A
ABFS (Azure Blob File System driver)
HDFS-compatible driver that lets Hadoop, Spark and HDInsight use ADLS Gen2.
Accelerated Networking
Azure's SR-IOV feature for lower VM network latency; RDMA on HPC sizes goes lower still.
Access policies (Key Vault)
The legacy Key Vault permission model; the Azure RBAC permission model is the current one.
Access reviews
Entra ID Governance feature for recurring attestation of guests, app users or group members, with self-review and auto-removal of non-responders; not PIM, which covers privileged roles only.
ACL (access control list)
Permission list on a file or folder, e.g. POSIX-style ACLs in ADLS Gen2 or NTFS ACLs on Azure Files; ACLs carry no attribute conditions.
ACR geo-replication
Premium-SKU Azure Container Registry feature replicating images to several regions under one registry name.
Action groups
Azure Monitor notification targets; they deliver alerts but do not detect problems themselves.
Active geo-replication
Per-database Azure SQL Database replication to up to four readable secondaries with manual failover; not available for SQL Managed Instance.
Activity log
Subscription log of management-plane operations (deployments, Policy events), kept 90 days; it records no data-plane access such as Key Vault reads.
AD (Active Directory)
Windows Server directory service (AD DS); on-premises forests sync to Entra ID through Entra Connect.
AD DS (Active Directory Domain Services)
The on-premises Windows domain service with domain controllers; see also Microsoft Entra Domain Services for the managed version.
AD FS (Active Directory Federation Services)
On-premises federation server; Web Application Proxy is its older publishing role, not Entra Application Proxy.
ADLS Gen2 (Azure Data Lake Storage Gen2)
Standard GPv2 storage with hierarchical namespace enabled, giving real directories and POSIX-style ACLs for analytics.
Administrative units
Entra containers that scope directory administration; not Azure Policy scopes or cost groupings.
AES (Advanced Encryption Standard)
Symmetric cipher; AES-256 is the TDE data encryption key that the RSA TDE protector wraps.
AKS (Azure Kubernetes Service)
Managed Kubernetes with full cluster and node-pool control; autoscales with HPA and the cluster autoscaler; has no built-in user sign-in.
Allowed locations
Azure Policy definition that denies resources outside listed regions; the right control for restricting where resources are deployed.
Allowed locations for resource groups
Azure Policy definition restricting only resource-group locations, which does not stop their resources being created in other regions.
Allowed virtual machine size SKUs
Azure Policy definition restricting which VM sizes can be deployed.
Always Encrypted
SQL column encryption performed on the client with keys the engine never sees, so DBAs and cloud admins see only ciphertext.
Always On availability group (AG)
SQL Server HA with synchronous replicas on separate VMs, needing no shared storage; a second running SQL VM makes it the most expensive DR option.
AMQP (Advanced Message Queuing Protocol)
Messaging protocol used by Event Hubs and Service Bus alongside HTTPS.
Apache Avro
Binary row format that Event Hubs Capture always writes; not Parquet or JSON.
Apache Spark pool
Synapse pool for Spark workloads; creates and updates Delta Lake, streams from the Cosmos DB change feed and runs ML.
API (application programming interface)
Programmatic interface a client calls, e.g. a web API protected by tokens.
API Management (APIM)
API gateway applying policies such as validate-jwt, ip-filter, rate limits and quotas once for all APIs; Premium tier for production VNet injection.
API permissions
Entra app-registration blade where a client requests delegated or application permissions, which then appear as token claims after consent.
API-driven inbound provisioning
Entra provisioning where a script posts SCIM bulk requests from any HR source (e.g. a CSV); inbound, unlike the outbound ECMA connector.
APM (application performance monitoring)
Request, failure, dependency and exception telemetry; the core function of Application Insights.
App registration
Entra ID object defining an application's identity, permissions and supported account types; used for OpenID Connect sign-in and multi-tenant apps.
App roles
Roles an API defines on its app registration; for app-to-app calls they arrive as the roles claim in client-credentials tokens.
App Service
Managed PaaS web hosting (web apps, Web App for Containers) in a sandbox with no OS access; autoscale and slots from Standard.
App Service Authentication (Easy Auth)
Built-in App Service sign-in with Entra ID requiring no code.
App Service Environment (ASE)
Single-tenant, network-isolated App Service (Isolated plan); far dearer, so only for isolation requirements.
Append (Policy effect)
Adds fields at create or update time only; cannot fix existing resources.
Application Gateway
Regional layer-7 load balancer with SSL offload, URL routing, cookie affinity and optional WAF; plays no part in Entra SSO to on-premises apps.
Application Gateway for Containers
Newer AKS ingress option built on Application Gateway, an alternative to AGIC.
Application Gateway Ingress Controller (AGIC)
AKS add-on that programs an Application Gateway WAF v2 from Kubernetes Ingress resources.
Application Insights
Azure Monitor APM service for app telemetry, Application Map, availability tests and usage analytics; workspace-based instances store data in Log Analytics.
Application permissions
App-only Entra permissions acting with no signed-in user, so they cover every user's data; not least privilege for per-user access.
Archive (tier)
Offline blob tier with the lowest storage and highest access price; blobs must be rehydrated (up to 15 hours) before reading.
ARM template
Declarative JSON IaC file for Azure deployments; fire-and-forget, with no live link like Blueprints.
AS-path prepending (autonomous system path)
BGP technique that lengthens a route's AS path so the nearer site is preferred.
AuditEvent
Key Vault resource-log category recording data-plane get, set and delete operations with caller, IP and result.
Auditing (Azure SQL)
Writes database audit logs to a storage account, Log Analytics or Event Hubs; the storage account may be in another region.
Authorisation code (grant)
OAuth flow for web and native apps where a user signs in with delegated permissions.
Authorisation levels (Azure Functions)
HTTP-trigger keys: Anonymous (no key), Function (function or host key), Admin (master key).
Auto-failover group (failover group)
Azure SQL geo-replication of a whole Managed Instance or group of databases with automatic failover and stable listeners; the only regional DR option for MI.
Auto-instrumentation
Enabling Application Insights from the App Service blade with no code change.
Automated Backup (SQL IaaS Agent)
SQL Server on Azure VM backups to a storage account; LRS is cheapest.
Automatic backups (Azure SQL)
Built-in backups giving point-in-time restore for 1–35 days; LTR is needed for longer.
Autoscale scaling plan
Built-in Azure Virtual Desktop feature that starts, stops and scales session hosts.
Availability set
VMs spread over fault and update domains (up to 20) in one datacentre; 99.95% SLA; no autoscale or zone spread.
Availability tests
Application Insights synthetic monitoring (standard, URL ping or custom TrackAvailability tests).
Availability zones
Physically separate datacentres within a region; VMs across two or more give a 99.99% SLA.
AzCopy
Command-line copy tool for storage data; cannot manage queues or copy running VMs.
Azure ABAC (attribute-based access control)
Role assignment conditions layered on RBAC, e.g. by blob index tag; supported for blobs (including ADLS Gen2) and queues, not Files or Tables.
Azure AD B2C
Customer identity service; APIM validate-jwt can validate its tokens through its OpenID configuration.
Azure Advisor
Best-practice recommendations (cost, performance, reliability, security) for existing Azure resources; cannot estimate pre-migration cost or evaluate NSG rules.
Azure Analysis Services
Tabular OLAP model serving many Power BI and Excel users; modern equivalent is Power BI Premium semantic models.
Azure Arc
Manages non-Azure servers in place through the Azure Connected Machine agent; not a migration tool.
Azure Automation
Runbook service for imperative scripts, e.g. AVD scaling; not IaC and cannot revoke access in reviews.
Azure Backup
Backup service storing recovery points in a Recovery Services vault, including long-term retention; not DR failover like Site Recovery.
Azure Backup security PIN
PIN protecting only hybrid (MARS, DPM/MABS) operations; any vault admin can regenerate it, so it does not protect Azure backups.
Azure Bastion
Brokers RDP and SSH over TLS on port 443 from the portal, so VMs need no public IPs; unlike JIT, which opens 3389/22.
Azure Batch
Schedules and autoscales compute node pools for parallel, HPC and render jobs, with multi-instance tasks for MPI.
Azure Blueprints
Deprecated (retiring July 2026) packaging of policies, roles and templates with a live link to assignments; assignments target one subscription.
Azure Cache for Redis (Azure Redis Cache)
In-memory cache next to the app for session state and cache-aside query results.
Azure CLI (CLI)
Cross-platform command line, e.g. az policy state trigger-scan or az storage queue.
Azure CNI Overlay
AKS network plugin giving pods a private overlay CIDR so only nodes use VNet IPs; supports Windows nodes.
Azure Connected Machine agent
The Azure Arc agent for non-Azure servers; it does not collect VM logs.
Azure Container Apps
Serverless, KEDA-based container hosting with autoscale and zone redundancy and no cluster admin.
Azure Container Instances (ACI)
Per-second-billed container groups with no cluster; no autoscale or zone spread.
Azure Container Registry (ACR)
Private container image registry with geo-replication, retention and ACR Tasks; webhooks drive continuous deployment.
Azure Content Delivery Network (CDN)
Caches static web content at edge points of presence near users.
Azure Cosmos DB Data Migration Tool
Tool for migrating data (e.g. from SQL Server) into Cosmos DB.
Azure CycleCloud
Provisions and manages HPC clusters for third-party schedulers such as Slurm, PBS Pro and LSF.
Azure Data Explorer
Petabyte-scale interactive analytics for logs and telemetry using KQL; successor to Time Series Insights.
Azure Data Factory
Managed ETL/ELT with pipelines, copy activities, triggers, mapping data flows and integration runtimes; batch, not per-transaction routing.
Azure Data Lake Analytics
Retired (February 2024) U-SQL analytics service that stored no data.
Azure Database for PostgreSQL flexible server
Managed PostgreSQL that scales up and adds read replicas; no multi-master write scale-out.
Azure Database Migration Service (DMS)
Migrates many databases or whole instances to SQL Managed Instance, offline or online.
Azure DNS Private Resolver
Managed DNS forwarding in a VNet so on-premises clients can resolve private DNS zones.
Azure Event Hubs
High-volume telemetry ingestion over HTTPS/AMQP; a destination for diagnostic settings.
Azure File Sync
Agent on on-premises Windows Server that caches an Azure file share locally with cloud tiering and two-way sync.
Azure Files
Managed SMB/NFS file shares; no Archive tier and one account-wide encryption key.
Azure Firewall
Managed stateful network firewall, deployable in Virtual WAN hubs and managed by Firewall Manager.
Azure Firewall Manager
Central management of Azure Firewall policies with parent-child inheritance across regions and subscriptions.
Azure Front Door
Global layer-7 entry point with anycast failover, TLS termination, URL routing and WAF with rate limiting.
Azure Functions
Serverless event-driven code (Consumption, Premium or Dedicated plan) run by triggers such as timer, HTTP, Blob or Event Grid.
Azure geography
A set of regions (e.g. United States) within which a Key Vault backup can be restored.
Azure Hybrid Benefit
Reuse of Windows Server, SQL Server, RHEL or SUSE licences with Software Assurance; not Ubuntu, and not the DTU model.
Azure Instance Metadata Service (IMDS)
Non-routable VM endpoint 169.254.169.254 that issues managed-identity tokens; not the login.microsoftonline.com endpoint.
Azure Key Vault
Store for secrets, keys and certificates; replicates to the paired region and is read-only during failover.
Azure Lighthouse
Delegates resources from other tenants to a managing tenant; not a migration or move tool.
Azure Load Balancer
Regional layer-4 load balancer (Standard is zone-redundant); no WAF, TLS termination or URL routing.
Azure Migrate
Discovery, assessment and server migration of on-premises VMs via an on-premises appliance; the project lives in the target subscription.
Azure Migrate project
The Azure resource (in the target subscription) that holds discovery and assessment data; not the on-premises appliance.
Azure Monitor agent (AMA)
Current agent collecting guest-OS logs according to DCRs; replaced the Log Analytics agent (MMA).
Azure Monitor Private Link Scope (AMPLS)
Connects Azure Monitor resources to private endpoints; use one per shared DNS, with peered VNets sharing an endpoint.
Azure Monitor workspace
Store for Prometheus metrics only; logs go to a Log Analytics workspace.
Azure Pipelines
Azure DevOps CI/CD with environments, approvals and checks for IaC deployments.
Azure Policy
Enforces and audits resource configuration (location, SKU, tags) through definitions and assignments; not a deployment tool or access control.
Azure RBAC permission model (Key Vault)
Key Vault access granted through role assignments such as Key Vault Secrets User; replaces access policies.
Azure Relay
Service the on-premises data gateway connects out to, so no VPN or inbound ports are needed.
Azure Reservations
One- or three-year commitments for discounts, e.g. on dedicated hosts or SQL vCores.
Azure Resource Mover
Moves existing Azure VMs, disks and NICs between regions or resource groups, validating dependencies.
Azure Service Fabric
Microservices platform on-premises and in Azure with per-service upgrades, health-based repair and stateful services.
Azure Site Recovery (ASR)
Replicates VMs to another site or region for DR with RTO in minutes and recovery points kept at most 15 days; does not raise the SLA.
Azure SQL Database
PaaS single database or elastic pool; up to 4 TB (128 TB Hyperscale); no cross-database queries, SQL Agent or CLR.
Azure SQL Managed Instance (MI)
PaaS SQL Server instance with near-full compatibility (SQL Agent, CLR, cross-database queries); regional DR only via auto-failover groups.
Azure SQL Migration extension
Azure Data Studio extension using DMS for online or offline migration to SQL Managed Instance or SQL Database; moves only databases.
Azure Stream Analytics
Serverless SQL-like stream processing with windows and built-in anomaly detection.
Azure Synapse Link for Cosmos DB
Queries the Cosmos DB analytical column store with no ETL and no RUs from the transactional store.
Azure Virtual Desktop (Windows Virtual Desktop)
Hosted Windows desktops; host pools scale with Automation runbooks or an Autoscale scaling plan.
Azure Virtual Network Manager
Manages VNets across tenants with static membership; dynamic membership via Azure Policy cannot cross tenants.
Azure VM backup policy
Azure Backup schedule (daily or weekly; hourly with Enhanced policy) plus daily, weekly, monthly and yearly retention tiers.
Azure-SSIS IR
Data Factory integration runtime that runs SSIS packages, with SSISDB in SQL Database or MI.
B
B2B collaboration
Entra guest invitations for each user; no automatic provisioning, approvals or expirations.
Backup and restore (Key Vault)
Encrypted backup blob restorable only into a vault in the same subscription and Azure geography.
Backup MUA Operator
Role on a Resource Guard needed to perform MUA-protected backup operations.
BareMetal Infrastructure
Dedicated servers (e.g. SAP HANA Large Instances) connected via ExpressRoute.
Basic (Log Analytics table plan)
Cheap-ingestion plan with per-GB query charges, reduced KQL and no log alerts.
BGP (Border Gateway Protocol)
Dynamic routing protocol used over ExpressRoute and VPN; the only way routes are exchanged for forced tunnelling.
Blob storage
Object storage for unstructured data such as video and images; block blobs up to about 190.7 TiB.
BlockBlobStorage
Premium SSD account for block and append blobs with lowest latency; LRS or ZRS only, no access tiers.
Bounded staleness
Cosmos DB consistency level, the strongest with a multi-region write-latency SLA.
Business Critical
VCore SQL tier with Always On replicas on local SSD, lowest latency and no-data-loss zone-redundant failover; no serverless option.
C
Capacity reservation groups
Reserve VM capacity; dearer than Spot Priority Mix for a guaranteed base.
CD (continuous deployment)
Automatic deployment on change, e.g. an ACR webhook redeploying Web App for Containers on image push.
Change Analysis
Agentless record of Azure resource property changes, now surfaced as Resource Graph change history.
Change feed
Ordered log of blob changes; needed for point-in-time restore and retains rather than purges data.
Change Tracking and Inventory
AMA-based tracking of guest-OS registry, file, software and service changes stored in Log Analytics.
CIDR (Classless Inter-Domain Routing)
IP address range notation, e.g. an AKS overlay pod range.
CIEM (cloud infrastructure entitlement management)
Multicloud permission analysis, provided by Entra Permissions Management.
Client credentials (grant)
OAuth app-only flow used by daemons, app-to-app calls and managed identities; a grant type, not a way to pass custom data.
Cloud tiering
Azure File Sync feature keeping hot files local and tiering the rest to the Azure file share.
CLR (common language runtime)
.NET code in SQL Server; supported by Managed Instance and VMs, not SQL Database.
Cold (tier)
Online blob tier cheaper to store than Cool but dearer to access; still immediately accessible.
COM (Component Object Model)
Windows component technology; COM components need VMs because App Service cannot register them.
Commitment tiers
Log Analytics workspace pricing from 100 GB/day that saves about 15–30% while ingesting everything.
Conditional Access
Entra ID P1 policy engine that grants access with controls such as MFA or compliant device, based on conditions like named locations or risk.
Connected organization
Partner directory registered in entitlement management so access-package policies can target its users.
Consumption (Functions plan)
Event-driven serverless plan with 10-minute maximum runs and no VNet integration.
Container Apps environments
Isolation boundary (own VNet) for Container Apps, with Consumption and Dedicated workload profiles.
COPY statement (COPY INTO)
Recommended fastest Synapse dedicated-pool loader, needing no external tables or file formats.
Cosmos DB (Azure Cosmos DB)
Globally distributed NoSQL database with multi-region writes, automatic indexing and under 10 ms latency.
Cosmos DB Built-in Data Reader
Native Cosmos DB data-plane RBAC role used with Entra ID tokens.
Cosmos DB for Table
Cosmos DB API compatible with Table storage, so migration is a connection-string change.
Cost Management
Azure cost analysis, budgets and tag-based reports for resources already in Azure; cannot estimate pre-migration costs.
Cost reporting
Tagging resources and grouping Cost Management reports and budgets by tag across subscriptions.
CQL (Cassandra Query Language)
Query language of the Cosmos DB for Apache Cassandra API.
Credential passthrough
Databricks per-user ADLS access with the user's own identity; needs the Premium SKU.
Cross-tenant access settings
Entra settings controlling inbound and outbound B2B trust with other tenants.
Cross-tenant synchronization
Configured in the source tenant to create, update and remove its users automatically in a target tenant.
CSV (comma-separated values)
Flat text export format, e.g. an HR file for API-driven provisioning.
Custom domain
Verified domain in an Entra tenant; each on-premises UPN suffix used for sign-in must be one.
Customer-managed account failover
Promotes a geo-redundant storage secondary to primary, keeping DNS names; the account is LRS afterwards until reconfigured.
D
DACPAC
SQL package of a database schema, used to create a target schema before migration.
Data Box
Offline bulk transfer appliance; Data Box Gateway is a one-way upload, neither provides sync.
Data collection endpoint (DCE)
Endpoint receiving Logs Ingestion API data; can be added to AMPLS for private ingestion.
Data collection rule (DCR)
Defines what AMA or the Logs Ingestion API collects (e.g. XPath event filters) and where it goes.
Data Discovery & Classification
Labels sensitive SQL columns; does not encrypt or mask them.
Data Migration Assistant (DMA)
Assesses SQL Server and migrates schema and data to Azure SQL Database.
Data Path Availability
Standard Load Balancer VIP availability metric; the first metric to check when a VM behind the load balancer is reported unavailable.
Databricks (Azure Databricks)
Spark analytics platform processing data in notebooks; Premium SKU needed for credential passthrough.
Databricks service principal
Service principal used by code outside Azure to call Databricks, unlike personal tokens tied to users.
Dataverse
Power Platform data store that can link to Microsoft Fabric through a shortcut.
DBFS (Databricks File System)
Databricks file-system layer over storage such as ADLS Gen2.
DC (domain controller)
Server hosting AD DS; keep DCs on-premises and in Azure for sync and sign-in resilience.
Dedicated (Functions plan)
Functions on an App Service plan with unlimited run time and VNet integration from Basic.
Dedicated host groups
Groups of physical hosts in one zone; surviving two zone losses needs three groups.
Dedicated SQL pool (formerly SQL Data Warehouse)
Synapse MPP warehouse with 60 distributions and at most 128 concurrent queries.
DefaultAzureCredential
Azure SDK credential that, among other sources, wraps the IMDS managed-identity call.
Defender for Identity (Microsoft Defender for Identity)
Monitors on-premises AD for threats; not an access-review or governance tool.
DEK (data encryption key)
Symmetric AES key that encrypts data and is wrapped by a protector such as the TDE protector.
Delegated permissions
Entra permissions letting an app act as the signed-in user on only that user's data.
Delta Lake
Transactional table format on the lake; Spark pools write it, serverless SQL pools only read it.
DeployIfNotExists (Policy effect)
Deploys an ARM template when a related resource is missing; fixes existing resources only through a remediation task.
Deployment slots
App Service staging slots (Standard and above) swapped into production with warm-up and rollback.
Deployment stacks
Manage a group of resources deployed together; with Template Specs, the replacement for Blueprints.
Diagnostic setting
Routes a resource's logs and metrics to storage, Log Analytics, Event Hubs or a partner; up to five per resource.
DIP (direct IP)
Back-end instance address; Health Probe Status measures DIP availability.
Direct Lake
Fabric semantic-model mode reading Delta/Parquet from OneLake into VertiPaq at near-import speed with no copy.
Distributed availability group
AG spanning two separately clustered AGs, allowing Windows to Linux SQL Server migration.
Distributed network name (DNN)
SQL Server on Azure VM listener that needs no Azure Load Balancer and fails over faster than VNN.
DNS (Domain Name System)
Name resolution; private endpoints rely on private DNS zones reached through 168.63.129.16.
DPM (Data Protection Manager)
System Center backup server; with MABS, a hybrid backup covered by the security PIN.
DR (disaster recovery)
Recovering service in another site or region, measured by RTO and RPO; not retention or the uptime SLA.
DS series
General-purpose VM sizes supporting Premium Storage and Accelerated Networking cheaply; right for SQL Server rather than NC.
DSC (Desired State Configuration)
PowerShell configuration management applied to VMs; does not create VMs.
DTU (Database Transaction Unit)
Blended compute measure in the SQL DTU model; see DTU model.
DTU model
Azure SQL purchasing model (Basic, Standard, Premium) with licence included; no Hybrid Benefit or reserved capacity.
Dynamic data masking
Masks query output (e.g. last four digits) for non-privileged users without changing stored data; UNMASK bypasses it.
Dynamic groups
Entra groups with rule-based membership from user attributes; not an access review.
E
E5 (Microsoft 365 E5)
Licence bundle including Entra ID P2 and ID Governance features.
ECMA connector
Entra outbound provisioning to on-premises LDAP or SQL apps; not for inbound HR data.
EDI (electronic data interchange)
B2B document exchange handled by Logic Apps integration accounts.
Elastic pool
SQL databases sharing eDTUs or vCores; best for many databases with staggered peaks.
Elastic queries
Cross-database queries in Azure SQL Database needing code changes; MI supports three-part names natively.
ELT (extract, load, transform)
Load raw data first and transform it in the target; see also ETL.
Encryption scopes
Per-container or per-blob encryption keys on top of account encryption; blob only.
Enterprise application
Entra service-principal object where users are assigned and SSO and Conditional Access are applied.
Entitlement management
Entra ID Governance access packages with approvals, expirations and connected organizations.
Entra ID P1
Entra licence needed for Conditional Access and Password Protection for on-premises AD.
Entra ID Protection (Identity Protection)
Entra ID P2 service evaluating user and sign-in risk and running the MFA registration policy.
ETL (extract, transform, load)
Transform data before loading it; Data Factory provides managed ETL/ELT.
Event Grid
Event router that pushes events to handlers; not a store and not a diagnostic-setting destination for Entra.
Event Grid domain
Event Grid resource routing many event types or topics to different subscribers.
Event Hubs Capture
Writes Event Hubs streams to Blob or ADLS Gen2 in Avro on a time or size window.
ExpressRoute
Private dedicated connection from on-premises to Azure via private or Microsoft peering.
ExpressRoute FastPath
Sends traffic straight to VMs, bypassing the gateway, for minimum latency.
F
Failover cluster instance (FCI)
SQL Server HA needing shared storage such as a premium file share.
FIFO (first in, first out)
Guaranteed ordering, provided by Service Bus message sessions, not storage queues.
Forced tunnelling
Sending all internet-bound Azure traffic on-premises by advertising 0.0.0.0/0 over BGP.
G
Gateway Load Balancer
Chains transparent third-party NVAs inline to a Standard Load Balancer frontend via VXLAN.
GatewaySubnet
Dedicated subnet for VPN or ExpressRoute gateways; /27 recommended minimum.
General Purpose
SQL tier with one compute node and remote storage; higher latency and no synchronous replica.
Geographic (routing)
Traffic Manager method sending users to endpoints by their location.
Get (secret permission)
Reads one Key Vault secret; enough for App Service Key Vault references.
GRS (geo-redundant storage)
Six copies, LRS in the primary and paired region; secondary readable only after failover.
GZRS / RA-GZRS (geo-zone-redundant storage)
ZRS primary plus LRS secondary region; RA- adds a readable secondary.
H
HA (high availability)
Keeping a service running through local failures, e.g. zone-redundant replicas.
HDFS (Hadoop Distributed File System)
Hadoop file system; ABFS gives ADLS Gen2 HDFS compatibility.
Health Probe Status
Standard Load Balancer DIP-availability metric showing the share of healthy back ends.
Hierarchical namespace (HNS)
Storage setting that turns GPv2 into ADLS Gen2 with directories and ACLs.
HPC (high-performance computing)
Large parallel workloads, served by Azure Batch or CycleCloud and RDMA VM sizes.
HSM (hardware security module)
Tamper-resistant key hardware, e.g. RSA-HSM keys or Managed HSM.
HSRP (Hot Standby Router Protocol)
LAN gateway-redundancy protocol, not used for Azure routing.
HTTP application routing
Retired AKS ingress add-on with no Azure WAF.
Hyperscale
SQL Database tier up to 128 TB with rapid scaling and load-balanced read replicas.
I
IaaS (infrastructure as a service)
VMs you manage down to the OS, e.g. SQL Server on Azure VMs.
IaC (infrastructure as code)
Declarative deployment files such as ARM templates and Bicep.
IAM (identity and access management)
Portal Access control (IAM) blade for RBAC role assignments.
Identity-based authentication (Azure Files)
SMB access with Entra Kerberos, AD DS or Entra Domain Services identities; SAS does not apply to SMB.
Immutable Blob storage
WORM protection for blobs via time-based retention or legal hold.
Immutable vaults
Recovery Services vault setting that stops recovery points being deleted early.
Import/Export
One-time shipping of disks to load or export Azure storage; not ongoing ingestion.
Inbound HR provisioning
Entra provisioning of users from HR systems (Workday gallery apps or API-driven) into AD or Entra ID.
Integration runtime (IR)
Data Factory compute: Azure IR, self-hosted IR or Azure-SSIS IR.
Intune (Microsoft Endpoint Manager)
Device management whose compliance policies back the Conditional Access compliant-device grant.
IO (input/output)
Storage reads and writes; Premium Azure Files gives single-digit-millisecond IO. See also IOPS.
IoT Hub
Device-to-cloud telemetry ingestion with device management, an alternative to Event Hubs.
IP (Internet Protocol)
Network addressing; private endpoints give services a private IP.
IP flow verify
Network Watcher tool that says whether a packet is allowed or denied and by which NSG rule.
ISE (integration service environment)
Dedicated, expensive Logic Apps environment.
ISO 27001
Information-security standard reported on the regulatory compliance dashboard.
IWA (Integrated Windows Authentication)
Kerberos/NTLM sign-in; published through Application Proxy with KCD.
J
JBoss EAP (Enterprise Application Platform)
Java runtime available on App Service with Java SE and Tomcat.
JIT (just-in-time)
Time-limited access, e.g. JIT VM access opening ports 3389/22, or PIM role activation.
JSON (JavaScript Object Notation)
Text data format for ARM templates and Cosmos DB documents.
K
KEDA (Kubernetes Event-driven Autoscaling)
Scales AKS pods from event-source metrics via HPA; the basis of Container Apps.
Kerberos
Ticket-based Windows authentication used by Entra Domain Services, Application Proxy KCD and Azure Files.
Kerberos Constrained Delegation (KCD)
Lets Application Proxy obtain Kerberos tickets for SSO to IWA apps.
Key (Key Vault)
Cryptographic key that Key Vault uses on your behalf and never releases.
Key Vault references
@Microsoft.KeyVault(...) app settings that App Service resolves with no code change.
Key Vault Secrets User
Role granting secret Get for the Key Vault RBAC permission model.
KQL (Kusto Query Language)
Query language of Log Analytics and Azure Data Explorer, used for log alerts.
L
LDAP (Lightweight Directory Access Protocol)
Directory protocol offered by Entra Domain Services; Application Proxy does not answer it.
Log alert
Azure Monitor alert on a KQL query in Log Analytics; cannot run on logs in storage or Event Hubs.
Log Analytics agent (MMA)
Legacy agent retired August 2024; replaced by AMA with DCRs.
Log Analytics workspace
Store for logs queried with KQL; used by Sentinel, VM insights and workspace-based Application Insights.
Logic Apps
Low-code workflows with triggers and connectors, e.g. approval emails; cannot run custom C#.
Logic Apps integration accounts
B2B/EDI artefact stores for Logic Apps; not a migration tool.
Long-term retention (LTR)
Azure SQL weekly, monthly and yearly backups kept up to 10 years.
M
MABS (Microsoft Azure Backup Server)
On-premises backup server; does not give MUA protection.
Managed identity
Entra identity for Azure resources with no stored secret; system-assigned or user-assigned.
Managed private endpoints
Synapse private endpoints from its managed VNet, approved on the target (e.g. Cosmos DB).
Managed virtual network
Synapse workspace VNet chosen only at creation, keeping traffic on the backbone.
Management groups
Containers above subscriptions for policy and RBAC inheritance; they never span tenants.
Mapping data flows
Visual Spark-based transformations in Data Factory and Synapse pipelines.
Message sessions
Service Bus feature giving FIFO for messages with the same session ID.
MFA (multifactor authentication)
A second sign-in factor, required through Conditional Access grants.
Microsoft 365 (Office 365)
SaaS productivity suite using one Entra tenant; Azure RBAC does not govern its data.
Microsoft Azure Management
Conditional Access cloud app covering the portal and ARM, used to require MFA before Bastion.
Microsoft Azure Recovery Services agent (MARS)
Agent backing up on-premises Windows files, folders and system state to a vault; on-premises only.
Microsoft Defender for Cloud (formerly Azure Security Center)
Security posture service with a regulatory compliance dashboard that reports but blocks nothing.
Microsoft Defender for SQL (Advanced Threat Protection)
SQL threat detection; not encryption or masking.
Microsoft Entra application proxy (Azure AD Application Proxy)
Publishes on-premises web apps via an outbound-only connector, with no VPN or inbound ports.
Microsoft Entra B2B (Azure AD B2B)
Guest accounts that authenticate against their home tenant.
Microsoft Entra Connect (Azure AD Connect)
Syncs on-premises AD identities to Entra ID.
Microsoft Entra Connect Health (Azure AD Connect Health)
Monitors Connect sync, AD FS and AD DS and emails alerts.
Microsoft Entra Connect provisioning agent
On-premises agent through which cloud provisioning apps write users to AD.
Microsoft Entra Domain Services (Azure AD DS)
Managed Azure domain offering LDAP, Kerberos and NTLM, populated from Entra ID with no on-premises connectivity.
Microsoft Entra ID (Azure AD)
Microsoft's cloud identity service and tenant for Azure and Microsoft 365.
Microsoft Entra ID Governance
Licence and feature set for access reviews, entitlement management and lifecycle workflows.
Microsoft Fabric
SaaS analytics platform built on OneLake, with shortcuts and Direct Lake.
Microsoft Graph
API for Microsoft 365 and Entra data, authorised with delegated or application permissions, not Azure RBAC.
Microsoft Purview (Azure Purview)
Data governance with a metadata-only Data Map of schema, lineage and classification; not log collection.
Microsoft.Sql service endpoint
Service endpoint routing subnet traffic to Azure SQL over the backbone, bypassing forced tunnelling.
Modify (Policy effect)
Adds, replaces or removes tags and properties; fixes existing resources through a remediation task.
MPI (Message Passing Interface)
Node-to-node HPC communication, run in Batch with multi-instance tasks.
Multi-user authorization (MUA)
Protects critical backup operations by requiring a role on a Resource Guard, ideally in a separate tenant.
My Apps
Entra user portal whose browser extension fills credentials for password-based SSO.
MySQL Flexible Server
Managed MySQL with zone-redundant HA on General Purpose and Business Critical, not Burstable.
N
NC / NV series
GPU VM sizes for compute (NC) and visualisation (NV); they add cost for SQL Server.
.NET
Microsoft development framework; full .NET Framework apps needing OS access go on VMs, while .NET on App Service supports auto-instrumentation.
Network Watcher
Azure network diagnostics, including IP flow verify, flow logs and Connection Monitor.
NFS (Network File System)
Unix file-share protocol offered by Azure Files, NetApp Files and blob NFSv3; not the Hadoop ACL model.
Non-gallery enterprise application
Enterprise application added for a custom or in-house app, e.g. with SAML SSO.
O
On-demand compliance scan
Policy evaluation started with CLI, PowerShell or REST, not the portal.
On-premises data gateway
Bridge for Power BI, Logic Apps and Power Apps to on-premises data; not for Data Factory.
Operational backup
Azure Backup for blobs, standardising retention across storage accounts.
OWASP (Open Web Application Security Project)
Body behind the Top 10 attacks that WAF rules block.
P
P1 / P2
See Entra ID P1 and Entra ID P2.
PaaS (platform as a service)
Managed platforms such as App Service and Azure SQL Database.
Password hash sync
Entra Connect sign-in method syncing password hashes, so lockout happens in the cloud.
Password-based SSO
Entra stores credentials and My Apps fills them into apps with no identity provider.
PCI DSS (Payment Card Industry Data Security Standard)
Compliance standard shown on the regulatory compliance dashboard.
Peering Service
Optimised internet routing to Microsoft; does not make Logs Ingestion private.
Performance (routing)
Traffic Manager method sending users to the lowest-latency endpoint.
Point-in-time restore
Restores block blobs in GPv2 to an earlier time; needs soft delete, versioning and change feed.
POSIX (Portable Operating System Interface)
Unix permission model used by ADLS Gen2 ACLs.
PostgreSQL (Cosmos DB API, Citus)
Distributed relational Cosmos DB API for horizontal write scale-out.
Power BI
Microsoft reporting service; connects to on-premises data via the on-premises data gateway.
Primary Refresh Token (PRT)
Token held by Entra-joined devices that gives seamless SSO to Entra-integrated apps.
Priority (routing)
Traffic Manager active/passive failover method that fails away from unhealthy endpoints.
Private DNS zone
Azure DNS zone linked to a VNet holding private A records; queryable only via 168.63.129.16, so on-premises needs a forwarder or DNS Private Resolver.
Private endpoint
Private IP for a service in your VNet, reachable from peered VNets and from on-premises over ExpressRoute or VPN; public access can then be disabled.
Privileged Identity Management (PIM)
Entra ID P2 just-in-time, time-bound privileged role activation with approval; not for reviewing guest access.
Proximity placement group
Keeps Azure compute physically close; cannot include BareMetal servers.
Purchase reservations
Portal blade showing reservation savings before buying, whereas Advisor recommends reservations from past usage.
Q
Queue Storage
Simple storage queues with messages up to 64 KB and no ordering guarantee; AzCopy cannot manage them.
R
RA-GRS (read-access geo-redundant storage)
GRS plus a read-only secondary endpoint usable without failover.
RBAC (role-based access control)
Azure role assignments governing who can manage resources, inherited down scopes; not where or what size resources are.
RDMA (remote direct memory access)
Lowest-latency networking over InfiniBand on HPC sizes with "r" in the name.
RDP (Remote Desktop Protocol)
Windows remote-session protocol on port 3389; Bastion carries it over TLS on 443.
Read scale-out
One readable secondary on Business Critical or Premium, with no load balancing.
Recovery Services vault
Store for Azure Backup and Site Recovery data, supporting soft delete, immutability and MUA; not a cheap archive for existing files.
Regional VNet integration
Outbound App Service access into a VNet (Basic tier up) via a subnet delegated to Microsoft.Web/serverFarms; inbound access needs a private endpoint.
Regulatory compliance dashboard
Defender for Cloud view reporting against standards such as ISO 27001 and PCI DSS; it blocks nothing.
Remediation task
Applies a DeployIfNotExists or Modify assignment to existing non-compliant resources, running as the assignment's managed identity.
Request (HTTP) trigger
Logic Apps trigger started by an incoming HTTP call or webhook.
Resource Graph
Fast query service across Azure resources that now surfaces Change Analysis change history.
Resource Guard
Separate resource holding the permissions MUA requires for critical Recovery Services vault operations; best placed in a separate tenant.
Resource locks
CanNotDelete or ReadOnly locks on management-plane operations; they do not restrict regions or sizes or protect blob data.
Resource owner password (grant)
Legacy OAuth flow that sends the user's password to the app.
Resource selectors
Narrow a policy assignment's evaluation by resource type or location, e.g. VMs in East US.
REST (representational state transfer)
HTTP API style used by Azure services, e.g. to start a compliance scan.
RHEL (Red Hat Enterprise Linux)
Linux distribution whose licences Azure Hybrid Benefit covers, unlike Ubuntu.
RPO (recovery point objective)
Maximum acceptable data loss; for a VM backup policy the minimum RPO equals the backup frequency.
RSA (Rivest–Shamir–Adleman)
Asymmetric algorithm; TDE protector keys are RSA or RSA-HSM at 2048 or 3072 bits, not 4096.
RTO (recovery time objective)
Maximum acceptable time to restore service; Site Recovery gives minutes, restoring from backup hours.
RU (request unit, RUs)
Cosmos DB throughput currency; Synapse Link queries consume none from the transactional store.
S
SAML (Security Assertion Markup Language)
Federation protocol for SSO to apps added as non-gallery enterprise applications.
SAP HANA
In-memory database, e.g. SAP HANA Large Instances on BareMetal Infrastructure.
Scale Out
App Service autoscale rules (Standard and above) adding or removing instances with demand; the answer for unpredictable load.
SCIM (System for Cross-domain Identity Management)
Provisioning standard whose bulk requests API-driven inbound provisioning accepts.
SDK (software development kit)
Client libraries; using the Key Vault SDK means code changes, unlike Key Vault references.
Security defaults
Free, tenant-wide baseline that requires MFA registration and blocks legacy authentication; cannot be scoped to a group.
SecurityEvent
Log Analytics table of Windows Security events collected by Sentinel or Defender.
Self-hosted IR (self-hosted integration runtime, formerly Data Management Gateway)
Data Factory runtime reaching on-premises or VM sources via outbound HTTPS.
Self-review
Access-review option where each member, including guests, attests whether they still need access.
Server trust group
Lets SQL Managed Instances run distributed transactions across instances.
Serverless (SQL)
Autoscaling, auto-pausing, per-second-billed single database in General Purpose or Hyperscale; not Business Critical and no reserved capacity.
Serverless SQL pool
Synapse pool querying lake files and the Cosmos DB analytical store in place; reads Delta but cannot write it or stream.
Service Bus
Enterprise messaging with queues and topics, transactions, ordering via sessions and dead-lettering.
Service Bus topic
Publish-subscribe entity where subscriptions filter relevant messages; Standard or Premium, not Basic.
Service Connector
Simplifies app-to-service connections; does not make Logs Ingestion private.
Service endpoint
Routes a subnet's traffic to a service's public endpoint over the Azure backbone; free, but not usable from on-premises.
Service principal
App-registration identity with a stored secret or certificate that must be rotated and can be copied; suits code outside Azure.
Session controls
Conditional Access sign-in frequency and app-enforced restrictions; they limit a session but do not require MFA.
Set (secret permission)
Writes Key Vault secrets (some older material calls it Create).
SIEM (security information and event management)
Security log analytics and detection, e.g. Microsoft Sentinel.
SLA (service level agreement)
Guaranteed uptime, e.g. 99.9% single VM, 99.95% availability set, 99.99% across zones.
Smart lockout
Entra ID brute-force lockout in every edition; with password hash sync it does not lock on-premises accounts.
SMB (Server Message Block)
Windows file-share protocol for Azure Files, using identity-based authentication.
Snapshot Debugger
Application Insights capture of exception snapshots down to the line of code.
Spot Priority Mix
VMSS Flexible setting giving a guaranteed base of regular VMs plus a percentage of Spot VMs.
Spot VMs
Discounted evictable VMs for interruptible work; not available for dedicated hosts.
SQL analytics endpoint
Fabric SQL access to lakehouse data; Power BI via DirectQuery is slower than Direct Lake.
SQL Database reserved capacity
One- or three-year vCore reservation that discounts compute only, not storage, licences or DTU databases.
SQL Server on Azure VMs
IaaS SQL Server with full OS control; HA through Always On AGs or FCIs.
SSIS (SQL Server Integration Services)
ETL packages, run in Azure by the Azure-SSIS IR.
SSL (Secure Sockets Layer)
TLS's predecessor; "SSL offload" means terminating TLS at the load balancer, which alone does not stop injection.
SSMA (SQL Server Migration Assistant)
Migrates non-SQL Server sources such as Oracle, DB2, MySQL, SAP ASE and Access.
SSMS (SQL Server Management Studio)
SQL Server management tool, e.g. for creating a target schema.
Standard general-purpose v2 (StorageV2, GPv2)
Standard account for all storage services with access tiers and every redundancy option.
State (parameter)
OAuth parameter that round-trips custom data, e.g. APIM's "Support state parameter".
Stored access policy
Container-level policy governing service SAS signed with the account key; cannot be used with user delegation SAS.
SYN Count
Standard Load Balancer metric counting TCP SYN packets, i.e. connection attempts.
System-assigned managed identity
Identity created and deleted with one resource; ten VMs get ten identities. Used for policy remediation.
T
Table storage
Cheap key-value tables indexed on PartitionKey and RowKey only, with one write region and 1 MB entities.
Tags
Name-value metadata for cost reporting and grouping across resource groups, enforced or inherited by Azure Policy.
TCP (Transmission Control Protocol)
Connection-oriented transport protocol.
TDE protector
Customer-managed asymmetric RSA key in Key Vault or Managed HSM that wraps the TDE data encryption key.
Template Specs
Versioned ARM templates stored as Azure resources; with deployment stacks, the Blueprints replacement.
Tenant Restrictions
Controls which tenants users can sign in to; not an access review.
Tenant Root Group
Root management group of a tenant; one assignment there covers every subscription.
Time Series Insights
Retired IoT analytics service succeeded by Azure Data Explorer.
Time-based retention (WORM) policy
Immutability policy: data can be read but not modified or deleted for the period.
TLS (Transport Layer Security)
Encryption for network traffic, e.g. Bastion sessions on port 443.
Token configuration
App-registration blade adding optional claims such as email and groups; not app roles.
Total Cost of Ownership calculator (TCO)
Compares on-premises spend with Azure before migrating.
Traffic Analytics
Analyses NSG or VNet flow logs into traffic patterns and top talkers; does not evaluate rules.
Traffic Manager
Global DNS-based routing (priority, performance, weighted, geographic) for any protocol; never sees HTTP and stores no content.
Transactional replication
SQL replication with Azure SQL Database as subscriber; minimal-downtime migration.
Transparent Data Encryption (TDE)
Encrypts database files at rest only; anyone who can query sees plaintext.
U
U-SQL
Query language of the retired Azure Data Lake Analytics.
UDP (User Datagram Protocol)
Connectionless transport protocol.
UDR (user-defined route)
Static route-table entry, e.g. next hop virtual network gateway; not dynamic like BGP.
UPN (user principal name)
User sign-in name; its suffix must be a verified custom domain.
Usage analytics
Application Insights analysis of users, sessions, funnels, retention and user flows.
User Access Administrator
Azure role that grants access but cannot manage resources or write tags.
User delegation SAS
SAS signed with Entra credentials; most secure SAS, works with shared key disabled, maximum 7 days, blobs only.
User-assigned managed identity
Standalone identity attached to many resources, so roles are granted once.
V
validate-jwt
APIM policy checking a token's issuer, audience and claims before the request reaches the back end.
vCore model
Azure SQL purchasing model choosing vCores, memory and storage separately; supports Hybrid Benefit and reserved capacity.
Versioning (blob)
Keeps previous blob versions; needed for point-in-time restore but does not purge data.
VHD (virtual hard disk)
Disk image format, e.g. the Hyper-V Azure Migrate appliance download.
VIP (virtual IP)
Load balancer frontend address; Data Path Availability measures VIP availability.
Virtual Machine Contributor
Azure role for managing VMs but not the network or storage they connect to.
Virtual machines (VMs)
IaaS compute with full OS access; needed for COM components and lift-and-shift.
Virtual nodes
ACI-backed AKS nodes giving Linux pods compute in seconds; need Azure CNI.
Virtual WAN
Hub-based networking; Basic supports site-to-site VPN only, Standard adds ExpressRoute, point-to-site and transit.
VM insights
VM performance and dependency map monitoring; does not audit changes or evaluate NSG rules.
VM scale set (VMSS)
Group of load-balanced VMs with autoscale, in Uniform or Flexible mode.
VMSS Flexible
Scale-set mode allowing mixed VM types and OSs, zone spread and Spot Priority Mix; no configurable update domains.
VNN (virtual network name)
Older SQL listener needing an Azure Load Balancer; replaced by DNN.
VPN (virtual private network)
Encrypted tunnel, e.g. site-to-site to a VPN gateway in GatewaySubnet.
VRRP (Virtual Router Redundancy Protocol)
LAN gateway-redundancy protocol, not used for Azure routing.
VSS (Volume Shadow Copy Service)
Windows snapshot mechanism MARS uses; not a backup solution.
VXLAN (Virtual Extensible LAN)
Encapsulation Gateway Load Balancer uses to chain NVAs.
W
Web API
The API that validates Entra tokens and authorises using scp and roles claims; the web app is only the client.
Web App for Containers
App Service hosting container images with autoscale, ACR continuous deployment and Easy Auth.
Web Application Firewall (WAF)
Layer-7 protection against OWASP Top 10 attacks such as SQL injection and XSS, on Front Door or Application Gateway.
Windows Admin Center (WAC)
Server management tool that can register with Azure and enable Azure Backup via MARS.
WS-Fed (WS-Federation)
Federation protocol for partner identity providers that do not use Entra.
X
XML (Extensible Markup Language)
Text data format, e.g. message bodies.
Z
Zone-redundant plan
App Service plan (Premium v2/v3) spreading at least three instances across zones.
ZRS (zone-redundant storage)
Three copies across availability zones in one region; no secondary region.