM backup snapshots kept alongside the disks for fast restore (1 to 5 days on Standard, up to 30 on Enhanced); older recovery points come from the vault tier.
Internal load balancer (ILB)
Load balancer with a private frontend IP in a subnet, spreading traffic between tiers or for VPN users; it can't accept internet traffic.
Internet (service tag)
Service tag for public IP space outside the VNet; a deny from Internet doesn't block intra-VNet traffic.
Internet routing
Routing preference that hands traffic to the transit ISP at the POP nearest the storage account, lowering networking cost; not supported for AD-joined Azure Files or Azure File Sync.
IP (Internet Protocol)
Network addressing; private endpoints give services a private IP.
IP configuration
Setting on a NIC that holds its private IP (dynamic or static) and optional public IP; load balancer backend pools and NAT rules reference it.
IP flow verify
Network Watcher tool that says whether a packet is allowed or denied and by which NSG rule.
IP network rule
Storage firewall rule that allows a public IPv4 address or CIDR range, such as an on-premises egress range; up to 400 per account and not usable for private addresses.
IP-based connection
Bastion Standard-or-higher feature for connecting to a target by private IP address instead of selecting the VM resource.
IPsec/IKE (Internet Protocol Security / Internet Key Exchange)
Protocol suite that encrypts and negotiates S2S and VNet-to-VNet VPN tunnels.
IPv6 (Internet Protocol version 6)
128-bit addressing supported in dual-stack VNets and Standard public IPs; Bastion and Azure Firewall public IPs must be IPv4.
iSCSI (Internet Small Computer Systems Interface)
Block-storage protocol over TCP (port 3260) that the file recovery script uses to attach recovery point disks as local volumes.
Isolated tier (App Service)
IsolatedV2 App Service tier that runs apps in an App Service Environment inside your VNet, scaling to 100 instances.
ISP (internet service provider)
Network provider carrying internet traffic; many block outbound TCP 445, which breaks SMB to Azure Files.
IT Service Management Connector (ITSMC)
Azure Monitor connector installed in a Log Analytics workspace that creates an ITSM connection so action groups can raise work items in an ITSM tool.
ITSM (IT service management)
Practice and tools (such as ServiceNow or SCSM) for incidents and work items; Azure Monitor reaches them through an ITSM action or Secure Webhook in an action group.
J
JIT (just-in-time)
Time-limited access, e.g. JIT VM access opening ports 3389/22, or PIM role activation.
Journal file
File (.jrn) the WAImportExport tool writes for each prepared drive, holding the drive serial number, BitLocker key and account details; uploaded when creating the import job.
JsonADDomainExtension
VM extension (publisher Microsoft.Compute) that joins a Windows VM to an Active Directory domain during a template deployment.
K
KEDA (Kubernetes Event-driven Autoscaling)
Scales AKS pods from event-source metrics via HPA; the basis of Container Apps.
Kerberos
Ticket-based Windows authentication used by Entra Domain Services, Application Proxy KCD and Azure Files.
Key encryption key (KEK)
Optional RSA key in Key Vault that wraps the ADE secret; pass its versioned URL with --key-encryption-key (CLI) or -KeyEncryptionKeyUrl (PowerShell).
Key Vault managed storage account keys
Legacy Key Vault feature that held and regenerated storage account keys on a schedule; removed from current docs in favour of Entra ID authorisation.
Key Vault references
@Microsoft.KeyVault(...) app settings that App Service resolves with no code change.
Key Vault Secrets User
Role granting secret Get for the Key Vault RBAC permission model.
KQL (Kusto Query Language)
Query language of Log Analytics and Azure Data Explorer, used for log alerts.
kubectl
Kubernetes command-line client for managing cluster workloads; installed with az aks install-cli, and it can't configure the AKS cluster autoscaler.
kubelogin
Kubectl credential plug-in that handles Microsoft Entra sign-in; installed with az aks install-cli.
kubenet
Basic AKS network plugin that saves IPs; no Windows nodes, and it retires on 31 March 2028 (migrate to Azure CNI Overlay).
L
Late Input Events
Stream Analytics metric counting events that arrived later than the late arrival tolerance window and were dropped or had their timestamp adjusted.
Legal hold
Immutability policy that keeps blobs in a WORM state until explicitly cleared; a container can hold one legal hold and one time-based retention policy together.
Lifecycle management
Rule-based policy that moves blobs between tiers or deletes them by age (modification, creation, last access or last tier change); supported on GPv2, legacy BlobStorage and premium block blob (delete only) accounts.
Load-balancing rule
Maps a frontend IP and port to a backend pool using a health probe; the load balancer forwards only traffic a rule defines.
LoadBalancer (Kubernetes Service)
Kubernetes Service type for which AKS creates an Azure Load Balancer front-end IP mapped to the pods; the address you publish in DNS for internet access.
Local network gateway
Azure object representing the on-premises site (VPN device public IP and address prefixes) for S2S connections; not used for P2S.
Log Analytics agent (MMA)
Legacy agent retired August 2024; replaced by AMA with DCRs.
Log Analytics Contributor
Azure built-in role that can read all monitoring data and edit monitoring settings, including Log Analytics workspaces and diagnostic settings.
Log Analytics workspace
Store for logs queried with KQL; used by Sentinel, VM insights and workspace-based Application Insights.
Log search alert (log alert)
Alert rule that runs a KQL query over Log Analytics data (for example the Event or Perf table) on a schedule, classically scoped to the workspace; it can now also be scoped to a single resource.
Logic App Contributor
Azure role that creates and manages logic apps (workflows/write) but can't grant access to them.
Logic App Operator
Azure role that reads, enables and disables logic apps and views runs, but can't create or edit them.
Logic Apps
Low-code workflows with triggers and connectors, e.g. approval emails; cannot run custom C#.
Login server
A registry's fully qualified name (for example myregistry.azurecr.io) that images must be tagged with before docker push.
Long-term retention (LTR)
Azure SQL weekly, monthly and yearly backups kept up to 10 years.
LUN (logical unit number)
Slot number identifying each data disk on a VM; it must be unique per VM.
M
MABS (Microsoft Azure Backup Server)
On-premises backup server; does not give MUA protection.
Mail-enabled security group
Security group with an email address, managed in Exchange or the Microsoft 365 admin centre; older guidance treated it as unsupported for group-based licensing, but current documentation lists mail-enabled groups as supported.
Managed identity
Entra identity for Azure resources with no stored secret; system-assigned or user-assigned.
Management certificate
Legacy certificate for the classic Azure Service Management API; unrelated to Azure Migrate sizing.
Management groups
Containers above subscriptions for policy and RBAC inheritance; they never span tenants.
Marketplace image
VM image published in Azure Marketplace and identified by publisher, offer, SKU and version (or a URN of the four).
Metric alert
Alert rule that evaluates numeric resource metrics at regular intervals, targeted at the resource; it can't see event log entries.
MFA (multifactor authentication)
A second sign-in factor, required through Conditional Access grants.
MFA Server (Azure Multi-Factor Authentication Server)
Deprecated on-premises MFA server that no longer services requests; use cloud Microsoft Entra MFA.
Microsoft 365 (Office 365)
SaaS productivity suite using one Entra tenant; Azure RBAC does not govern its data.
Microsoft 365 groups
Microsoft 365 collaboration groups with a shared mailbox, calendar and files; they aren't alert constructs, so alerts email people through action group receivers.
Microsoft account (MSA)
Personal consumer account (outlook.com, live.com) that B2B guests can use by default with no extra identity provider.
Microsoft Azure operated by 21Vianet (Azure China 21Vianet)
Physically separate Azure cloud in China run by 21Vianet; VNets can't be peered between it and Azure public.
Microsoft Azure Recovery Services agent (MARS)
Agent backing up on-premises Windows files, folders and system state to a vault; on-premises only.
Microsoft cloud settings
Cross-tenant access settings that enable B2B collaboration with Azure Government or Azure operated by 21Vianet.
Microsoft Defender for Storage (Advanced Threat Protection for Storage)
Defender for Cloud plan that detects threats and scans for malware in Blob, Files and Data Lake Storage; not an access control.
Microsoft Entra application proxy (Azure AD Application Proxy)
Publishes on-premises web apps via an outbound-only connector, with no VPN or inbound ports.
Microsoft Entra B2B (Azure AD B2B)
Guest accounts that authenticate against their home tenant.
Microsoft Entra Connect (Azure AD Connect)
Syncs on-premises AD identities to Entra ID.
Microsoft Entra Domain Services (Azure AD DS)
Managed Azure domain offering LDAP, Kerberos and NTLM, populated from Entra ID with no on-premises connectivity.
Microsoft Entra External ID
Microsoft's external identity platform covering B2B collaboration and customer (CIAM) tenants; the successor to Azure AD B2C for new customers.
Microsoft Entra ID (Azure AD)
Microsoft's cloud identity service and tenant for Azure and Microsoft 365.
Microsoft Entra ID Free (Entra ID Free)
Entra edition included with Azure and Microsoft 365 subscriptions; licences can only be assigned directly to users.
Microsoft Entra join (Entra joined devices)
Joins organisation-owned Windows or macOS devices directly to Entra ID; Users may join devices to Microsoft Entra ID controls who can, unlike registration (BYOD).
Microsoft Entra Kerberos (Azure AD Kerberos)
Identity source for Azure Files in which Entra ID issues Kerberos tickets for SMB, for hybrid (and now cloud-only) identities; only one identity source per storage account.
Microsoft Entra roles (directory roles)
Tenant-level admin roles such as User Administrator that manage Entra objects and grant no Azure resource rights; Azure RBAC is separate.
Microsoft Graph
API for Microsoft 365 and Entra data, authorised with delegated or application permissions, not Azure RBAC.
Microsoft network routing (Microsoft global network)
Default routing preference that brings traffic onto Microsoft's global network at the POP nearest the client for best performance.
Microsoft.ClassicNetwork
Resource provider for classic (ASM) networking resources; ARM NSGs are under Microsoft.Network instead.
Microsoft.Insights
Azure resource provider namespace for Azure Monitor resources such as diagnostic settings, alert rules, data collection rules and endpoints.
Microsoft.KeyVault
Service endpoint for Azure Key Vault; doesn't activate service endpoint policies, which need Microsoft.Storage.
Microsoft.Network
Azure resource provider namespace for networking resources such as VNets, NSGs and Network Watcher; its actions are what Network Contributor grants.
Microsoft.OperationalInsights
Azure resource provider namespace for Log Analytics workspaces; Traffic Analytics needs workspaces/read and workspaces/sharedkeys/action.
Microsoft.Storage
Service endpoint for Azure Storage; one per subnet covers every storage account in the region.
Modify
Adds, replaces or removes tags and properties; fixes existing resources through a remediation task.
Monitor condition
System-set state of a fired alert, Fired or Resolved, according to whether the underlying condition still holds; activity log alerts stay Fired.
mstsc (Remote Desktop Connection)
Windows RDP client; run directly it can't reach a VM without a public IP, but az network bastion rdp opens it through Bastion.
Multi-user authorization (MUA)
Protects critical backup operations by requiring a role on a Resource Guard, ideally in a separate tenant.
Nano Server
Smallest Windows container base image, for .NET Core apps, without PowerShell or WMI.
NAT gateway (Azure NAT Gateway)
Managed outbound-only SNAT for a subnet through static public IPs; the recommended explicit outbound method, allowing no unsolicited inbound connections.
Native client support
Bastion Standard-or-higher setting that lets az network bastion rdp/ssh connect from a local client such as mstsc.
Nested groups
Groups within groups; Azure role assignments through them are honoured, but group-based licensing only reaches direct members.
Network Contributor
Azure built-in role for managing networking resources (Microsoft.Network/*); it lacks the storage, Log Analytics workspace and DCR actions that flow logs and Traffic Analytics need.
Network Performance Monitor (NPM)
Retired Log Analytics agent-based network monitoring solution, replaced by Connection Monitor.
Network Watcher
Azure network diagnostics, including IP flow verify, flow logs and Connection Monitor.
Network Watcher Agent extension
VM extension (AzureNetworkWatcherExtension) used by packet capture and Connection Monitor; installs only on Azure VMs or Azure Arc-enabled servers.
New-AzConfigurationAssignment
Az.Maintenance cmdlet that assigns a maintenance configuration (patching or maintenance schedule) to a VM, scale set or host; it installs no software.
New-AzManagementGroupDeployment
Az cmdlet that deploys a template at management group scope.
New-AzResourceGroupDeployment
Az cmdlet that deploys a template to an existing resource group, with -Mode Incremental (default) or Complete; it can't create its own group.
New-AzResourceLock
Az cmdlet that creates a CanNotDelete or ReadOnly lock (-LockLevel) on a subscription, resource group or resource.
New-AzRoleDefinition
Az cmdlet that creates a custom role from a JSON file (-InputFile) or a role object.
New-AzSubscriptionDeployment (New-AzDeployment)
Az cmdlet (alias New-AzDeployment) that deploys a template at subscription scope, where it can create resource groups.
New-AzWebApp
Az.Websites cmdlet that creates a web app; with -SourceWebApp it clones an existing app.
New-MgInvitation
Microsoft Graph PowerShell cmdlet that calls the invitations API to invite a B2B guest (or reset redemption), e.g. looped over CSV rows.
New-MgUser
Microsoft Graph PowerShell cmdlet that creates a member (internal) user, never a guest.
Next hop
Network Watcher tool returning the next hop type, IP and route table for a destination; checks routing only.
Next hop type
Where a route sends traffic: Virtual appliance (NVA or firewall private IP), Virtual network gateway, Virtual network, Internet or None.
NGINX
Open-source web server and reverse proxy (installed on VMs, for example with the Custom Script Extension) and the basis of the Ingress NGINX controller for AKS, which has no Azure WAF; upstream Ingress NGINX maintenance ended in March 2026 and Microsoft supports the application routing add-on's NGINX only until November 2026, with Gateway API as the successor.
Node pool
Group of AKS nodes with the same VM size and OS; system pools host CoreDNS and other system pods, user pools host apps, and the cluster autoscaler is set per pool.
Not allowed resource types
Built-in Azure Policy (Deny) that blocks the listed resource types however they're deployed, ARM templates included.
NotActions
Role-definition list subtracted from Actions (e.g. Microsoft.Authorization/* for the Contributor pattern); not a deny, so another role can still grant it.
Notary Project
Cross-industry specifications and tools for signing and verifying OCI artifacts; the replacement for DCT in ACR.
Notary v1
Signing model behind Docker Content Trust, replaced in ACR by Notary Project signing.
Notation
Notary Project CLI that signs and verifies container images, using certificates stored in Azure Key Vault through a plug-in.
NS record
DNS name-server record used for delegation; created automatically at a zone's apex.
NSG flow logs
Logs of allowed and denied traffic through NSGs over time; none can be created since 30 June 2025 and they retire on 30 September 2027, so use VNet flow logs.
O
Object replication
Asynchronous copy of block blobs from a source container to a destination container in another account in any region; needs versioning on both accounts and change feed on the source, and supports GPv2 and premium block blob accounts.
On-premises data gateway
Bridge for Power BI, Logic Apps and Power Apps to on-premises data; not for Data Factory.
Operational backup
Azure Backup for blobs, standardising retention across storage accounts.
OS disk
Managed disk holding the VM's operating system (drive C: on Windows); it persists through redeploy and resize.
Out-of-Order Events
Stream Analytics metric counting events received out of order relative to event time, which are dropped or given an adjusted timestamp by the event ordering policy.
Outbound rules
Standard Load Balancer rules that give backend pool VMs explicit outbound SNAT through the frontend public IPs.
Output Events
Stream Analytics metric counting the events the job writes to its outputs.
OVF (Open Virtualization Format)
VMware VM template format used to deploy Site Recovery appliances on vSphere.
OWASP (Open Web Application Security Project)
Body behind the Top 10 attacks that WAF rules block.
P
PaaS (platform as a service)
Managed platforms such as App Service and Azure SQL Database.
Packet capture
Network Watcher capture of VM traffic with 5-tuple filters and a time limit (default 18,000 s = 5 h), using the Network Watcher Agent extension.
Page blob
Blob of 512-byte pages for random read/write, up to 8 TiB; backs VM disks (VHDs) and can't use Cool or Archive tiers.
Paired region
Region matched with another in the same geography for sequenced updates and prioritised recovery; the usual DR target, but pairing gives no automatic failover.
Parameters (ARM template)
Template section for values supplied or overridden at deployment time, inline or from a parameter file; only parameters, not variables, can change without editing the template.
Partner solutions (Azure Native Integrations)
Diagnostic settings destination that streams logs to third-party monitoring services such as Datadog or Elastic through Azure Native Integrations.
Pass-through Authentication (PTA)
Entra Connect sign-in method whose on-premises agents (outbound 443 only) validate passwords against AD, so no hashes are stored in the cloud.
Password hash sync
Entra Connect sign-in method syncing password hashes, so lockout happens in the cloud.
Peering Service
Optimised ISP-to-Microsoft internet routing; does not give PaaS resources a private IP or make access private.
PEM
Base64 text certificate format that Key Vault can import but App Service can't import directly; convert it to PFX first.
Perf
Log Analytics table of performance counters (for example LogicalDisk Free Megabytes) collected from machines; a log search alert can query it.
Performance Monitor (perfmon)
Windows tool that records performance counters and event traces through Data Collector Sets; no network packet inspection.
Performance tier (Standard / Premium)
Storage account setting fixed at creation: Standard (HDD-backed GPv2) or Premium (SSD) for latency and throughput; the access tier, not performance, is the cost lever for cold data.
Performance-based assessment
Azure Migrate assessment that recommends Azure VM sizes and disk types from collected CPU, RAM, IOPS and throughput history rather than the on-premises allocation.
PFX (PKCS #12)
Password-protected certificate file containing the private key and chain; the only private-certificate format App Service can upload or import from Key Vault.
Placement group
Scale set construct like an implicit availability set with five fault and five update domains; one holds up to 100 VMs, and singlePlacementGroup=false allows up to 1,000.
Platform metrics
Numeric metrics every Azure resource emits automatically at one-minute frequency with no configuration or cost; guest OS counters are not included and need an agent.
Pod CIDR
Kubenet address range (default 10.244.0.0/16) from which each node gets a /24 for its pods.
Point-in-time restore
Restores block blobs in GPv2 to an earlier time; needs soft delete, versioning and change feed.
POP (point of presence)
Edge location where traffic enters or leaves Microsoft's global network.
Power BI
Microsoft reporting service; connects to on-premises data via the on-premises data gateway.
Private DNS zone
Azure DNS zone linked to a VNet holding private A records; queryable only via 168.63.129.16, so on-premises needs a forwarder or DNS Private Resolver.
Private DNS Zone Contributor
Azure role for private DNS zones but not the VNets they link to, so a VNet link also needs virtualNetworks/join/action on the VNet.
Private endpoint
Private IP for a service in your VNet, reachable from peered VNets and from on-premises over ExpressRoute or VPN; public access can then be disabled.
Private subnet
Subnet with default outbound access disabled, so VMs need a NAT gateway, Standard Load Balancer outbound rules or a public IP to reach the internet.
Privileged Identity Management (PIM)
Entra ID P2 just-in-time, time-bound privileged role activation with approval; not for reviewing guest access.
Proximity placement group
Keeps Azure compute physically close for low latency; a VM or scale set can use only a PPG in its own region.
PTR record
Reverse-lookup DNS record mapping an IP to a name; not supported by private zone autoregistration.
Public load balancer
Load balancer with a public frontend IP for internet-facing Layer 4 traffic; Standard needs Standard SKU public IPs.
Publish-AzVMDscConfiguration
Az.Compute cmdlet that packages a DSC script and uploads it to Blob storage for Set-AzVMDscExtension; it applies nothing to a VM.
Q
Queue Storage
Simple storage queues with messages up to 64 KB and no ordering guarantee; AzCopy cannot manage them.
R
RA-GRS (read-access geo-redundant storage)
GRS plus a read-only secondary endpoint usable without failover.
RBAC (role-based access control)
Azure role assignments governing who can manage resources, inherited down scopes; not where or what size resources are.
RDP (Remote Desktop Protocol)
Windows remote-session protocol on port 3389; Bastion carries it over TLS on 443.
Reader
Built-in management-plane role that views resources, letting a user see a storage account in the portal, but grants no data access or keys.
Reader and Data Access
Azure storage role that can view storage accounts and list their access keys (listKeys and ListAccountSas actions) to read data through Shared Key; it can't regenerate keys.
ReadOnly (ReadOnly lock)
Resource lock level that blocks changes and deletion, and blocks moves when on the source or target resource group or subscription.
Recovery point (restore point)
Copy of backed-up data at a point in time; it exists only for backups that have actually run and counts once even when it matches several retention tiers.
Recovery Services vault
Store for Azure Backup and Site Recovery data, supporting soft delete, immutability and MUA; not a cheap archive for existing files.
Redeploy
VM action (Redeploy + reapply blade, az vm redeploy, Set-AzVM -Redeploy) that moves a VM to a new Azure host immediately; configuration and OS/data disks persist but the temporary disk is wiped.
Redundancy conversion (live migration)
Customer- or support-initiated change of a storage account's zone redundancy (for example LRS to ZRS) with no downtime, where the region supports it; GPv1 must be upgraded first.
reference()
ARM template function that returns a resource's runtime state and creates an implicit dependency; it doesn't return an ID for dependsOn.
Regional VNet integration
Outbound App Service access into a VNet (Basic tier up) via a subnet delegated to Microsoft.Web/serverFarms; inbound access needs a private endpoint.
Remediation task
Applies a DeployIfNotExists or Modify assignment to existing non-compliant resources, running as the assignment's managed identity.
Replace existing (restore option) (replace disks)
Azure VM restore option that replaces the original VM's OS and data disks with the recovery point; anything written after the backup is lost but VM configuration such as size is kept.
Reports Reader
Entra role that reads sign-in and audit reports; not on the SSPR two-gate list, so its holders follow the user SSPR policy.
Reset redemption status
Re-invites a guest after their sign-in email changes while keeping the object ID, group memberships and app assignments; the UPN doesn't change.
Resource group (RG)
Container for resources whose location stores only metadata; its location can't change and it can't nest.
Resource Guard
Separate resource holding the permissions MUA requires for critical Recovery Services vault operations; best placed in a separate tenant.
Resource locks
CanNotDelete or ReadOnly locks on management-plane operations; they do not restrict regions or sizes or protect blob data.
Resource logs
Per-resource platform logs of operations inside a resource; they aren't collected or stored until a diagnostic setting routes them somewhere.
Resource Policy Contributor
Azure role that creates and assigns policy and initiative definitions; Contributor lacks policyDefinitions/write.
resourceId()
ARM template function that returns a resource's unique ID; without subscription or resource group arguments it resolves to the resource group being deployed to.
REST (representational state transfer)
HTTP API style used by Azure services, e.g. to start a compliance scan.
RHEL (Red Hat Enterprise Linux)
Linux distribution whose licences Azure Hybrid Benefit covers, unlike Ubuntu.
Role Based Access Control Administrator
Azure role that can create and delete role assignments (roleAssignments/write) without managing resources; like Owner and User Access Administrator, it can assign roles.
Role-assignable group
Entra group created with isAssignableToRole = true (Entra ID P1) that can hold directory roles; assigned membership only, no nesting, and the flag can't be added later.
Route table
Resource holding UDRs, associated with subnets; it affects traffic leaving those subnets (associate it with GatewaySubnet to steer inbound VPN traffic).
Route-based VPN
VPN gateway type using routing tables and any-to-any traffic selectors; required for P2S, gateway transit and BGP, and the only type the portal creates.
Routing preference
Storage account setting that chooses how internet traffic reaches the public endpoint: Microsoft network routing (default) or Internet routing; affects path and egress cost, not access.
RSA (Rivest–Shamir–Adleman)
Asymmetric algorithm; storage customer-managed keys must be RSA or RSA-HSM at 2048, 3072 or 4096 bits.
Runbook
Azure Automation script (PowerShell, Python or graphical) run as a job in an Azure sandbox or on a Hybrid Runbook Worker, for example on a schedule to resize a VM.
S
S2S VPN (site-to-site VPN)
IPsec/IKE tunnel over the internet between an on-premises VPN device and a VNet's VPN gateway, needing a local network gateway and a connection; cheaper than ExpressRoute.
SAS expiration policy (sasPolicy)
Storage account setting that sets a recommended upper limit for SAS validity and logs (or blocks) any SAS that exceeds it; the portal warns at creation.
Scale Out
App Service autoscale rules (Standard and above) adding or removing instances with demand; suited to unpredictable load.
Seamless SSO (Microsoft Entra seamless single sign-on)
Signs domain-joined devices on the corporate network in silently with PHS or PTA (not AD FS); needs autologon.microsoftazuread-sso.com in the Local intranet zone and no inbound ports.
Secure transfer required (supportsHttpsTrafficOnly)
Storage account setting that rejects unencrypted HTTP (and unencrypted SMB) requests; it forces HTTPS only and does not restrict networks.
Security Admin
Azure role for Microsoft Defender for Cloud policy, alerts and recommendations; it can't assign roles or create general policy definitions.
Security Administrator
Entra role for security settings and reports; it can't change SSPR policy or control guest invitations.
Security group
Entra group type for access to resources; members can be users, devices and service principals, with assigned or dynamic membership.
Security questions
SSPR-only method that counts as one method however many are answered, can't be used by admins and is being retired in March 2027.
Security Reader
Azure role with read-only access to Defender for Cloud; it can't assign roles.
Server-side encryption (SSE)
Always-on encryption at rest of managed disks by Azure Storage with platform- or customer-managed keys; temp disks and caches aren't covered and a downloaded VHD isn't encrypted.
Service Bus
Enterprise messaging with queues and topics, transactions, ordering via sessions and dead-lettering.
Service chaining
Routing spoke traffic through a hub NVA or gateway with UDRs over peering; the workaround for spoke-to-spoke traffic and for policy-based gateways that can't do gateway transit.
Service CIDR
Internal range (AKS default 10.0.0.0/16) for Kubernetes ClusterIP addresses, with the cluster DNS service at .10; unreachable from outside the cluster.
Service endpoint
Routes a subnet's traffic to a service's public endpoint over the Azure backbone; free, but not usable from on-premises.
Service plans
The individual apps and services inside a licence, which can be turned on or off per assignment.
Service principal
App-registration identity with a stored secret or certificate that must be rotated and can be copied; suits code outside Azure.
Service SAS
SAS signed with the account key that delegates access to one storage service (for example a container); can reference a stored access policy and stops working when Shared Key is disabled.
Service tag
Microsoft-maintained group of IP prefixes for an Azure service (e.g. Storage, AzureKeyVault, optionally regional) usable as an NSG source or destination.
Session persistence
Load Balancer distribution mode: None (5-tuple hash, default), Client IP (2-tuple) or Client IP and Protocol (3-tuple) affinity.
Set-AzAksCluster
Az.Aks cmdlet that creates or updates an AKS cluster, including -EnableNodeAutoScaling with -NodeMinCount and -NodeMaxCount.
Set-AzVM
Az.Compute cmdlet that redeploys or reapplies a VM, marks it generalized or simulates Spot eviction.
SIEM (security information and event management)
Security log analytics and detection, e.g. Microsoft Sentinel.
SMB (Server Message Block)
Windows file-share protocol for Azure Files, using identity-based authentication.
SMB Multichannel
Azure Files feature that lets an SMB 3.1.1 client open several connections to a share for more throughput and IOPS; premium (SSD, FileStorage) shares only.
SMTP connector (Simple Mail Transfer Protocol)
Logic Apps connector that sends email through your own SMTP server.
SQL injection
Web attack inserting SQL into requests; blocked by the Application Gateway WAF tier, not NSGs.
SRV record
DNS service-location record, e.g. the domain controller records AD DS clients need; Azure-provided DNS can't serve AD's SRV records.
SSPR (self-service password reset)
Lets users reset or unlock their own password using registered methods; scope is None, Selected (one group, nested supported) or All.
Standard general-purpose v2 (StorageV2, GPv2)
Standard account for all storage services with access tiers and every redundancy option.
Standard SKU public IP
Static-only public IP that can be zonal, zone-redundant or IPv6 and is closed to inbound traffic until an NSG allows it; required by Standard Load Balancer, Bastion, Azure Firewall and VPN gateways.
Standard tier (App Service)
Cheapest App Service tier with rules-based autoscale (up to 10 instances), deployment slots and app cloning.
Stopped (deallocated)
VM state after stopping it from Azure, which releases the host and compute billing (a guest OS shutdown doesn't); the VM's cores still count against vCPU quota.
Storage (service tag)
Service tag for Azure Storage's IP ranges (outbound); it covers the service, not a specific account.
Storage account
Top-level Azure Storage resource providing a unique namespace for blob, file, queue and table data; its kind, performance and location are fixed at creation.
Storage Account Contributor
Built-in management-plane role for storage accounts that includes listKeys, so it reaches all data via Shared Key and exceeds least privilege for uploads.
Storage Account Encryption Scope Contributor
Azure storage role limited to managing encryption scopes; no key or data access.
Storage Account Key Operator Service Role
Built-in role that can list and regenerate storage account access keys, and therefore reach all data through Shared Key.
Storage Blob Data Contributor
Built-in data-plane role that reads, writes and deletes containers and blobs; with Reader, the least privilege for portal uploads.
Storage Blob Data Owner
Built-in data-plane role with full access to blob containers and data, including setting POSIX ACLs and blob index tags.
Storage Blob Data Reader
Built-in data-plane role that reads and lists containers and blobs.
Storage firewall
Storage account network rules (VNet, IP, resource instance and trusted-service rules) limiting its public endpoint; with none set, any network can reach it.
Storage Sync Service
Root Azure resource for Azure File Sync that registers servers and holds sync groups; not a target for Import/Export.
Stored access policy
Container-level policy that constrains, and lets you revoke, any service SAS that references it; grants nothing on its own, maximum five per container, not usable with user delegation SAS.
Subnet
Range of a VNet's address space where resources get private IPs; Azure reserves 5 addresses in each (first four and last), so /24 gives 251 usable and the smallest IPv4 subnet, /29, gives 3.
System Center Service Manager (SCSM)
On-premises System Center product for IT service management (incidents, changes, problems) that alerts can raise work items in through ITSMC.
System route
Default route Azure creates for every subnet, e.g. VNet-local traffic and 0.0.0.0/0 to Internet; overridden by UDRs.
System state
Windows Server operating system configuration (registry, boot files, Active Directory and so on) that MARS can back up; restoring it needs Windows Server Backup.
System-assigned managed identity
Identity created and deleted with one resource; ten VMs get ten identities; Azure Policy remediation can use one.
T
T-SQL (Transact-SQL)
Microsoft's SQL dialect for SQL Server and Azure SQL; it isn't used to query Azure Monitor logs or filter event collection.
Table storage
Cheap key-value tables indexed on PartitionKey and RowKey only, with one write region and 1 MB entities.
Tags
Name-value metadata for cost reporting and grouping across resource groups, enforced or inherited by Azure Policy.
targetScope
Bicep setting for a file's deployment scope: resourceGroup (default), subscription, managementGroup or tenant.
TCP (Transmission Control Protocol)
Connection-oriented transport protocol.
Template Specs
Versioned ARM templates stored as Azure resources; with deployment stacks, the Blueprints replacement.
Temporary disk
Non-managed local disk on the VM host (drive D: on Windows by default) for page files and scratch data; its contents can be lost on redeploy, deallocation or maintenance.
Tenant Restrictions
Controls which tenants users can sign in to; not an access review.
Tenant Root Group
Root management group of a tenant; one assignment there covers every subscription.
Test failover (disaster recovery drill)
Site Recovery drill that creates VMs in an isolated network without affecting replication; the VM joins the target subnet with the same name as its source subnet, or the first subnet alphabetically.
Time-based retention (WORM) policy
Immutability policy: data can be read but not modified or deleted for the period.
TLS (Transport Layer Security)
Encryption for network traffic, e.g. Bastion sessions on port 443.
Topology
Network Watcher diagram of a VNet's resources and relationships; shows no traffic or packets.
Traffic Analytics
Analyses NSG or VNet flow logs into traffic patterns and top talkers; does not evaluate rules.
Traffic Manager
Global DNS-based routing (priority, performance, weighted, geographic) for any protocol; never sees HTTP and stores no content.
Traffic Manager Contributor
Azure role limited to Traffic Manager profiles; it can't enable Traffic Analytics.
U
UDR (user-defined route)
Static route-table entry, e.g. next hop virtual network gateway; not dynamic like BGP.
UNC path (Universal Naming Convention)
Windows share path, for Azure Files \\<account>.file.core.windows.net\<share>, used to map a drive over SMB (TCP 445).
union()
ARM template function that merges arrays or objects into one, keeping duplicate values once.
Unmanaged disks
Legacy VM disks stored as page blobs (VHDs) in your own storage account; retired in favour of managed disks.
Update domain (UD)
Group of VMs restarted together during planned maintenance, one at a time; an availability set has up to 20 (default 5).
Update-AzAksNodePool
Az.Aks cmdlet that updates a node pool, for example -EnableAutoScaling with -MinCount and -MaxCount.
UPN (user principal name)
User sign-in name; its suffix must be a verified custom domain.
Usage location (UsageLocation)
Cloud-only user attribute (not synced from AD) that must be set before a licence is assigned directly; historically group-based licensing needed it too, today it falls back to the tenant's location.
Use remote gateways
Spoke-side peering option to send traffic through the peered hub's gateway; affects gateway transit only, not VM-to-VM traffic across the peering.
User Access Administrator
Azure role that grants access but cannot manage resources or write tags.
User Administrator
Entra role that creates and manages users and all groups, resets passwords for limited admins and assigns licences.
User delegation SAS
SAS signed with Entra credentials; most secure SAS, works with Shared Key disabled, maximum 7 days; supported for Blob (including ADLS Gen2), Queue, Table and Azure Files (REST); cannot use a stored access policy.
User response (alert state)
User-set status of a fired alert (New, Acknowledged or Closed) that can be changed at any time independently of the monitor condition.
User-assigned managed identity
Standalone identity attached to many resources, so roles are granted once.
V
Variables (ARM template)
Template section for values fixed in the template and read with variables('name'); they can't be overridden at deployment and change nothing unless a resource references them.
Vaulted backup
Azure Backup tier that copies data offsite into the vault on a daily or weekly schedule and keeps it up to 10 years; for blobs it restores only to a different storage account.
vCPU quota
Per-subscription, per-region limits enforced at two tiers, total regional vCPUs and VM-family vCPUs; a deployment must fit both, counting allocated and deallocated VMs.
Versioning (blob)
Keeps previous blob versions; needed for point-in-time restore but does not purge data.
VHD (virtual hard disk)
Disk image format, e.g. the Hyper-V Azure Migrate appliance download.
Virtual Machine Administrator Login
Azure role that signs in to a VM as administrator via the loginAsAdmin data action; it can't manage the VM.
Virtual Machine Contributor
Azure role for managing VMs but not the network or storage they connect to.
Virtual Machine User Login
Azure role that signs in to a VM as a regular user via the login data action.
Virtual machines (VMs)
IaaS compute with full OS access; needed for COM components and lift-and-shift.
Virtual network flow logs (VNet flow logs)
Network Watcher logs of flow-level (not packet) traffic enabled on the VNet, written to a storage account and used by Traffic Analytics; replace NSG flow logs.
Virtual network gateway
Azure gateway resource in GatewaySubnet, either VPN or ExpressRoute type; as a UDR next hop it sends traffic to on-premises.
Virtual network link
Link between a private DNS zone and a VNet, needed for resolution (resolution-only link) or registration (autoregistration on); peering alone gives neither.
Virtual network peering (VNet peering)
Private, low-latency connection between VNets in the same or different regions over the Microsoft backbone; on its own it gives App Service no VNet access.
Virtual network rule (VNet rule)
Storage firewall rule that admits a specific subnet, which must have the Microsoft.Storage service endpoint enabled; the endpoint alone grants nothing.
Virtual WAN
Hub-based networking; Basic supports site-to-site VPN only, Standard adds ExpressRoute, point-to-site and transit.
VirtualNetwork (service tag)
Service tag covering the VNet address space, peered VNets and connected on-premises ranges.
VM extensions
Small post-deployment apps (resource type Microsoft.Compute/virtualMachines/extensions) run by the Azure VM Agent to install software or configure a VM; the VM must be running.
VM insights
VM performance monitoring plus a dependency Map (Map and Dependency agent deprecated, retiring 30 June 2028); does not audit changes or evaluate NSG rules.
VMSnapshot extension (VM backup extension)
VM extension that Azure Backup installs automatically on first backup to coordinate application- or file-consistent snapshots of an Azure VM; it replaces the need for the MARS agent.
VPN (virtual private network)
Encrypted tunnel, e.g. site-to-site to a VPN gateway in GatewaySubnet.
VPN gateway
Virtual network gateway of type VPN in GatewaySubnet for S2S, P2S and VNet-to-VNet IPsec tunnels; its Standard static public IP is fixed at creation and can't be swapped.
W
WAImportExport (WAImportExport.exe)
Command-line tool that prepares drives for Azure Import/Export: BitLocker-encrypts them, copies data and writes the journal file.
Web App for Containers
App Service hosting container images with autoscale, ACR continuous deployment and Easy Auth.
Web Application Firewall (WAF)
Layer-7 protection against OWASP Top 10 attacks such as SQL injection and XSS, on Front Door or Application Gateway.
Webhook
Action group action that calls an HTTP endpoint with the alert payload (limit 1,500 calls a minute per subscription).
Website Contributor
Azure role that manages web apps (not their plans), letting Entra identities publish without deployment credentials.
Windows Azure Diagnostics extension (WAD)
Legacy VM extension (Azure Diagnostics extension for Windows) that collected guest OS data to storage; it was retired on 31 March 2026 and AMA with DCRs replaces it.
Windows Server Backup
Built-in Windows Server feature used to apply a MARS system state recovery to the server; not needed for file and folder restores.
WMI (Windows Management Instrumentation)
Windows management interface for reading and changing system information, queried with WQL; not an Azure Monitor collection method.
Workbook (Azure Workbooks)
Azure Monitor interactive report combining logs, metrics and text; not a prerequisite for Traffic Analytics.
Workload profiles environment
Default (v2) Container Apps environment type with Consumption and Dedicated profiles, UDRs and NAT Gateway; a custom VNet subnet must be at least /27 and delegated to Microsoft.App/environments.
WQL (WMI Query Language)
SQL-like query language for Windows Management Instrumentation; Azure Monitor doesn't use it to filter event collection.
Write Accelerator
M-series-only capability for Premium SSD disks that lowers write latency for database logs; ADE isn't supported on disks that use it.
X
XML (Extensible Markup Language)
Text data format, e.g. message bodies.
XPath (XML Path Language)
Query syntax used in a DCR's xPathQueries (for example Security!*[System[(EventID=4648)]]) to choose which Windows events AMA collects; up to 20 expressions per DCR.
Z
ZRS (zone-redundant storage)
Three copies across availability zones in one region; no secondary region.