The Ultra Transcenders glossary

--attach-acr

Option on az aks create or az aks update that links a container registry to an AKS cluster by assigning AcrPull to the kubelet identity, so nodes can pull its images.

168.63.129.16 (WireServer)

Special platform address (WireServer) through which Azure delivers the VM agent channel, built-in DNS, DHCP and load balancer health probes. Traffic to it must stay open, or those platform functions stop working.

3DES (Triple Data Encryption Standard)

Older symmetric block cipher (Triple DES) regarded today as weak. Storage customer-managed keys cannot use it as a key type.

5-tuple

The five values that identify a flow: protocol plus the source and destination IP addresses and ports. Azure Load Balancer hashes them by default to spread traffic, and IP flow verify in Network Watcher takes them as its input.

@secure() decorator

Bicep decorator marking a parameter or output of type string or object as sensitive, so its value is kept out of Resource Manager logs and deployment history.

\${{inputs.<name>}} (job input expression)

An expression used in an Azure Machine Learning command that, when the job runs, is substituted with the input's downloaded or mounted path, or with its literal value. The preceding flag has to match the argparse name in the script.

_backup.filter

File placed in an app's site\wwwroot folder that lists paths for custom App Service backups to skip; during a restore, those excluded paths are not touched.

_dnsauth TXT record

A TXT record named _dnsauth.<subdomain> that Front Door Standard/Premium checks to confirm you own a domain. It plays no part in routing.

A record

Points a DNS name at an IPv4 address. A typical use is pointing a root (apex) domain at an app.

AAAA record

Type of DNS entry that resolves a host to its IPv6 address.

ABFS (Azure Blob File System driver)

Short for Azure Blob File System driver. Hadoop, Spark and HDInsight rely on this HDFS-compatible connector to read and write ADLS Gen2 data.

abfss:// (Azure Blob File System (secure))

Secure URI scheme used to reach ADLS Gen2 data, always through the dfs endpoint (account.dfs.core.windows.net); blob endpoint addresses are not used with it.

Abuse monitoring

Azure OpenAI mechanism that looks across a customer's traffic for recurring misuse and flags it for review by Microsoft. Individual responses are not filtered by it.

Accelerated Networking

SR-IOV capability that cuts latency, jitter and CPU overhead for VM networking in Azure. HPC VM sizes with RDMA achieve even lower latency.

Access keys (storage account keys)

Pair of 512-bit keys belonging to a storage account; every account SAS and service SAS is signed with one of them. Once both are regenerated, direct key access and all those SAS tokens stop working.

Access package

Bundle in entitlement management that groups apps, groups and sites together with request policies and an expiry. Access to the resources is withdrawn once an assignment expires.

Access policies (Key Vault)

Older permission model for Key Vault, now superseded by the Azure RBAC model.

Access restrictions (App Service access restrictions)

Allow and deny rules for inbound App Service traffic, matched on IP range, service tag or subnet. They can, for instance, restrict an app to a corporate NAT's public addresses.

Access reviews

Microsoft Entra ID Governance capability that periodically asks reviewers or users themselves to confirm membership for guests, app users or groups, removing anyone who does not respond. PIM, by contrast, handles privileged roles.

Access tier

Setting for block blobs in standard accounts (Hot, Cool, Cold or Archive). Cooler tiers cost less to store but more to access.

Account SAS

Shared access signature created with an account key. One token may cover multiple services (ss), resource types (srt) and permissions (sp), service-level operations included, but turning off Shared Key authorisation blocks it.

Accountability principle

Under this responsible AI principle, identifiable people must answer for how an AI system behaves; human oversight, override capability and governance committees support it.

Accuracy (classification metric)

Overall measure for a classification model: the share of all test cases it predicts correctly.

ACL (access control list)

List of permissions set on a file or folder; examples include the POSIX-style lists in ADLS Gen2 and NTFS lists on Azure Files. Attribute conditions cannot be expressed in them.

ACR geo-replication

Capability of Premium Azure Container Registry that keeps images in multiple regions while clients still use a single registry name.

ACR Tasks

Capability present in all Azure Container Registry SKUs for building, pushing and patching images in the cloud, through quick tasks (az acr build), triggered tasks or multi-step tasks.

AcrPull

Data-plane role built into Azure Container Registry that allows reading tags and pulling images. Assign it to whichever identity performs the pull.

AcrPush

Azure Container Registry built-in role for pushing as well as pulling images. It is the narrowest role that permits pushes, though signing images is outside it.

AcrQuarantineWriter

Azure Container Registry built-in role belonging to the quarantine feature: it lets an identity push quarantined images and update their quarantine status. It has nothing to do with signing.

Action groups

Sets of notification and automation targets in Azure Monitor that an alert calls when it fires. Detecting the problem is the alert rule's job, not theirs.

Active assignment

Type of PIM assignment that grants the role straight away, with no activation step, for as long as the assignment lasts.

Active Directory - Integrated (Microsoft Entra Integrated)

Sign-in choice in SSMS, since renamed Microsoft Entra Integrated, that silently passes on a hybrid user's existing Windows credentials using federation or seamless SSO.

Active Directory - Password (Microsoft Entra Password)

SSMS sign-in choice, since renamed Microsoft Entra Password, that prompts for a Microsoft Entra user name and password.

Active geo-replication

Azure SQL Database feature that replicates a single database to as many as four readable secondaries, failed over manually. SQL Managed Instance does not offer it.

Active-active VPN gateway

Configuration where tunnels run on both gateway instances, and each instance has a Standard static public IP of its own. Azure Route Server branch-to-branch transit needs this mode plus ASN 65515.

Activity log

Record, held for 90 days, of control-plane operations in a subscription such as deployments and Policy events. Data-plane actions, Key Vault reads for example, are not captured.

Activity log alert

Alert rule without state that triggers on a matching Activity log event, deleting a management lock for instance. A scope, a condition and an action group are required; a Log Analytics workspace is not.

AD (Active Directory)

Short for Active Directory, the directory service built into Windows Server (AD DS). Entra Connect synchronises on-premises forests to Microsoft Entra ID.

AD CS (Active Directory Certificate Services)

Short for Active Directory Certificate Services, a Windows Server role that operates a private certificate authority. Because the certificates it issues are not publicly trusted, services needing a public CA, such as Front Door bring-your-own-certificate, refuse them.

AD DS (Active Directory Domain Services)

Short for Active Directory Domain Services, the domain controller-based Windows directory run on-premises. Microsoft Entra Domain Services offers a managed counterpart.

AD DS authentication (Azure Files)

Option that domain-joins a storage account to on-premises AD DS, letting synced hybrid users mount its SMB shares using Kerberos. RBAC controls share-level access, while Windows ACLs govern files and folders.

AD FS (Active Directory Federation Services)

Short for Active Directory Federation Services, a federation server hosted on-premises. Its older publishing role, Web Application Proxy, is a separate thing from Microsoft Entra application proxy.

Adaptive thinking (thinking type adaptive)

Mode in which Claude itself chooses whether to reason and for how long, guided by the effort parameter. Claude Opus 4.7 and newer models support only this thinking mode.

Add-AzNetworkInterfaceIpConfig

Cmdlet in Az.Network for adding another IP configuration to a NIC that already exists. Passing -PrivateIpAddressVersion IPv6 lets a VM gain IPv6 without needing a second NIC.

Add-AzVirtualNetworkPeering

Az.Network cmdlet for creating a VNet peering link in a single direction. For hub-and-spoke gateway sharing, set -AllowGatewayTransit on the link from hub to spoke and -UseRemoteGateways on the link from spoke to hub.

Additional context (Authenticator)

Microsoft Authenticator option that enriches push and passwordless prompts with where the sign-in is coming from geographically and which application asked for it.

Additional local administrators (Microsoft Entra Joined Device Local Administrator)

Microsoft Entra ID P1 device setting that grants selected users local administrator rights across all Microsoft Entra joined devices. Targeting only some devices is not possible.

Address space

The CIDR block or blocks that define a VNet. Every subnet has to fall inside it; blocks can be added, or altered when nothing is using them.

ADLS Gen2 (Azure Data Lake Storage Gen2)

Short for Azure Data Lake Storage Gen2: a standard GPv2 account with hierarchical namespace turned on, so analytics workloads get true directories and POSIX-style ACLs.

Admin consent

Approval of an app's permissions for the whole tenant, given by an administrator with the right authority. Application permissions always need it, and owning the app does not grant it.

Admin consent workflow

Feature allowing users to ask an administrator to approve an app they cannot consent to themselves. Nominated reviewers handle the requests, yet the approver must hold a role able to grant admin consent.

Admin user (ACR)

Built-in admin account on a container registry, turned off by default, with one username and two passwords that can be regenerated. It grants full push and pull rights under a single shared identity.

Administrative (Activity log category)

Category of Activity log entries covering every create, update, delete and action call made via Resource Manager, for example adding a tag, attaching a disk or creating a resource group.

Administrative units

Containers in Microsoft Entra ID that limit the reach of directory administrators to particular users, groups or devices. They are neither Azure Policy scopes nor cost groupings.

ADUC (Active Directory Users and Computers)

Short for Active Directory Users and Computers, the on-premises console for administering AD users and objects individually. Bulk changes are impractical with it.

Adult content detection (Adult visual feature)

Image Analysis 3.2 capability, needing no training, that flags images through isAdultContent, isRacyContent and isGoryContent with scores between 0 and 1. Newer moderation is offered by Azure AI Content Safety.

Advanced data parsing

Structure-aware document processing: it applies OCR to scanned pages, joins tables spanning pages, recovers headers and produces chunks tagged with heading, page and table metadata, in contrast to fixed-size or page-by-page chunking.

Advanced hunting

Threat-hunting feature of the Microsoft Defender portal that runs KQL over 30 days of raw Defender XDR data, plus onboarded Sentinel data, and supports custom detections. It finds activity after it happens rather than blocking it.

Advanced Threat Protection

Part of Defender for SQL that raises alerts for possible SQL injection, code vulnerable to injection, brute-force attacks and access by unusual principals or from unusual locations.

AES (Advanced Encryption Standard)

Short for Advanced Encryption Standard, a symmetric cipher. With TDE, the RSA TDE protector wraps an AES-256 data encryption key.

afdverify

Verification CNAME in Front Door (classic), mapping afdverify.<host> to afdverify.<name>.azurefd.net, which proves ownership of a custom domain while live traffic stays where it is.

Affordance (prompting)

Prompting approach where the model is offered callable tools or functions, letting it pass tasks like calculations or lookups to code rather than guess the answer.

Agent Application (published agent)

Resource that Azure creates on publishing an agent version; it has a stable endpoint plus its own Microsoft Entra agent identity and blueprint. Role assignments held by the project identity do not carry over and need to be granted again.

Agent endpoint (stable agent endpoint)

Fixed URL through which consumers call an agent by name. A version selector decides whether it always serves the newest version, without redeployment, or stays pinned to a single active version.

Agent ID Administrator

Privileged role in Microsoft Entra for managing agent identities and blueprints across their lifecycle. Approving partner agent permissions and granting admin consent are beyond it.

Agent identity

Service principal of a special kind representing an AI agent, holding no credentials itself. It can act on its own using app-only permissions or for a user using delegated ones; Conditional Access offers only block, not grant controls, for it.

Agent identity blueprint (blueprint)

Template in Microsoft Entra Agent ID that holds credentials for one type of agent and obtains tokens for the agent identities created from it. Policies like Conditional Access set on it reach all those identities; Azure RBAC roles cannot be assigned to it.

Agent instructions (system message)

System message of an agent defining its role, objectives, tone and boundaries; it also steers, though not deterministically, when tools get called.

Agent Monitoring Dashboard

View in Microsoft Foundry, powered by Application Insights, that tracks token consumption, latency, successful runs and evaluation scores and can raise alerts. It gives visibility at runtime and is not a gate for releases.

Agent risk

Condition in Conditional Access based on the risk level Microsoft Entra ID Protection assigns to agent identities, letting a policy stop high-risk agents from obtaining tokens.

Agent version

Snapshot of an agent's configuration that cannot be changed. Every edit, a single prompt tweak included, produces a new one, and rolling back simply means referencing an earlier version.

Agent's user account (agent user)

Optional Microsoft Entra user object tied one-to-one to an agent identity, for services such as a mailbox, Teams or OneDrive that expect a user. No password or passkey exists for it, and privileged admin roles cannot be assigned to it.

Agentic retrieval

Query approach in Azure AI Search where an LLM turns a conversation into several planned subqueries; these execute together, are reranked semantically, and the best chunks are merged. Classic RAG, by contrast, issues just one query.

Agentless discovery for Kubernetes

Capability in Defender CSPM and Defender for Containers that inventories Kubernetes clusters and assesses their posture through APIs, using the Kubernetes Agentless Operator role. Pod admission and blocking are outside its scope.

Agentless malware scanning

Snapshot-based malware check for VM disks that runs Microsoft Defender Antivirus engines with no agent installed. It comes with Defender for Servers Plan 2, not with Defender CSPM by itself.

Agentless scanning (agentless machine scanning)

Defender for Cloud technique that inspects snapshots of VM disks for secrets, vulnerabilities and installed software, with nothing installed on the VM.

Agents (classic) API (threads, runs, messages)

First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.

AGWFirewallLogs

Log Analytics table, resource-specific, that stores WAF events from Application Gateway. Front Door uses different tables.

AI Administrator

Microsoft Entra role for managing Microsoft 365 Copilot and other AI settings; holders may also consent on behalf of the whole tenant, Microsoft Graph application permissions excepted.

AI agent

Software pairing a generative model with tools, enabling it to understand what is asked, converse and act to reach a goal.

AI bill of materials (AI BOM)

Catalogue compiled by AI security posture management in Defender CSPM listing what a generative AI app is built from, including its models, SDKs and data sources.

AI enrichment (skillset)

Indexing-time process in Azure AI Search where skills such as OCR, key phrase extraction, entity recognition and image analysis turn raw content into fields that can be searched.

AI gateway (Foundry)

API Management instance linked to a Microsoft Foundry resource; it sits in front of registered models, tools and agents, adding access control, rate limiting and diagnostics. Custom agents cannot be registered without one.

AI gateway in Azure API Management

Collection of API Management gateway capabilities, offered in every tier rather than as its own product, for placing model APIs, MCP servers and A2A agent APIs behind caller authentication, token metering and content screening.

AI Red Teaming Agent

PyRIT-based tool in Microsoft Foundry that mounts simulated adversarial attacks on models and agents and reports how often attacks succeed. It identifies risk without blocking anything.

AI security posture management (AI-SPM)

Part of Defender CSPM, absent from Foundational CSPM, that finds generative AI workloads, compiles an AI bill of materials and highlights AI-specific recommendations and attack paths.

AIProjectClient

Starting object of the Microsoft Foundry SDK, constructed from the project endpoint plus a Microsoft Entra credential like DefaultAzureCredential. Because only Entra ID authentication is supported, no project key or SAS exists.

AIServices (resource kind)

Setting kind to AIServices creates the multi-service Microsoft Foundry resource, which Microsoft recommends; Speech, Vision, Language, Azure OpenAI and Content Understanding are then reached with a single credential at a single endpoint.

AKS (Azure Kubernetes Service)

Short for Azure Kubernetes Service, a managed Kubernetes offering that gives full control of clusters and node pools. Scaling uses the cluster autoscaler and Horizontal Pod Autoscaler; user sign-in is not built in.

Alert processing rules (action rules)

Rules applied after an alert fires that attach or suppress action groups, on a schedule if required. Only notifications are affected; the alert rule stays in place and keeps firing.

Alert rule

Azure Monitor definition made up of a scope naming the target resources, a condition setting the signal and logic, and optionally action groups. A separate rule is needed for every signal that has different recipients.

All resources (Conditional Access) (All cloud apps)

Broadest Conditional Access target, previously called All cloud apps, which takes in every resource such as Microsoft 365 and the Azure portal. Microsoft Azure Management covers less.

AllMetrics

Category in a diagnostic setting that sends out a resource's platform metrics. If only log categories are chosen, metrics are not exported.

Allow Azure services and resources to access this server

Networking option on Azure SQL that lets in connections from every Azure IP address, even resources owned by other customers. Leaving it off follows least privilege.

Allow forwarded traffic

Peering option permitting traffic that did not start in the peer VNet, but was forwarded by a gateway or NVA, to pass over the peering.

Allow gateway transit (allowGatewayTransit)

Peering option set on the hub, which owns the gateway, so that peered VNets can share its ExpressRoute or VPN gateway. The spoke sets Use remote gateways to match; on a VNet lacking a gateway the option has no effect.

Allow storage account key access (AllowSharedKeyAccess)

Storage setting which, once disabled, makes every request authorised by Shared Key fail with 403, covering account keys plus account and service SAS. Microsoft Entra identities gain nothing from it, and user delegation SAS keeps working.

AllowAzureLoadBalancerInBound

Built-in NSG inbound rule at priority 65001 that admits traffic coming from Azure Load Balancer, health probes included.

allowBlobPublicAccess (Allow Blob anonymous access)

Account-level storage property; setting it to false blocks anonymous reads on all containers regardless of what each container's access level says.

Allowed locations

Built-in Azure Policy that rejects resources in any region missing from its list, making it the usual way to control where deployments go.

Allowed locations for resource groups

Azure Policy definition that constrains only where resource groups are created; resources within those groups can still be placed in other regions.

Allowed resource types

Deny-effect built-in Azure Policy that permits only the resource types it lists and blocks the rest.

Allowed virtual machine size SKUs

Azure Policy that limits deployments to a chosen set of VM sizes.

AllowInternetOutBound

Built-in NSG outbound rule at priority 65001 that lets traffic reach the internet. A deny rule with a smaller priority number overrides it.

AllowVNetInBound

Built-in NSG inbound rule at priority 65000 that admits anything from the VirtualNetwork service tag, which also covers peered VNets.

AllowVnetOutBound

Built-in NSG outbound rule at priority 65000 that lets VMs open connections towards their own VNet and peered VNets. The NSG at the destination still has to permit the port.

Alt text (Image Analysis)

Image description for accessibility, produced by Image Analysis captioning above a confidence threshold. New solutions should prefer Content Understanding or a multimodal model.

Always Encrypted

Client-side encryption of SQL columns using keys never revealed to the database engine, meaning cloud administrators and DBAs only ever see ciphertext.

Always On availability group (AG)

High-availability feature of SQL Server that keeps synchronous or asynchronous replicas on different servers or VMs without shared storage. As every replica is a live SQL Server, it is an expensive way to provide DR.

Amazon EC2 (EC2)

Amazon's virtual machine offering. Defender for Cloud can onboard EC2 instances automatically, installing Azure Arc and Defender components, when its AWS connector has Defender for Servers turned on.

Amazon ECR (ECR)

Amazon's registry service for container images, which Defender for Containers can scan once the AWS connector is in place.

AMD SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging)

Hardware feature from AMD that encrypts and isolates virtual machine memory; the confidential VM series DCasv5/DCadsv5 and ECasv5/ECadsv5 rely on it.

AmlOnlineEndpointConsoleLog

Table in Log Analytics capturing console output from Azure Machine Learning online endpoint containers, useful when a container will not start or handles requests incorrectly.

AMQP (Advanced Message Queuing Protocol)

Short for Advanced Message Queuing Protocol; Service Bus and Event Hubs accept it as well as HTTPS.

AnalysisResult

Object that poller.result() returns in Content Understanding; its JSON body carries the extracted fields and markdown content.

Analytics rule

KQL-based detection in Microsoft Sentinel that searches ingested data, generates alerts and bundles them into incidents. Rules identify threats but do not fix them.

Analytics tier

Hot data tier of Microsoft Sentinel supporting hunting, detections and every Sentinel feature; its analytics retention can be extended to as much as two years.

Analyze image API (image:analyze)

REST operation in Content Safety that rates a blob URL or base64-encoded picture against four harm categories, returning severity 0, 2, 4 or 6; it is called as POST {endpoint}/contentsafety/image:analyze.

Analyze text API (text:analyze)

Content Safety call (POST {endpoint}/contentsafety/text:analyze) that rates text for violence, hate, sexual content and self-harm, optionally matching it against named blocklists.

analyze-text endpoint (/language/:analyze-text)

Single Azure Language REST endpoint (/language/:analyze-text) in which the kind field of the request, for example SentimentAnalysis, EntityRecognition or LanguageDetection, chooses the feature. The older /text/analytics/v3.x paths are superseded by it.

AnalyzeTextOptions

Request class in the Content Safety SDK carrying the text, categories, blocklist names and output type; AnalyzeText accepts it.

Annotate (guardrail action)

Guardrail action that reports detection details such as detected, filtered and severity yet lets the content through. Blocking requires Annotate and block instead.

Annotate and block

Guardrail action in Microsoft Foundry that marks detected risk and also stops it; at the tool-call intervention point, this means the tool call never runs.

Anomaly detection

Identifying data points or time-series values that look out of the ordinary, such as fraud or a spike from a sensor. Microsoft retired the dedicated Azure AI Anomaly Detector service on 1 October 2026.

Anonymous IP address

Sign-in risk detection in Microsoft Entra ID Protection, raised when someone signs in through an anonymising proxy like Tor.

Apache Avro

Compact binary data format organised by rows; Event Hubs Capture produces its files in this format natively.

Apache Spark pool

Spark compute in Azure Synapse used to build and update Delta Lake tables, run machine learning and stream changes from the Cosmos DB change feed.

Apex domain (root domain, zone apex)

The bare domain without any subdomain (example.com), also known as the zone apex or root domain. Since a CNAME is not allowed there, routing it to a service like Front Door relies on CNAME flattening or Azure DNS alias records.

API (application programming interface)

Short for application programming interface: a contract that client code calls programmatically, for example a web API secured with tokens or the Files, Images or Responses APIs.

API key (Foundry resource key) (resource key)

Key generated alongside an Azure OpenAI or Foundry Tools resource and supplied through the api-key header. It is used only when keyless authentication with Microsoft Entra ID cannot be.

API key (Foundry) (key-based authentication)

Secret shared by callers of an Azure OpenAI or Microsoft Foundry endpoint, conferring full access without any role check. Passing it around eliminates separation of roles, and it offers no network isolation.

API Management (APIM)

Azure's API gateway, where policies like rate limits, quotas, ip-filter and validate-jwt are defined once and apply to every API. Production VNet injection is offered in the Premium tier.

API Management llm-content-safety policy

Policy for the AI gateway in API Management: it passes prompts or completions to Azure AI Content Safety and rejects the call with 403 if a blocklist matches, Prompt Shields detect an attack, or a harm category passes its threshold, where 0 is strictest and 7 most lenient.

API Management llm-token-limit policy

Inbound AI gateway policy that caps token usage per counter key. Exceeding tokens-per-minute produces 429, an exhausted token quota produces 403, and estimate-prompt-tokens lets it reject before calling the backend.

API Management validate-jwt policy

API Management inbound policy validating a JWT's issuer, audience, signature and required claims, for instance using the Microsoft Entra OpenID configuration. By default it answers 401 when a token is absent or invalid.

API permissions

Blade of a Microsoft Entra app registration where the client asks for application or delegated permissions; once consent is given they show up as claims in tokens.

API server authorized IP address ranges

AKS capability restricting who can reach the public Kubernetes API server to specified IP ranges. Existing public clusters can have it switched on.

API-driven inbound provisioning

Inbound Microsoft Entra provisioning in which an app or script submits SCIM bulk requests built from any HR source, a CSV file for instance. The ECMA connector, by contrast, provisions outbound.

APIM named values (named values)

Reusable name/value pairs referenced from API Management policies. A value can be held in plain text, encrypted inside APIM as a secret, or pulled from Key Vault through the instance's managed identity.

APIM protocols and ciphers (Protocols + ciphers)

Blade in API Management for switching TLS/SSL protocols (SSL 3.0, for example) and cipher suites on or off, on the client side and towards backends. By default the minimum is TLS 1.2.

APIM subscription key (Ocp-Apim-Subscription-Key)

Caller key supplied either as a query-string parameter or in the Ocp-Apim-Subscription-Key header. API Management's gateway checks it as an APIM subscription key, which is not a Microsoft Entra token, while Foundry Tools like Content Safety read the resource key from it.

APM (application performance monitoring)

Short for application performance monitoring, the collection of request, dependency, failure and exception telemetry that sits at the heart of Application Insights.

App Configuration (Azure App Configuration)

Central store in Azure for feature flags and application settings. Its key-values can be made read-only, but those locks differ from Resource Manager locks.

App Configuration Data Owner

Data-plane Azure role with full rights over key-values in App Configuration. No Microsoft Entra directory permissions come with it.

App consent policy

Set of include and exclude conditions deciding which permissions users, or holders of custom roles, are allowed to consent to; microsoft-user-default-low is one built-in policy.

App manifest (application manifest)

Portal-editable JSON describing a Microsoft Entra app registration's attributes, including keyCredentials, accessTokenAcceptedVersion and groupMembershipClaims.

App registration

Object in Microsoft Entra ID describing an app's identity, the permissions it needs and which account types it supports; multi-tenant apps and OpenID Connect sign-in depend on it.

App roles

Roles declared by an API in its app registration. When one app calls another using client credentials, the assigned roles appear in the token's roles claim.

App Service

Managed PaaS hosting for web apps and Web App for Containers, run in a sandbox without OS access. Deployment slots and autoscale start at the Standard tier.

App Service Authentication (Easy Auth)

Code-free sign-in feature of App Service, also called Easy Auth, supporting Microsoft Entra ID along with other identity providers.

App Service backup

Scheduled or on-demand custom backup saving an app's configuration and content as blobs in a storage container within the same subscription. It is configured for each app or slot and can be restored to a different one.

App Service custom domain

Host name bound to an App Service app once the service has confirmed an asuid TXT record and an A or CNAME record. Serving it over HTTPS also requires binding a TLS certificate.

App Service Environment (ASE)

Network-isolated, single-tenant deployment of App Service on the Isolated plan. Because its cost is much higher, it suits only workloads that demand isolation.

App Service plan

Billing unit providing the compute, defined by region, OS, pricing tier and instance size and count, on which one or more apps run. Separate plans are needed for Linux and Windows apps.

App settings

Environment variables injected into an App Service app as name/value pairs, taking precedence over values in appsettings.json or Web.config. Each can be marked as specific to a slot.

Append (Policy effect)

Policy effect in Azure that inserts fields only while a resource is being created or updated; resources that already exist are not corrected by it.

Append a tag and its value to resources

Append-effect built-in policy that adds a tag whenever a resource is created or updated, leaving tags users set intact. Resource groups are not covered.

Append blob

Block-based blob tuned for writes that only add to the end, such as logs. Access tiers cannot be applied to it.

Append effect

Effect in Azure Policy whose field additions happen solely during create or update requests; already-deployed resources stay unremediated.

Application Administrator

Microsoft Entra role able to manage every enterprise application and app registration, application proxy included. It may grant admin consent, apart from Microsoft Graph app roles.

Application Developer

Microsoft Entra role allowing its holders to register apps even if "Users can register applications" is No. Other people's apps are outside its control.

Application Gateway

Layer-7 load balancer deployed per region, offering URL-based routing, TLS offload, cookie-based affinity and an optional WAF.

Application Gateway autoscaling

Capability of Application Gateway v2 that varies the instance count between configured minimum and maximum values, at most 125. Plan subnet size for that maximum, adding one address per private frontend IP.

Application Gateway Basic SKU

Low-traffic Application Gateway v2 SKU that supports header rewrite but omits WAF, mTLS and URL rewrite.

Application Gateway for Containers

Recent Application Gateway-based option for load balancing and ingress on AKS, offered as an alternative to AGIC.

Application Gateway Ingress Controller (AGIC)

Add-on for AKS that reads Kubernetes Ingress resources and sets up an Application Gateway, WAF v2 included, to match them.

Application Gateway v1 (Standard / WAF tiers)

First-generation Application Gateway SKU, with Standard and WAF tiers and authentication certificates, which retired on 28 April 2026. Gateways already on v2 cannot revert to it.

Application Gateway v2

Present-day Application Gateway SKU, Standard_v2 or WAF_v2, offering zone redundancy, autoscaling, a static VIP, Key Vault integration and header rewrite. It requires its own subnet, ideally a /24.

Application Gateway WAF tier

Tier of Application Gateway that brings OWASP Core Rule Set protection, now WAF_v2 since the v1 WAF tier retired on 28 April 2026. No WAF is included with the Standard tier.

Application groups

Collections of RemoteApp apps or full desktops in Azure Virtual Desktop, which administrators assign to users.

Application Insights

APM service within Azure Monitor providing application telemetry, availability tests, usage analytics and Application Map. Data from workspace-based instances lives in Log Analytics.

Application Insights Profiler

Capability of Application Insights that records performance traces from a running app, revealing slow requests and hot paths in the code. User behaviour is not what it profiles.

Application Map

Diagram in Application Insights showing the components of an application and how they call each other.

Application object

An app's single global definition, i.e. its app registration in the home tenant; every tenant using the app gets a service principal created from it.

Application permissions

Microsoft Entra permissions granted to the app itself and used without any signed-in user, which means they reach every user's data. For per-user access they are not least privilege.

Application rule

Azure Firewall rule type that controls outbound HTTP, HTTPS and MSSQL traffic according to the destination FQDN, with full URL filtering requiring Premium. DNAT and network rules are evaluated before it.

Application security group (ASG)

Named collection of VM NICs that NSG rules can use as source or destination in place of IP addresses. NICs join only when explicitly added, and they must all belong to one VNet.

Application segment (app segment)

Destination defined on an enterprise application for Microsoft Entra Private Access, made up of an FQDN, wildcard FQDN, IP or range together with ports and protocol. Matching traffic is reachable solely by users assigned to that app.

Approved Inventory

State in Defender EASM for assets the organisation owns directly. Such assets are scanned every day and, by default, are the only ones dashboard charts display.

Archive (tier)

Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.

Area of interest (smart crop)

Smart-crop capability of Image Analysis that, for a requested aspect ratio, returns a bounding box around the most important part of the image, useful for thumbnails and cropping.

argparse

Module in the Python standard library for parsing named arguments passed to a script on the command line. If a flag's name differs from what was declared, the script errors or the argument stays unset.

ARM (Azure Resource Manager)

Short for Azure Resource Manager, the control plane Azure uses for deploying and managing resources.

ARM template

JSON file describing Azure infrastructure declaratively. Once deployed it keeps no live connection to the resources, unlike Blueprints, which retires fully on 31 January 2027.

Artifact Registry (Google Artifact Registry)

Google Cloud's service for storing container images. Once the GCP connector is set up, Defender for Containers can scan what it holds.

AS path (autonomous system path)

BGP attribute recording each ASN a route has passed through. Routes with shorter paths usually win, so adding extra ASNs makes one look less attractive.

AS Path (hub routing preference)

Routing preference for a Virtual WAN hub under which the shortest BGP AS path wins regardless of where the route came from. When local routes tie, ExpressRoute is chosen over site-to-site VPN.

AS-path prepending (autonomous system path)

Making a BGP route less attractive by repeating ASNs to lengthen its AS path, steering traffic towards a different site or path.

ASIM parsers (Advanced Security Information Model parsers)

Short for Advanced Security Information Model parsers: KQL functions that map Microsoft Sentinel data onto shared schemas when queried. That happens after ingestion has been charged, so ingestion costs are unaffected.

Ask a question node (ask_question)

Workflow step in Microsoft Foundry that prompts the user, waits for an answer and keeps it in a variable like Local.Var01 so later conditions can test it.

ASM (Azure Service Manager)

Short for Azure Service Manager, the classic deployment model that came before Azure Resource Manager. New resources should not use it.

ASN (autonomous system number)

Short for autonomous system number, which identifies a BGP routing domain. Azure VPN gateways use 65515 by default, a reserved value on-premises peers must avoid; Defender EASM also discovers ASNs as an internet asset type.

Asset chain-based management

Way of removing assets in bulk in Defender EASM, chosen by the discovery group, seed or discovery chain entry that found them; everything discovered downstream goes too.

AssignableScopes

Property of a role definition stating at which management groups, subscriptions, resource groups or resources a custom role may be assigned.

Assigned group

Microsoft Entra group whose membership is maintained by hand by its owners or administrators rather than through a dynamic rule.

Assignment required

Setting on an enterprise application that allows sign-in only by users and groups that have been assigned to it.

Assistants API (Azure OpenAI Assistants)

Azure OpenAI's OpenAI-style API based on assistants, threads and runs. It was deprecated and retired on 26 August 2026, with Foundry agents using conversations and responses taking its place.

Association

Routing setting for a Virtual WAN hub. Each connection is associated with exactly one route table, and that table determines the routes the connection learns.

Attack paths (attack path analysis)

Defender CSPM capability showing how an attacker could chain exploitable weaknesses together to reach critical assets.

Attack surface composition

Within Defender EASM's Attack Surface Summary dashboard, the area that shows how many assets exist in each category; it does not list insights.

Attack surface priorities

Severity view in Defender EASM's summary dashboard. Insights are banded as high, medium or low, and the low band takes in deprecated technology plus infrastructure that will soon expire.

Attack Surface Summary

Top-level overview dashboard in Defender EASM. One section, priorities, ranks insights by how severe they are; another, composition, just tallies assets.

Attention

In a transformer, the mechanism determining the weight each other token in the context carries when predicting the next one.

Audience

Setting on a point-to-site VPN gateway using Microsoft Entra ID authentication; it contains the app ID of the Azure VPN Client or of a custom app. Only a single Audience value is allowed per gateway.

Audio + human-labeled transcript data

Training material for custom speech: recordings in mono 16-bit PCM WAV (RIFF) format at 8 or 16 kHz, zipped up together with a plain-text file listing each recording's name alongside what was said.

AudioConfig

Object in the Speech SDK specifying where audio comes from or goes to, for example FromStreamInput, FromWavFileInput or FromDefaultMicrophoneInput.

AudioOutputConfig

Speech SDK class choosing a single destination for synthesised speech: a file, a named device, a custom output stream or the default speaker.

AudioStreamFormat

Speech SDK class describing how an audio stream is encoded, namely channels, bits and sample rate. It does not act as an output destination.

Audit action group

Named bundle of database-engine events, BATCH_COMPLETED_GROUP being one, selected when defining an audit policy. By default Azure SQL audits BATCH_COMPLETED_GROUP together with successful and failed database authentication.

Audit effect

Policy effect in Azure that records a warning and flags matching resources as non-compliant, without ever blocking or altering them.

AUDIT_CHANGE_GROUP

Fires when someone creates, alters or drops an audit or audit specification, so it captures changes to the auditing setup itself; logins and queries are covered by other action groups.

AuditEvent

Category of Key Vault resource logs that tracks each data-plane get, set or delete, noting who called, from which IP address, and whether it succeeded.

AuditIfNotExists

Azure Policy effect that flags a resource as non-compliant if a related resource, identified by details.type and matching existenceCondition, is absent. It only reports and never deploys anything.

Auditing (Azure SQL)

Azure SQL capability that sends database audit logs to Log Analytics, Event Hubs or a storage account; that account is allowed to be in a different region.

Authentication Administrator

Microsoft Entra role for managing authentication methods on individual user accounts. Tenant-wide SSPR and the authentication methods policy lie outside its reach.

Authentication certificate

How Application Gateway v1 trusted backends: the public key (.cer) of the backend's certificate was uploaded into backend settings. On v2, trusted root certificates take its place.

Authentication methods policy

Tenant-level Microsoft Entra policy that switches on each sign-in method, such as FIDO2, Authenticator, certificate-based authentication, TAP or SMS, for chosen users or groups.

Authentication Policy Administrator

Least-privileged Microsoft Entra role for tenant-level SSPR settings and the authentication methods policy, neither of which Authentication Administrator can change.

Authentication strength

Grant control in Conditional Access that restricts which combinations of methods meet a policy, for example the built-in Phishing-resistant MFA. It narrows methods without enabling them; enabling is done in the authentication methods policy.

Authorisation code (grant)

OAuth 2.0 grant used by native and web apps: the user signs in, and the app then acts on their behalf with delegated permissions.

Authorisation levels (Azure Functions)

Key requirements for HTTP triggers in Azure Functions: Anonymous needs no key, Function accepts a function or host key, and Admin requires the master key.

Auto-failover group (failover group)

Azure SQL feature that geo-replicates a group of databases or an entire Managed Instance, failing over automatically behind listener endpoints that stay the same. For Managed Instance it is the sole regional DR option.

Auto-instrumentation

Turning on Application Insights for an app without changing its code, for instance through the App Service blade.

Auto-shutdown

VM option in Azure that deallocates the machine at a fixed time every day to cut costs. Backups continue to run while it is stopped.

Autocomplete

Query API in Azure AI Search that finishes partially typed terms using suggester fields, invoked with suggesterName. To get matching documents back, use Suggestions instead.

AutoGen

Multi-agent framework from Microsoft Research, known for patterns like GroupChat, now succeeded by Microsoft Agent Framework.

Automated Backup (SQL IaaS Agent)

Feature of the SQL IaaS Agent extension: SQL Server instances on Azure VMs get backed up into a storage account.

Automatic backups (Azure SQL)

Backups that Azure SQL takes on its own, allowing point-in-time restore over a window of 1 to 35 days. Keeping backups longer requires long-term retention (LTR).

Automatic scaling (App Service)

Rule-free scale-out choice for Premium v2 to v4 App Service plans that adds prewarmed instances according to HTTP traffic. Scaling on a CPU threshold is not possible with it.

Automation account

Container in Azure Automation that holds runbooks, configurations and assets.

Automation rule

Microsoft Sentinel rule triggered when an incident or alert from any source is created or updated, used to centrally set status, assign owners, apply tags and launch playbooks.

Autoregistration (auto registration)

When enabled on a private DNS zone's virtual network link, VMs in that VNet get A records created automatically, kept in step as their IPs change and removed when they are deleted. A VNet may autoregister into only one private zone.

Autoscale

Azure Monitor capability that adds or removes instances on a schedule or once a metric rule has been true for its full duration. The maximum instance count merely sets a ceiling and never triggers scaling itself.

Autoscale scaling plan

Feature built into Azure Virtual Desktop that powers session hosts on and off and scales them according to a schedule.

Availability set

Grouping that distributes VMs across as many as 3 fault domains and 20 update domains inside a single datacentre, backed by a 99.95% SLA. It offers neither autoscale nor zone distribution.

Availability tests

Synthetic monitoring in Application Insights, using standard tests or custom TrackAvailability tests; the older URL ping tests retire on 30 September 2026.

Availability zones

Separate physical datacentre locations inside one region. Placing VMs in at least two of them earns a 99.99% SLA.

AWS connector (Defender for Cloud) (native AWS connector)

Connector linking Defender for Cloud to Amazon Web Services, finished by running a generated CloudFormation template on the AWS side. If Defender for Servers is enabled, it provisions Azure Arc onto EC2 instances automatically.

az acr build

Azure CLI command for an ACR quick task, which sends the build context to Azure, builds the image there and pushes the result into a registry that already exists.

az acr create

Use this Azure CLI command, specifying a SKU, to provision a new container registry.

az acr credential

Group of Azure CLI commands for viewing or regenerating the admin-user credentials of a registry.

az acr login

Azure CLI command that uses the signed-in Microsoft Entra identity to log Docker in to a registry, so that pushes and pulls work.

az aks

Azure CLI commands for managing AKS. For example, az aks install-cli installs kubectl, while running az aks update or az aks nodepool update with --enable-cluster-autoscaler --min-count --max-count enables autoscaling.

az cognitiveservices account create

Azure CLI command creating a Foundry Tools or Foundry resource based on --location, --sku and --kind. Customer-managed key configuration belongs in --encryption; --assign-identity merely creates a managed identity.

az container create

Azure CLI command that deploys a container group to Azure Container Instances. Its options cover the image, exposed ports, a VNet subnet, the restart policy, and registry access through credentials or --acr-identity.

az deployment group create

Azure CLI command for deploying a template into a resource group that already exists.

az deployment sub create

Azure CLI command for deploying a template at the subscription level, which is how resource groups themselves can be created.

az ml model restore

Command in the Azure Machine Learning CLI that un-archives a model or model version so it shows up in listings again, for rollback or auditing.

az ml online-deployment get-logs

Azure Machine Learning CLI command fetching container logs for a deployment, from the inference server by default or from storage-initializer, to troubleshoot issues like init() failures or missing packages.

az ml online-endpoint update --traffic

Azure CLI command for dividing live requests across the deployments behind one online endpoint, given as name=percentage pairs such as blue=90 green=10; the values have to add up to either 100 or 0.

az network bastion

Group of Azure CLI commands (rdp, ssh and tunnel) for reaching VMs through Bastion; for example, az network bastion rdp starts mstsc against a machine that has no public IP address.

az network dns zone import

Single Azure CLI step that reads a BIND-format zone file and either builds a new Azure DNS zone from it or merges its records into an existing one.

AZ SKU (availability zone SKU)

Any VPN or ExpressRoute gateway SKU carrying the AZ suffix (VpnGw1AZ to 5AZ, ErGw1Az to 3Az). In regions with availability zones its instances spread across zones; in other regions it deploys regionally, becoming zone-redundant once zones are introduced there.

az storage blob

Set of Azure CLI commands for working with blob data; upload-batch pushes a whole local folder, while copy start-batch copies between containers on the server side.

azcmagent

CLI that ships with the Azure Connected Machine agent. Running azcmagent connect registers a server with Azure Arc, and supplying a service principal ID plus a secret or certificate makes that onboarding unattended.

AzCopy

Microsoft's command-line utility for moving data into, out of and between storage accounts; queue management and copying a running VM are outside what it can do.

AZFWNetworkRule

When Azure Firewall logs in resource-specific mode, entries produced by its network rules land in this Log Analytics table.

AZFWThreatIntel

Log Analytics table, in resource-specific mode, where Azure Firewall writes events raised by threat intelligence.

Azure ABAC (attribute-based access control)

Attribute-based conditions added on top of Azure RBAC role assignments, such as granting access only to blobs carrying a certain index tag. Blobs (ADLS Gen2 included) and queues support them; Azure Files and Tables do not.

Azure AD B2C

Identity platform for customer-facing apps; since 1 May 2025 new customers can't buy it and are directed to its successor, Microsoft Entra External ID. Tokens it issues can be checked by API Management's validate-jwt policy via its OpenID configuration.

Azure Advisor

Azure service that reviews resources you already run and recommends improvements in cost, performance, reliability and security based on best practice.

Azure AI Administrator

Built-in role meant for Azure Machine Learning and Foundry hubs only, where it holds every control plane permission over Azure AI and the services it relies on. Today's Foundry resources are governed by Foundry Owner or Foundry Account Owner instead.

Azure AI Content Safety

Foundry Tool that scores text and images for hate, sexual, violent and self-harm content, returning a severity level for each category; Foundry guardrails are built on the same technology.

Azure AI Developer

Built-in role scoped to an Azure Machine Learning workspace or hub: holders can do anything inside it except administer the workspace itself. For Foundry projects, the equivalent roles are Foundry Owner and Foundry User.

Azure AI Face (Face service)

Foundry Tool limited to human faces: it detects them, verifies whether two match (1:1) and identifies a person from a group (1:many). Verification and identification are Limited Access features.

Azure AI Search

Managed Azure service that builds indexes over your content and answers keyword, vector, hybrid and semantically ranked queries, optionally with AI enrichment. Retrieval-augmented generation, Foundry agents and knowledge mining all use it to fetch relevant content.

Azure AI Search admin key

Either of a search service's two admin API keys (primary and secondary), each granting full read and write access and each regenerable. Rotation without downtime: point clients at the secondary, regenerate the primary, then do the reverse.

Azure AI Search partition (partition)

Storage and I/O unit of a search service, each holding part of the indexes. Adding partitions increases storage and indexing throughput; the number of search units equals replicas multiplied by partitions.

Azure AI Search query key

Read-only API key used only to query the documents collection of an index; a service can hold up to 50. Every query key works across all indexes, and query keys are created or deleted rather than regenerated.

Azure AI Search replica (replica)

Additional copy of a search service's engine and indexes. Replicas spread queries for load balancing and improve availability, so adding them is the fix when queries are throttled with HTTP 503.

Azure AI Search tool (AzureAISearchTool)

Tool that lets an agent query an Azure AI Search index that already exists. You supply project_connection_id and index_name; by default it runs vector_semantic_hybrid queries and returns five results (top_k 5).

Azure Analysis Services

Azure service hosting tabular OLAP models for large numbers of Power BI and Excel users; semantic models in Power BI Premium are its modern counterpart.

Azure Arc

Azure service for managing servers that live outside Azure without moving them, by installing the Azure Connected Machine agent; it does not migrate anything.

Azure Arc-enabled servers

Servers running Windows or Linux outside Azure that become Azure resources once the Azure Connected Machine agent is installed; data collection rules can then drive the Azure Monitor agent on them.

Azure Automation

Azure service that runs runbooks, scripts that carry out imperative steps such as scaling Azure Virtual Desktop host pools. It is not an infrastructure-as-code tool.

Azure Automation State Configuration

DSC service within Azure Automation, due to retire on 30 September 2027. It compiles configurations, assigns them to onboarded machines that are running, and reports back on compliance.

Azure Backup

Azure's backup service, which keeps recovery points, long-term retention included, in a Recovery Services vault. It restores data rather than failing workloads over, which is the job of Site Recovery.

Azure Backup always-on soft delete (enhanced soft delete)

Setting on Recovery Services and Backup vaults that, once enabled, is permanent. Deleted backup data stays recoverable for 14 to 180 days (14 by default, first 14 free); blob and Azure Files operational backups aren't covered.

Azure Backup reports (Backup Reports)

Reporting for Azure Backup, fed by diagnostic settings on each vault. Log Analytics workspaces receiving the data may be in any region, whereas a storage account target has to share the vault's region.

Azure Backup security PIN

Short-lived PIN, valid for five minutes, created from a Recovery Services vault's Properties. Hybrid backups through MARS, MABS or DPM ask for it before critical actions such as stopping protection with data deletion or changing the passphrase; Azure VM backups aren't covered.

Azure Bastion

Managed service that lets you open RDP and SSH sessions from the portal over TLS on port 443, so VMs need no public IP. Just-in-time VM access differs in that it opens ports 3389 and 22.

Azure Batch

Azure service that schedules parallel, HPC and rendering jobs onto pools of compute nodes it scales automatically; multi-instance tasks support MPI workloads.

Azure Blueprints

Deprecated service bundling policies, roles and templates, each assignment staying live-linked and scoped to a single subscription. Nothing new could be defined after 31 July 2026, and on 31 January 2027 it retires in favour of deployment stacks and Template Specs.

Azure Boards

Work-tracking service within Azure DevOps.

Azure Cache for Redis (Azure Redis Cache)

Managed in-memory cache placed close to an application for session state and cache-aside query results. It is being retired (Enterprise on 31 March 2027; Basic, Standard and Premium on 30 September 2028), so Azure Managed Redis is the choice for new designs.

Azure CLI (CLI)

Command-line tool for managing Azure that runs on any platform; examples include az login, az storage queue and az policy state trigger-scan.

Azure CNI

Network plugin for AKS in which each pod receives an IP address from the VNet; virtual nodes depend on it.

Azure CNI Overlay

AKS networking option where pods draw IPs from a private overlay range and VNet addresses are consumed only by nodes; it works with Windows nodes.

Azure Compute Gallery

Azure resource for storing and sharing versions of VM images; anyone publishing a new version into it needs write access to the gallery.

Azure Connected Machine agent

Agent from Azure Arc installed on servers outside Azure. Once a server is Arc-enabled this way, services such as Defender for Cloud can push extensions to it, though the agent doesn't gather VM logs itself.

Azure Connected Machine Onboarding

Narrowly scoped built-in role, typically given to a service principal, whose only purpose is onboarding machines into Azure Arc in bulk.

Azure Container Apps

Container hosting built on KEDA where Azure runs the underlying cluster for you; apps scale automatically and can be zone-redundant.

Azure Container Instances (ACI)

Way to run container groups without any cluster, billed per second. It offers neither autoscaling nor spreading across zones, and Azure Machine Learning treats it as a legacy v1 deployment target.

Azure Container Registry (ACR)

Private Azure registry for container images. Images can be geo-replicated, cleaned up by retention policies and built by ACR Tasks, while webhooks let a push kick off continuous deployment.

Azure Container Registry SKUs

Azure Container Registry comes in Basic, Standard and Premium. Every tier includes ACR Tasks and the admin user; private endpoints, content trust, connected registries and dedicated data endpoints are Premium-only.

Azure Container Service

Azure's container orchestration service before AKS, now retired; it never had an on-premises version.

Azure Content Delivery Network (CDN)

Service caching static web content on edge servers near users. New profiles can no longer be made on the classic Azure CDN Standard from Microsoft, which retires on 30 September 2027; Azure Front Door Standard or Premium is the route for new deployments.

Azure Content Moderator (Content Moderator)

Older moderation service, reached through the /contentmoderator path, that flagged content as a yes/no result and supported custom term lists. It is deprecated, retiring on 15 March 2027, and Azure AI Content Safety replaces it.

Azure Content Understanding in Foundry Tools (Content Understanding)

Foundry Tool whose generative AI analyzers turn documents, images, audio and video into structured fields by extracting, classifying or generating values.

Azure Cosmos DB Data Migration Tool

Utility that moves data from sources such as SQL Server into Azure Cosmos DB.

Azure custom roles

Roles you author yourself in Azure RBAC, listing your own permitted actions, for cases no built-in role covers; a tenant can hold as many as 5,000.

Azure CycleCloud

Tool for creating and operating HPC clusters on Azure around third-party schedulers like Slurm, LSF or PBS Pro.

Azure Data Explorer

KQL-based service for fast, interactive analysis of telemetry and logs at petabyte scale; Time Series Insights users moved to it as the successor.

Azure Data Factory

Managed data integration service for ETL and ELT, built from pipelines, copy activities, triggers, mapping data flows and integration runtimes. It works in batches rather than routing individual transactions.

Azure Data Lake Analytics

Analytics service based on U-SQL that held no data of its own; it was retired in February 2024.

Azure Data Share

Azure service for sending data to another organisation's subscription as full or incremental snapshots on a schedule.

Azure Data Studio

Database tool retired on 28 February 2026 that once carried the Azure SQL Migration extension. Since then, Database Migration Service jobs are started from the Azure CLI, PowerShell or the Azure portal.

Azure Database for MariaDB

Managed MariaDB offering, now retired, under the Microsoft.DBforMariaDB resource provider; resetting the server's admin password required the Microsoft.DBforMariaDB/servers/write permission.

Azure Database for PostgreSQL

Azure's managed PostgreSQL. It grows by scaling up and by adding read replicas rather than multi-master writes; to spread writes horizontally you use its elastic clusters feature, based on Citus.

Azure Database for PostgreSQL flexible server

Current deployment option of Azure's managed PostgreSQL. It scales up and offers read replicas but not multi-master; writes are distributed horizontally through the Citus-based elastic clusters feature.

Azure Database Migration Service (DMS)

Azure service for moving whole instances or many databases at once into Azure SQL targets such as SQL Managed Instance, either online or offline.

Azure DDoS Protection

Azure defence for public IP addresses against volumetric and protocol-level DDoS attacks. Paid tiers (DDoS Network Protection and DDoS IP Protection) build on the basic infrastructure protection that comes free.

Azure Dedicated HSM

Thales hardware security module dedicated to one tenant and placed in your own VNet; the service is being retired and takes no new customers.

Azure DevOps

Microsoft's suite of DevOps services, among them Azure Boards and Azure Pipelines.

Azure DevOps Administrator

Microsoft Entra role for managing enterprise-level Azure DevOps policies across the organisations connected to the tenant; it gives no rights to register apps or grant admin consent.

Azure Disk Backup

Azure Backup protection for managed disks that needs no agent, taking snapshots kept in the same region; recovery isn't orchestrated automatically.

Azure Disk Encryption (ADE)

Due to retire on 15 September 2028, this feature encrypts VM OS and data disks from inside the guest (BitLocker or DM-Crypt), keeping keys in Key Vault. Dynamic volumes, Write Accelerator disks and ephemeral OS disks aren't supported.

Azure Disk Encryption for volume encryption

Key Vault access policy setting (enabled-for-disk-encryption) without which Azure Disk Encryption can't store keys and secrets in the vault; the vault also has to be in the same region as the VM.

Azure DNS

Family of Azure services for hosting and resolving DNS, covering public zones, private zones and DNS Private Resolver; you can't register domain names through it.

Azure DNS name servers

Four authoritative name servers (ns1-xx.azure-dns.com, .net, .org and .info) that Azure allocates to each public zone and lists on the zone's overview page; every one of them belongs in the NS records at the domain registrar.

Azure DNS Private Resolver

Managed resolver inside a VNet that removes the need for DNS server VMs in hybrid setups. Its inbound and outbound endpoints each need their own subnet of at least /28 delegated to Microsoft.Network/dnsResolvers, and it can link only to a VNet in the same region.

Azure Document Intelligence in Foundry Tools (Document Intelligence, Form Recognizer)

Foundry Tool that pulls text and fields out of forms and documents using read, layout, prebuilt models (such as invoice and receipt) and custom models.

Azure endpoint

Kind of Traffic Manager endpoint pointing at an Azure service, such as a web app or a public IP resource that has a DNS name; a MultiValue profile can't use it.

Azure Event Hubs

Azure service for ingesting telemetry at high volume over HTTPS or AMQP; diagnostic settings can send data to it.

Azure Extended Network (extended network for Azure)

Windows Admin Center feature letting migrated VMs keep their IP addresses by stretching an on-premises subnet into Azure; two appliance VMs carry a VXLAN tunnel between them, and up to 250 addresses can be extended.

Azure Extended-Network Gateway

The appliance VM placed in Azure for Azure Extended Network. Its OS must be Windows Server 2022 Datacenter: Azure Edition, and it needs two NICs: one on the extended subnet, one on a routable subnet.

Azure Face service (Face API)

Service within Azure Vision that detects faces, verifies one face against another and identifies a face among many. Access is limited, and among the Vision options it alone can say whose face it is.

Azure File Sync

Agent installed on Windows Server on premises that keeps a local cache of an Azure file share, syncing changes both ways and tiering cold files to the cloud.

Azure Files

Azure's managed file shares over SMB or NFS. There is no Archive tier, and a single encryption key applies across the whole storage account.

Azure Files backup

Azure Backup for file shares, using a Recovery Services vault that must share the storage account's region. Schedules are either daily or hourly; hourly ones repeat every 4, 6, 8 or 12 hours, with 1 and 2 added in newer policies.

Azure Files OAuth over REST

Capability allowing Microsoft Entra users, groups and managed identities to use OAuth tokens against the FileREST data API. The roles that grant it carry readFileBackupSemantics or writeFileBackupSemantics; the SMB share roles don't apply.

Azure Firewall

Stateful network firewall run by Azure as a managed service; it can be placed in Virtual WAN hubs and administered through Firewall Manager.

Azure Firewall Manager

Service for administering Azure Firewall policies centrally, letting child policies inherit from a parent across subscriptions and regions.

Azure Firewall Premium

Top Azure Firewall SKU, which builds on Standard with IDPS, TLS inspection, URL filtering and web categories; using those features requires a firewall policy on the Premium tier.

Azure Firewall rule collection

Set of rules of a single type (DNAT, network or application) that share one action and one priority and sit within a rule collection group. Priority only decides order among collections of the same rule type.

Azure Firewall Standard

Mid-level Azure Firewall SKU: it filters with application and network rules, can block known-bad addresses using threat intelligence and acts as a DNS proxy. Inspecting TLS traffic and IDPS are Premium-only.

Azure Front Door

Layer-7 global front end that fails over between origins using anycast, terminates TLS, routes requests by URL path and can apply a rate-limiting WAF.

Azure Functions

Serverless compute for event-driven code, started by triggers such as HTTP, timer, Blob or Event Grid and hosted on a Consumption, Premium or Dedicated plan.

Azure Functions Consumption plan

Older serverless hosting plan for Functions that caps each run at 10 minutes and lacks both VNet integration and inbound private endpoints, all of which Flex Consumption, Premium and Dedicated plans provide.

Azure Functions Dedicated plan (App Service plan)

Running Functions on an App Service plan. Executions have no time limit, and from the Basic tier upwards apps can integrate with a VNet.

Azure Functions Premium plan (Elastic Premium)

Functions hosting plan that keeps instances pre-warmed to avoid cold starts and supports VNet integration; executions default to 30 minutes, a limit you can raise in host.json.

Azure geography

Grouping of Azure regions such as United States; restoring a Key Vault backup is allowed only inside the geography it came from.

Azure Government

Separate cloud for US government workloads, physically isolated from global Azure, so VNet peering between the two isn't possible.

Azure Hybrid Benefit

Licensing benefit that cuts Azure costs by reusing Windows Server or SQL Server licences with Software Assurance, or RHEL and SUSE subscriptions. Ubuntu isn't eligible, nor is the DTU purchasing model of Azure SQL.

Azure Information Protection (AIP)

Service that classifies and protects documents in Office apps, applying a single label to each (if several match, the last one in the policy wins). Its classic client has been retired, with Microsoft Purview sensitivity labels taking over.

Azure Instance Metadata Service (IMDS)

Endpoint at the non-routable address 169.254.169.254, reachable only from within a VM, that returns metadata about the VM and issues managed identity tokens. An outbound NSG rule denying the AzurePlatformIMDS tag cuts off access.

Azure Internet Analyzer

Now-retired Azure service for measuring how internet performance looked to end users connecting to Azure endpoints.

Azure IR

Integration runtime in Data Factory that can connect only to data stores in the cloud.

Azure Key Vault (Key Vault)

Azure service holding secrets, keys and certificates. If the region has a paired region in the same geography, contents replicate to it, and during a best-effort failover initiated by Microsoft the vault can only be read.

Azure Key Vault provider for Secrets Store CSI Driver (azure-keyvault-secrets-provider)

AKS add-on that gives pods access to Key Vault certificates, keys and secrets by mounting them as CSI volumes; it can optionally copy them into Kubernetes secrets too.

Azure KMS (Key Management Service)

Endpoint used to activate Windows on Azure VMs: azkms.core.windows.net (20.118.99.224 and 40.83.235.53) on TCP port 1688. With forced tunnelling in place, user-defined routes sending those IPs to next hop Internet keep activation working.

Azure Kubernetes Service Cluster Admin Role

Built-in role whose only permission is listing the cluster admin credential (kubeconfig) of an AKS cluster.

Azure Language in Foundry Tools (Azure AI Language, Text Analytics)

Foundry Tool offering natural language processing over existing text, such as sentiment, key phrase extraction, entity recognition, PII detection, summarisation and language detection. Prebuilt features work without training, and nothing new is generated.

Azure Lighthouse

Azure service that lets a managing tenant work on resources delegated to it from other tenants; resources aren't moved or migrated.

Azure Load Balancer

Layer-4 load balancer operating within a region, with zone redundancy on the Standard SKU; it has no WAF, doesn't terminate TLS and can't route by URL.

Azure Login action (azure/login)

Step in a GitHub Actions workflow that authenticates to Azure, either as the service principal of an Entra app or as a user-assigned managed identity; using OpenID Connect avoids storing any secret.

Azure Machine Configuration (guest configuration)

Azure Policy capability that checks or enforces settings at the OS level on Azure VMs and Arc-enabled machines; it replaces Automation State Configuration and the DSC extension.

Azure Machine Learning (AML)

Azure platform where you train, deploy, monitor and retrain models of your own, practising MLOps through tools such as pipelines, online endpoints, model monitoring and prompt flow.

Azure Machine Learning CLI v2 (az ml)

Extension adding az ml commands to the Azure CLI, used to create jobs, assets, endpoints and deployments defined in YAML files.

Azure Machine Learning component (component)

Reusable building block for a pipeline, versioned and self-contained, much like a function: it declares a name, inputs and outputs, and bundles the command, code and environment it runs.

Azure Machine Learning designer (Designer)

Visual, drag-and-drop tool inside Azure Machine Learning studio for assembling pipelines that train models. Foundry models are browsed and deployed elsewhere.

Azure Machine Learning environment (environment)

Versioned asset that pairs a Docker image with a pip or conda specification, so every job or deployment using it gets identical dependencies. You point to it by name plus a version number, or by name with @latest.

Azure Machine Learning pipeline (ML pipeline)

Reusable job that links components together, for example data preparation then training then scoring, and can be run on a schedule.

Azure Machine Learning registry (Azure ML registry)

Shared store, with its own access control and lineage tracking, for versioned models, environments, components and data assets used by many workspaces such as dev, test and prod. Workspaces still exist alongside it.

Azure Machine Learning SDK v2 (azure-ai-ml)

Python SDK currently used with Azure Machine Learning, centred on the MLClient class. It has no logging API, so MLflow is used to log metrics.

Azure Machine Learning workspace (AML workspace)

Main Azure Machine Learning resource, holding models, environments, components and data assets, recording job history and pointing to compute and datastores. Anything registered there is owned by that workspace unless it is put in a registry.

Azure Migrate

Azure service that discovers, assesses and migrates on-premises servers using an appliance deployed on premises; its project is created in the destination subscription.

Azure Migrate appliance

Discovery VM run on premises and registered to exactly one Azure Migrate project; it is deployed from a Hyper-V VHD, a VMware OVA or an installer script, finds servers without agents and collects the performance data that assessments draw on.

Azure Migrate project

Resource created in the destination subscription to store what Azure Migrate discovers and assesses; it is separate from the appliance running on premises.

Azure Monitor

Observability platform for Azure that brings together metrics, logs and traces from both Azure and hybrid resources so they can be analysed and alerted on.

Azure Monitor agent (AMA)

Agent now used to collect logs from a machine's guest OS, driven by data collection rules; it took over from the Log Analytics agent (MMA).

Azure Monitor alerts

Rules in Azure Monitor that send notifications or trigger actions once a condition on metrics, logs or the activity log is satisfied.

Azure Monitor Logs

Within Azure Monitor, the store for log data: records of logs and performance counters are kept in Log Analytics workspaces, where KQL queries retrieve them.

Azure Monitor Metrics

Part of the Azure Monitor data platform that stores numeric values as time series. Platform metrics are gathered without any setup and retained for 93 days.

Azure Monitor Private Link Scope (AMPLS)

Azure resource linking Azure Monitor resources to private endpoints. Networks sharing one DNS should use a single scope, and peered VNets can use the same endpoint.

Azure Monitor workspace

Workspace that holds only Prometheus metrics; log data belongs in a Log Analytics workspace instead.

Azure NetApp Files

Azure service offering managed file volumes over NFS and SMB.

Azure Network Adapter

Windows Admin Center option for linking a single Windows Server to a VNet by point-to-site VPN. If the VNet has no VPN gateway it creates one, taking about 25 minutes, and no VPN hardware is needed on premises.

Azure Network Function Manager

Azure service for deploying network functions from partners, such as a mobile packet core, onto Azure Stack Edge devices; it plays no part in securing VNets.

Azure OpenAI (Azure OpenAI in Foundry Models)

Use of OpenAI models in Azure, including GPT, o-series, embeddings, image and Whisper, through either a Foundry resource or an Azure OpenAI resource. Content Understanding isn't available from a standalone Azure OpenAI resource.

Azure OpenAI AvailabilityRate (Model Availability Rate)

Metric for Azure OpenAI calculated as total calls less server errors, divided by total calls; it reveals unavailability on the service side, meaning HTTP 5xx responses.

Azure OpenAI Embedding skill (AzureOpenAIEmbeddingSkill)

Skill in an AI Search skillset that sends each chunk to an embedding model deployment (text-embedding-3-small, text-embedding-3-large or ada-002) during indexing to produce vectors; charges come from Azure OpenAI.

Azure OpenAI in Foundry Models (Azure OpenAI Service)

OpenAI models offered by Azure as a fully managed service with guardrails built in, covering GPT-4.1, GPT-5, o-series, image, audio and embeddings. Rather than running infrastructure, you pick a deployment type.

Azure OpenAI On Your Data

Feature of Azure OpenAI, now deprecated, for grounding chat answers in your own content retrieved from a search index. Its replacement for new work is Foundry Agent Service paired with Azure AI Search or Foundry IQ.

Azure OpenAI v1 API

Azure OpenAI API without version parameters, called from the ordinary OpenAI() client with base URL https://<resource-name>.openai.azure.com/openai/v1/; the host comes from the resource name rather than the project.

Azure Pipelines

CI/CD service within Azure DevOps that deploys applications and infrastructure as code, with environments, approvals and checks.

Azure Policy

Azure service that audits and enforces how resources are configured, for example their location, SKU or tags, using definitions and assignments. It neither deploys resources nor controls access.

Azure Policy for Kubernetes (Azure Policy add-on for AKS)

Admission control for Kubernetes based on Gatekeeper v3, installed as an AKS add-on or, on other clusters, an Arc extension. It acts as a webhook so that non-compliant pods are rejected by Azure Policy definitions set to Deny.

Azure Policy initiative

Collection of Azure Policy definitions that are assigned as one unit; security policies and custom standards in Defender for Cloud have to take this form.

Azure PowerShell (Az PowerShell module)

Set of Az.* modules from Microsoft that let you manage Azure from PowerShell, using cmdlets like Set-AzStorageAccount.

Azure Private Link (Private Link)

Azure capability placing PaaS services such as Azure Storage behind a private endpoint in your VNet. Traffic stays on the Microsoft backbone with no public IP involved, though VNet and DNS configuration are required.

Azure public peering

Older ExpressRoute peering for reaching Azure's public endpoints; it is deprecated for new circuits, with Microsoft peering in its place.

Azure RBAC

Azure's model for granting access: built-in or custom roles are assigned at a scope to users, groups or managed identities. Calling Foundry keylessly with Entra ID requires a data-plane role, for example Foundry User (formerly Azure AI User) or Cognitive Services OpenAI User.

Azure RBAC permission model (Key Vault)

Way of authorising access to Key Vault through Azure role assignments, for instance Key Vault Secrets User, in place of vault access policies.

Azure Relay

Messaging service connecting cloud and on-premises endpoints through outbound connections on port 443, without a VPN, inbound ports or VNet routing. The on-premises data gateway and App Service Hybrid Connections rely on it.

Azure Reservations

Discounts on Azure resources such as dedicated hosts or SQL vCores in return for committing to a one- or three-year term.

Azure reserved addresses

Five addresses in each subnet that Azure keeps for itself: the network address, the default gateway, two for Azure DNS and the broadcast address. A /24 therefore offers 251 usable addresses and a /29 only 3; IPv4 subnets of /30 or /31 aren't allowed.

Azure Resource Mover

Azure service that relocates existing VMs, disks and NICs to another region or resource group, checking their dependencies along the way.

Azure Route Server

Managed service that peers over BGP with network virtual appliances in a VNet and installs the learned routes on the VMs. It works purely in the control plane, so traffic never passes through it.

Azure security baseline (Machine Configuration)

Built-in Machine Configuration baselines for Azure and Arc-enabled machines: the Azure Security Baseline for Windows or Linux and the CIS Linux Benchmarks. Since built-in definitions are read-only, you tailor them with the Modify settings wizard under Policy > Machine Configuration.

Azure Service Fabric

Platform for microservices that runs both in Azure and on premises, supporting stateful services, upgrades service by service and automatic repair based on health.

Azure Service Health (Service Health)

Dashboard tailored to your subscriptions that reports Azure platform outages, scheduled maintenance and health advisories affecting them.

Azure Site Recovery (ASR)

Disaster recovery service replicating VMs to a secondary site or region; recovery time is measured in minutes and recovery points are kept for no longer than 15 days.

Azure Site Recovery Provider

Component installed on each Hyper-V host, or on the VMM server where one is used, which registers that server with a Recovery Services vault and manages replication.

Azure Speech in Foundry Tools (Azure Speech)

Foundry Tool for spoken language, able to transcribe audio into text, synthesise voice from text, translate what is said and run live voice conversations.

Azure SQL auditing

Azure SQL feature that sends audit logs to Event Hubs, a Log Analytics workspace (the only KQL-queryable option) or a storage account, which in the portal must be in the server's region and can't be premium FileStorage or legacy BlobStorage.

Azure SQL connection policy (Proxy / Redirect)

Azure SQL option deciding how clients reach the database: via the gateway with Proxy, or straight to the hosting node with Redirect. It affects the network path only, not who may connect.

Azure SQL Database

Platform-as-a-service database offered as a single database or in an elastic pool, sized up to 4 TB or 128 TB on Hyperscale. SQL Agent, CLR and queries across databases aren't available.

Azure SQL Managed Instance (MI)

Fully managed SQL Server instance offering almost complete compatibility, including SQL Agent, CLR and queries across databases; disaster recovery to another region is achieved with auto-failover groups.

Azure SQL Migration extension

Azure Data Studio extension, now retired along with that tool in February 2026, that ran online or offline Database Migration Service migrations of databases to SQL Database or SQL Managed Instance. DMS is now driven from the Azure portal, PowerShell or the Azure CLI.

Azure Stack Edge

Edge appliance managed by Microsoft and administered from Azure, bringing compute, AI and network functions to on-premises sites.

Azure Storage Explorer (Storage Explorer)

Desktop application for handling data in storage accounts that already exist, such as blobs and their tiers, file shares, tables, queues and SAS URLs; creating a storage account isn't possible from it.

Azure Storage firewall

Network rules on a storage account, applied when public network access is limited to selected networks. Only the listed IP ranges, VNet subnets, resource instances and trusted services can reach the public endpoint; all other traffic is refused.

Azure Stream Analytics

Serverless service that processes streaming data with a SQL-like language, offering windowing functions and anomaly detection out of the box.

Azure Synapse Link for Cosmos DB

Feature for querying Cosmos DB's analytical column store without ETL and without using request units from the transactional store. New projects can no longer adopt it and should use Cosmos DB mirroring in Microsoft Fabric.

Azure Translator in Foundry Tools (Translator)

Foundry Tool that translates text and whole documents from one language into another; extracting fields from forms is not something it does.

Azure Update Manager

Azure's patching service: it assesses which OS updates Azure VMs and Arc-enabled servers are missing and installs them, whether right away or within scheduled maintenance windows.

Azure Virtual Desktop (Windows Virtual Desktop)

Azure-hosted Windows desktop and app service; to add or remove session hosts in a host pool you use either an Autoscale scaling plan or Automation runbooks.

Azure Virtual Machines for deployment

Access policy option on a Key Vault (enabled-for-deployment) that permits Microsoft.Compute to pull certificates, kept as secrets, into VMs at creation time. Azure Disk Encryption doesn't rely on this setting.

Azure Virtual Network Manager

Service for centrally managing connectivity, as hub-and-spoke or mesh, and security admin rules across VNets in many subscriptions. VNets in other tenants must be added as static members, because dynamic membership driven by Azure Policy works only within one tenant.

Azure Vision in Foundry Tools (Azure AI Vision, Computer Vision)

Foundry Tool for analysing images, reading text from them (OCR) and detecting faces. Image Analysis API versions 3.2 and 4.0 are both deprecated, with retirement set for 25 September 2028.

Azure VM Agent

Software inside each VM that handles communication with the Azure fabric controller and carries out VM extensions, so no extension can be installed on a VM lacking it.

Azure VM backup policy

Policy defining when Azure Backup protects a VM (once a day or once a week, or several times a day under the Enhanced policy) and how long recovery points are retained at daily, weekly, monthly and yearly levels.

Azure VPN Client

Microsoft's VPN app for Windows 11 and macOS, needed for point-to-site connections that authenticate with Entra ID; you set it up by importing the azurevpnconfig.xml file from the profile package.

Azure Windows VM Agent (Windows VM agent)

Small service in each Windows VM through which the Azure fabric installs and runs extensions, the backup extension included. Collecting monitoring telemetry is left to other agents.

azure-ai-projects (AIProjectClient)

Python SDK for Microsoft Foundry; its AIProjectClient opens a connection to a project, and telemetry.get_application_insights_connection_string() fetches the connection string of the Application Insights resource linked to that project.

azure-core-tracing-opentelemetry

Python package connecting Azure SDK calls to OpenTelemetry; for tracing agents on the client side it is installed together with opentelemetry-sdk and azure-ai-projects.

Azure-provided DNS

Default resolver for a VNet, at 168.63.129.16, which answers with records from private DNS zones linked to that VNet; a custom DNS server has to forward queries to it to resolve those records.

Azure-SSIS IR

When Data Factory needs to execute SSIS packages, it uses this integration runtime, hosting the SSISDB catalogue in either SQL Managed Instance or SQL Database.

AzureActivity

Table in Log Analytics where a subscription's activity log is stored.

AzureAIOpenTelemetryTracer

Callback tracer for LangChain and LangGraph that sends OpenTelemetry spans to Foundry and Azure Monitor, but only if supplied as config={'callbacks':[tracer]}; the enable_content_recording setting decides whether message content is captured.

AzureBackupReport (Azure Backup Reporting Data)

Diagnostics category on a vault, now legacy, that fed Backup reports and worked only with Azure diagnostics mode. Its replacement is the set of resource-specific Core Azure Backup Data events.

AzureBastionSubnet

Name that Azure Bastion's dedicated subnet must have. Since 2 November 2021 it must be /26 or larger for all SKUs needing one (every SKU but Developer); previously /27 was allowed.

AzureCosmosDB (service tag)

Service tag covering Azure Cosmos DB's IP ranges, which can be scoped to a region and used as the destination of an outbound NSG rule.

AzureDiagnostics

Log Analytics table shared by many services, receiving Azure resource logs from diagnostic settings that use the legacy Azure diagnostics mode, Azure Firewall logs being one example. Guest operating system logs don't go here.

AzureFirewallManagementSubnet

Subnet (minimum /26) set aside for the management NIC of Azure Firewall; that NIC must have a public IP address of its own and a default route to the internet.

AzureFirewallSubnet

Mandatory name of the subnet, /26 or bigger, dedicated to hosting Azure Firewall.

AzureFrontDoor.Backend

Service tag for the IP addresses Front Door uses when contacting origins. Pairing it with a filter on the X-Azure-FDID header in an access restriction ensures only your own Front Door instance gets through.

AzureFrontDoor.FirstParty

Service tag that Microsoft reserves for its own Front Door-hosted services; locking down your origin is not what it is for.

AzureFrontDoor.Frontend

Service tag covering the Front Door addresses that clients connect to, applied when controlling outbound traffic.

AzureKeyCredential

Credential type in the Azure SDKs that authenticates with a fixed API key, in contrast to token-based credentials like DefaultAzureCredential.

AzureKeyVault (service tag)

Service tag, usable outbound and optionally regional, that represents the IP ranges of Azure Key Vault.

AzureLoadBalancer (service tag)

Service tag standing for 168.63.129.16, which Azure's infrastructure load balancer uses as the source of its health probes; rules using it match probe traffic, never client requests.

AzureMetrics

When a diagnostic setting exports platform metrics with AllMetrics ticked, they arrive in this Log Analytics table.

azureml:// URI (datastore URI)

Data reference syntax in Azure Machine Learning, written azureml://datastores/<name>/paths/<path>, that locates data through a datastore already registered in the workspace.

AzureNetworkAnalytics_CL

Table in Log Analytics populated by Traffic Analytics with processed NSG flow log results; each field name ends with a type suffix, for example FlowType_s, SubType_s or FlowStartTime_t.

AzurePlatformIMDS (service tag)

Service tag for the Instance Metadata Service at 169.254.169.254, meaningful only outbound. Denying it in an outbound NSG rule stops the VM reaching IMDS; inbound rules using it do nothing.

AzureRM

Former Azure PowerShell module, deprecated on 29 February 2024 and superseded by Az; for example, Get-AzureRmRoleDefinition is now Get-AzRoleDefinition.

azurevpnconfig.xml

Profile file for the Azure VPN Client, found in the P2S profile package downloaded once the gateway is set up for Entra ID authentication; users import it, or it is pushed out to them.

B-series

Burstable VM family that accumulates CPU credits while running under its baseline and uses them up when it bursts above it.

B2B collaboration

Microsoft Entra feature that invites external users one by one as guests; by itself it doesn't provision, approve or expire their access automatically.

B2B direct connect

Microsoft Entra cross-tenant access setting that applies only to shared channels in Teams.

Backend pool

Targets of a load balancer, identified by IP address or NIC IP configuration. A pool can't span VNets, and a Standard load balancer won't accept a VM that has a Basic public IP.

Backend settings (backend HTTP settings)

Reusable Application Gateway configuration, shareable between rules, covering how backends are contacted: protocol and port, any host name override, a custom health probe and the certificates trusted on the backend.

Backlogged Input Events

Stream Analytics metric showing how many received input events are still waiting to be processed. If it never drops back to zero, the job is falling behind and should be given more streaming units.

Backup and restore (Key Vault)

Key Vault feature producing an encrypted blob of a stored object; restoring it works only into a vault within the same subscription and the same Azure geography as the original.

Backup center

Single pane in Azure Backup for managing all your vaults and backup policies together.

Backup Contributor

Azure role allowed to manage backups within a Recovery Services vault, though it can neither create vaults nor give access to others.

Backup Management Service

Service application of Azure Backup; to back up VMs encrypted with Azure Disk Encryption, it needs access to the vault's keys and secrets, granted by an access policy or a Key Vault role.

Backup MUA Operator

To perform a backup operation that multi-user authorisation (MUA) protects, a user needs this role assigned on the relevant Resource Guard.

Backup Operator

Built-in role for day-to-day vault work: starting backups and restores. Deleting backups, creating vaults and creating policies are all beyond it.

Backup policy

Setting in an Azure Backup vault fixing when one type of workload is backed up and for how long. Policies don't extend beyond their vault, so VM and Azure Files policies must be created in each vault separately.

Backup storage redundancy (storage replication type)

Replication choice for a Recovery Services vault (GRS unless you pick LRS or ZRS). Set it before protecting the first item, because it is locked once backup has been configured.

Backup vault

Vault type in Azure Backup aimed at newer workloads, for instance managed disks, Azure Blobs, AKS and Azure Database for PostgreSQL. Protecting Azure VMs, Azure Files or MARS backups requires a Recovery Services vault instead.

BACPAC

Export file holding both the schema and the data of a SQL database. Because the export is only consistent if nothing writes to the database meanwhile (or if you export from a copy), it counts as an offline migration method.

BareMetal Infrastructure

Azure offering of dedicated physical servers, SAP HANA Large Instances being one example, linked to your network over ExpressRoute.

Base analyzer

Prebuilt parent analyzer for a given modality (prebuilt-document, prebuilt-image, prebuilt-audio or prebuilt-video), from which a custom analyzer inherits by setting baseAnalyzerId.

Base64 data URI

Embedding the image itself in image_url as a data:image/jpeg;base64,... string; this is the approach when no public URL hosts the image.

Basic (Log Analytics table plan)

Low-cost Log Analytics table plan where ingestion is cheap but each query is charged per GB and runs at workspace scope. Full KQL and simple log search alerts are supported; standard log search alerts are not.

Basic Load Balancer

Load Balancer SKU retired on 30 September 2025. It was open by default, worked only with Basic public IPs and lacked zones and HA Ports, and its backend pool was confined to a single availability set, scale set or standalone VM.

Basic SKU public IP

Public IP SKU, retired on 30 September 2025, that could be static or dynamic and was open by default; Standard Load Balancer, Bastion and Azure Firewall would not accept it.

Bastion Developer SKU

Free tier of Azure Bastion, hosted on shared infrastructure, which connects to a single VM at a time, works without an AzureBastionSubnet and can't reach peered VNets. Every paid tier (Basic, Standard, Premium) needs its own AzureBastionSubnet sized /26 or larger.

Batch endpoint

Endpoint type for asynchronous scoring jobs: data in storage is split into mini-batches, processed in parallel on a compute cluster, and results are saved back to storage. Choose it for large scheduled workloads, not when low latency matters.

Batch synthesis API

Asynchronous text to speech REST API suited to big batches of SSML or plain text. Unlike the real-time REST API, which stops at 10 minutes of audio, it can generate longer output such as audiobooks.

Batch transcription

Asynchronous REST API that transcribes large quantities of recorded audio held in storage and delivers the text later; it is unsuitable for live captioning.

BATCH_COMPLETED_GROUP

Audit action group in Azure SQL that logs the full text of each query batch and stored procedure once it completes; it belongs to the recommended auditing configuration.

BCP (bulk copy program)

Bulk copy utility run from the command line to load data into SQL Server and Azure SQL; it is slower than the COPY statement.

Bearer token (access token)

Access token placed in an HTTP Authorization: Bearer header; any party holding it can call the API it protects.

begin_analyze()

Method on ContentUnderstandingClient that kicks off analysis asynchronously and immediately hands back an LROPoller; calling poller.result() then yields the AnalysisResult.

BFD (Bidirectional Forwarding Detection)

Protocol that spots a failed ExpressRoute link in less than a second. Microsoft's MSEE routers already have it on for new peerings, so you enable it on your own edge routers and tie it to the BGP session.

BGP (Border Gateway Protocol)

Dynamic routing protocol used with both ExpressRoute and VPN connections. On ExpressRoute private peering it is the only way to exchange routes, including a 0.0.0.0/0 default route for forced tunnelling.

BGP community

Label attached to routes Microsoft advertises, such as 12076:5010 marking one service or region. Route filters, and routers on premises, match on these values to decide which prefixes to take.

BGP peer IP

IP address from which each router runs its BGP session. Azure allocates one to a VPN gateway when BGP is switched on, and you record the internal address of your on-premises router in the local network gateway.

BGP peering with the virtual hub (hub BGP peering)

Virtual WAN capability where a network virtual appliance in a spoke connected directly to the hub runs a BGP session with the hub's router; the spoke's VNet connection must be associated with defaultRouteTable.

BGP route propagation

Setting on a route table, shown as Propagate gateway routes, that decides whether routes a VNet gateway has learned are passed to the subnet. Turning it off on spoke subnets stops on-premises routes from sidestepping a firewall.

BGP transit routing

Behaviour of a VPN gateway that passes prefixes learned from one BGP peer on to its other peers, letting chained BGP-enabled site-to-site and VNet-to-VNet connections reach one another; default routes are not passed on.

Bicep

Domain-specific language for declaring Azure infrastructure as code, which is compiled into ARM templates.

Billable Foundry resource (skillset) (cognitiveServices)

Key or identity of a Foundry resource linked to a skillset, letting built-in Vision, Language and Translator skills process more than the free allowance of 20 documents per indexer per day; a single multi-service resource is enough for all of them.

BIND zone file

Plain text file in the standard format that lists a DNS zone's records. You can import it with az network dns zone import in the Azure CLI or through the portal; Azure PowerShell offers no cmdlet for this.

BingGroundingToolDefinition

In the classic C# agents SDK, the tool definition you create from a Bing connection ID; supply it in the tools list of CreateAgentAsync rather than through ToolResources.

BitLocker (BitLocker Drive Encryption)

Full-volume encryption built into Windows; drives used with Azure Import/Export are protected with AES-256 BitLocker.

Blast radius (Exposure Management) (View blast radius)

Graph view in Exposure Management showing how compromise of a chosen node, such as an identity or a choke point, could spread to critical assets.

Blob index tags

Indexed, searchable key-value attributes set on blobs, which lifecycle rules can filter on via blobIndexMatch and ABAC conditions can use; filtering by them isn't possible with a SAS.

Blob storage

Azure's object store for unstructured content like images and video; a single block blob can reach roughly 190.7 TiB.

BlobStorage (legacy account)

Older storage account kind that holds only blobs on standard performance and offers access tiers; it retires on 13 October 2026, so accounts should move to general-purpose v2.

Block access (Conditional Access)

When a Conditional Access policy with this grant applies, the sign-in is refused outright; because block wins over all other controls, meeting MFA or compliance requirements in a different policy cannot override it.

Block blob

The blob type built from individual blocks, suited to text and binary files of up to roughly 190.7 TiB; access tiers and object replication work only with this type.

BlockBlobStorage

Premium, SSD-backed account kind dedicated to block and append blobs, giving the lowest latency; redundancy is limited to LRS or ZRS and access tiers aren't available.

Blocklist

A content filter can reference this user-defined collection of terms or regular expressions, holding as many as 10,000 entries, to stop particular words getting through.

BlocklistClient

Client in the Content Safety SDK for managing text blocklists: creating, listing and deleting them, and adding or removing items (add_or_update_blocklist_items, remove_blocklist_items with at most 100 per call, delete_text_blocklist).

Blue-green deployment (safe rollout)

Safe rollout approach for an online endpoint: a new green deployment is added with no traffic, tested, then given a growing share; to roll back, send all traffic to blue again (blue=100).

BM25 (Okapi BM25)

Full-text ranking function that weighs how often a term occurs, how rare it is across the corpus and how long each document is.

BOM (byte-order mark)

Bytes placed first in a text file to signal its encoding. Fine-tuning data should be saved as UTF-8 with a BOM, keeping each file below 512 MB; ASCII, UTF-16 or ISO-8859-1 files risk failing validation.

Boot integrity monitoring

Trusted launch feature in which the Guest Attestation extension remotely confirms that a VM booted cleanly; Defender for Cloud raises an alert if attestation fails.

Bot Manager rule set (Bot Manager)

WAF managed rules that sort incoming bots into good, bad or unknown categories and apply an action to each.

Bounded staleness

Cosmos DB consistency setting where reads may trail writes, but never by more than a configured count of versions or time interval; it is the strongest level that carries a write-latency SLA for multi-region accounts.

Bounding box

The x, y, width and height pixel coordinates marking where a detected object sits in an image; object detection outputs them, whereas image classification doesn't.

Branch protection

Rules on a branch such as main (branch protection in GitHub, branch policies in Azure Repos) that stop people pushing to it directly and require reviewed pull requests for merges.

Branch-to-branch (route exchange)

Optional Azure Route Server feature, disabled by default, that passes routes among NVAs and the VPN and ExpressRoute gateways in its VNet, enabling transit between ExpressRoute and site-to-site VPN.

Brand detection (logo detection)

Recognises the logos of thousands of well-known brands from a built-in catalogue, giving back each name with a confidence and bounding box; available in Image Analysis 3.2, and your own logos call for a trained custom model.

Budgets

In Cost Management, spending limits you can scope and filter by tag, which raise alerts when actual or forecast spend nears or passes them.

Built-in authentication for App Service and Container Apps (Easy Auth)

Easy Auth: sign-in handled by the platform itself (as a sidecar for Container Apps), working with Entra ID, Google, GitHub, Facebook, X or any OpenID Connect provider. Turning on Require authentication turns away anonymous callers; pair it with HTTPS only.

Built-in evaluators (evaluators)

Ready-made scorers in Foundry covering safety, quality, similarity, RAG and agent behaviour, with OpenAI graders and custom options alongside; they report how outputs perform but never alter settings or retrain anything.

Bulk operations

Entra admin centre tasks run from a CSV template you download first: creating member users, inviting guests, deleting users (only the UserPrincipalName column) and exporting the user list.

Business Critical

Azure SQL vCore tier offering the lowest latency by running Always On replicas on local SSD, plus zone-redundant failover that loses no data; serverless isn't offered.

BYOC (bring your own certificate)

Option for HTTPS on a Front Door custom domain in which your own certificate sits in Azure Key Vault, read through a managed identity or registered service principal; direct upload isn't possible and the chain must come from a Microsoft Trusted CA.

BYOK (bring your own key)

Customer-managed key approach where the key lives in your own Key Vault, serving for instance as the TDE protector or as a storage account's encryption key.

CA (certificate authority)

Entity that issues digital certificates; point-to-site VPN needs one only when clients authenticate with root and client certificates, not when RADIUS or Entra ID is used.

Calendars.ReadWrite

Microsoft Graph permission for creating, reading, updating and deleting events; as an application permission it spans every calendar in the organisation and needs admin consent, while delegated it reaches only the signed-in user's own calendars.

Calendars.ReadWrite.Shared

Delegated Graph permission reaching any calendar the signed-in user has access to, shared and delegate calendars included, but never the whole organisation.

Candidate (Defender EASM asset state)

Asset state in Defender EASM meaning there is some, but insufficient, linkage to your seeds; someone must check ownership by hand, and the asset is only scanned during discovery.

CanNotDelete (Delete lock)

Lock level under which a resource can still be read and modified but not deleted; moving it remains possible.

Capacity reservation groups

Containers for on-demand capacity reservations that secure VM capacity in a chosen region or zone; you pay for the reservation whether VMs use it or not.

Capacity unit (CU)

Unit used to size and bill Application Gateway v2, set by whichever is greatest of one compute unit, 2,500 persistent connections or 2.22 Mbps; an instance supplies roughly 10 of them.

Captioning

Turning speech in live or recorded video into timed text shown on screen; a speech to text use case that can also filter profanity and display partial results.

CD (continuous deployment)

Practice of releasing every change automatically, such as an ACR webhook that redeploys a containerised web app when a new image is pushed.

CEF (Common Event Format)

Format for text logs sent over syslog by firewalls and similar devices. A Linux log forwarder passes these messages to Microsoft Sentinel, which stores them in CommonSecurityLog.

CEF via AMA

Sentinel data connector in which a Linux forwarder runs the Azure Monitor Agent with a DCR to receive CEF messages; it supersedes the older CEF connector built on the Log Analytics agent.

Certificate (Key Vault)

Key Vault object holding an X.509 certificate, whose associated key and secret are managed alongside it.

Certificate authentication (P2S) (Azure certificate)

Point-to-site authentication method: you upload a root certificate the gateway trusts, and every client proves itself with a client certificate issued from that root.

Certificate lifetime actions

Settings in a Key Vault certificate policy, triggered a number of days before expiry or at a percentage of lifetime, that either renew automatically or email the contacts; renewal works through these, not through key rotation policies.

Certificate-based authentication (CBA)

Lets people authenticate to Microsoft Entra by presenting an X.509 certificate from your organisation's PKI. Scoped to a group, it becomes an extra option, can count as passwordless MFA and doesn't stop anyone using other methods.

Chain-of-thought prompting (chain of thought, CoT)

Technique where the prompt tells a non-reasoning model to work through the problem one step at a time, showing its reasoning before giving the answer.

Change Analysis

Records changes to Azure resource properties without an agent; it now appears as change history in Resource Graph.

Change feed

A log, in order, of changes made to blobs; point-in-time restore for block blobs depends on it.

Change Tracking and Inventory

Uses the Azure Monitor Agent to follow changes to files, registry keys, software and services inside guest operating systems, keeping the records in Log Analytics.

Chat Completions API (chat.completions)

Azure OpenAI interface built around a messages array of roles, plus response_format and tools that nest a function object; it remains supported, though the Responses API is advised for new applications.

Chat message roles (system, user, assistant, tool)

Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).

Chat playground

Lets you try a deployed chat model in Foundry without writing code, adjusting the system message, temperature, past messages included and maximum response length.

CheckingEndpoint

Interim Traffic Manager status an endpoint holds before its first probe result arrives; it continues to appear in DNS answers during that time.

Checkov

Open-source scanner for infrastructure-as-code that Microsoft Security DevOps runs; because it understands Terraform, ARM, Kubernetes manifests, CloudFormation, Helm charts and Dockerfiles, its format coverage exceeds Template Analyzer's.

ChecksFailedPercent (% Checks Failed)

One of the Connection Monitor metrics, together with RoundTripTimeMs and Test Result, on which Azure Monitor metric alerts can trigger, for instance when a site-to-site VPN goes down.

Child zone

When a subdomain like research.adatum.com gets its own DNS zone, the parent zone delegates to it using an NS record set with the subdomain's name.

Chunk overlap

Portion of text shared between neighbouring chunks so context isn't lost at the split; overdoing it (say a third of each chunk) means top-k retrieval brings back near-identical passages.

Chunking

Dividing content into short passages before it is embedded and indexed. Oversized chunks mix unrelated sections and weaken meaning, so Azure AI Search advises around 512 tokens each, overlapping by about 10-25%.

CI/CD (continuous integration and continuous delivery)

Pipelines, for example in Azure Pipelines or GitHub Actions, that build, test and deploy code automatically; short for continuous integration and continuous delivery.

CIDR (Classless Inter-Domain Routing)

Notation for IP ranges that writes an address followed by a prefix length, as in 10.1.255.0/24; short for Classless Inter-Domain Routing.

CIEM (cloud infrastructure entitlement management)

Analysis of identity permissions across multiple clouds; since Entra Permissions Management was retired in October 2025, Defender for Cloud is where this capability lives.

Circuit authorization (authorization key)

Created by an ExpressRoute circuit's owner, it yields a key that a different subscription redeems to link its gateway to the circuit; each connection needs its own, and no extra circuit is required.

Classic subscription administrators (Service Administrator and Co-Administrators)

Old roles with authority over a whole subscription, namely Account Administrator, Service Administrator and Co-Administrator; they were retired in August 2024 in favour of Azure RBAC.

Classification

Predictive, supervised learning that assigns an item to one of a set of categories, for instance deciding whether an email is spam; it isn't generative.

Claude models in Foundry (Anthropic Claude)

Anthropic models available to deploy through Microsoft Foundry. From Opus 4.7 onwards they support adaptive thinking only, refusing temperature and an enabled thinking type, whereas Sonnet 4.6 still takes both.

Client address pool

Range of private addresses handed out to point-to-site VPN clients; it must not overlap on-premises or VNet ranges and is set once the VPN gateway has been created.

Client credentials (grant)

App-only OAuth 2.0 flow in which the application signs in as itself, not on behalf of a user; daemons, service-to-service calls and managed identities rely on it.

Client secret (application password)

Password-like credential added to an app registration under Certificates & secrets, with its value displayed just once; public client apps don't have one.

ClientSecretCredential

Credential type in the Azure Identity library for signing in as a service principal from three values (tenant ID, client ID, client secret); the secret it depends on needs protecting and regular rotation.

Cloud App Security Administrator

Administers Defender for Cloud Apps in Microsoft Entra, but holds no permission to register applications or grant consent.

Cloud Application Administrator

Entra role matching Application Administrator except that it can't manage application proxy.

Cloud Device Administrator

Entra role whose rights cover turning devices on or off in the directory, deleting them and viewing BitLocker recovery keys, with no access at all to Azure resources.

Cloud security explorer

Part of Defender CSPM where you write graph queries, or start from templates, against the cloud security graph to ask about inventory, internet exposure or OS; it searches what is already known rather than scanning or capturing traffic.

Cloud security graph

Context engine in Defender for Cloud that links inventory, exposure, permissions, vulnerabilities and lateral movement paths; attack path analysis and cloud security explorer both build on it, and Defender CSPM is required.

Cloud tiering

When enabled on an Azure File Sync server endpoint, rarely opened files move up to the cloud share, while the server keeps a local cache of those used often.

CloudAppEvents

Holds enriched activity from Office 365 and connected SaaS apps for advanced hunting. Data arrives only through Defender for Cloud Apps and its Microsoft 365 connector; Purview Audit by itself doesn't fill it.

CLR (common language runtime)

Lets .NET code run inside SQL Server (common language runtime); SQL Server on VMs and SQL Managed Instance support it, while Azure SQL Database doesn't.

CLU (conversational language understanding)

Conversational language understanding: a custom Azure Language feature for chatbots that works out the intent behind an utterance and pulls out its entities; it retires on 31 March 2029.

Cluster autoscaler

Scales an AKS node pool, Windows pools included, by adding or removing VMs as the demand from pods rises and falls.

ClusterIP

Kubernetes' default Service type; it is given an internal address from the service CIDR and can be reached only from within the cluster.

CNAME (canonical name record)

Alias record in DNS that points one name at another, for example www at <app>.azurewebsites.net; it can't be placed at the apex of a zone.

Code interpreter tool (code_interpreter)

Agent tool provided out of the box that writes Python and executes it in a sandbox to do maths, analyse data or draw charts.

Codeless Connector Framework (CCF)

Lets you create SaaS data connectors for Microsoft Sentinel without writing code, by defining four things in sequence: the custom output table, the DCR, the connector's UI and its connection rules.

Codex

Former OpenAI model for code (code-davinci-002), now retired in Azure; current GPT models, GPT-5 codex variants among them, do coding work instead, and codex-mini is itself deprecated with retirement on 15 November 2026.

Cognitive Services Contributor

Role for managing resources: it can create them, see and regenerate keys and tailor content filters, though it can't call models with Entra ID; usually more access than a task requires.

Cognitive Services Data Reader

Built-in role granting only read data actions over Foundry Tools data, such as Speech projects.

Cognitive Services OpenAI Contributor

Azure OpenAI role that adds dataset uploads, fine-tuning and deployment creation to everything OpenAI User allows, yet can neither create resources nor see keys.

Cognitive Services OpenAI User

The narrowest Azure OpenAI role for calling models through Entra ID; it can see the endpoint and deployments and use the playgrounds, but not deploy, view keys or upload fine-tuning data.

Cognitive Services Speech User

Grants use of the Speech transcription and synthesis APIs, real-time and batch, and lets you view but not change custom models; pair it with a custom subdomain when authenticating through Entra ID.

Cognitive Services User

Built-in role permitted to call any model or Foundry Tool on the resource and to list and read its keys, which is wider access than Azure OpenAI inference alone requires.

CognitiveServices (resource kind)

The kind value used by the older multi-service Azure AI services resource; AIServices is the kind to choose for new ones.

Coherence evaluator (CoherenceEvaluator)

AI-assisted Foundry evaluator for general use that rates how logically a response flows and how well organised and consistent it is, looking only at the query and response without outside knowledge.

Cohort

In the Responsible AI dashboard, a group of data points you pick out so you can set its errors and metrics against others and spot gaps that one global cohort conceals.

Cold (tier)

Online access tier for blobs that costs less to store than Cool but more to read, while data stays instantly available.

Color scheme detection (colour scheme)

Tells you the main foreground, background and accent colours of a picture and whether it is black and white; part of Image Analysis 3.2.

Column encryption key (CEK)

In Always Encrypted, the key that actually encrypts column values; it sits encrypted in the database metadata and the driver retrieves it, so clients never receive it directly.

Column master key (CMK (Always Encrypted))

Protects the column encryption keys in Always Encrypted. It never lives in the database itself but in Azure Key Vault or the Windows certificate store, and client apps need permission to use it.

COM (Component Object Model)

Windows component technology (Component Object Model); since App Service can't register COM components, apps relying on them must run on VMs.

Command job

Runs a single command, for example python script.py, as an Azure Machine Learning job, with its inputs, outputs, environment and compute target all declared up front.

Commitment tiers

Log Analytics pricing levels starting at 100 GB per day that cut costs by around 15-30% versus pay-as-you-go, with no data dropped.

CommonSecurityLog

Destination table in Log Analytics for CEF-formatted messages that a Microsoft Sentinel log forwarder passes on.

Communication Compliance (Microsoft Purview Communication Compliance)

Purview insider-risk tool that flags messages in email, Teams or Copilot interactions that may be inappropriate or breach regulations so reviewers can respond; DLP policies sit elsewhere.

Company branding

Lets you change only the look of the Entra sign-in page, such as its logo, background and text; it neither names groups nor verifies domains.

Completions playground (legacy completions API)

Older Foundry playground where you typed a prompt and got text back, tied to the legacy Completions API and models like gpt-35-turbo-instruct. Use the chat playground with the Responses or Chat Completions API for anything new.

Composed model

Single model ID in Document Intelligence that bundles as many as 500 custom extraction models; from v4.0 (2024-11-30), a classifier you train explicitly decides which model handles each document.

Compressed audio input (AudioStreamFormat.GetCompressedFormat)

Speech SDK ability to accept MP3, OPUS/OGG, FLAC, ALAW and MULAW through push or pull streams, with GStreamer doing the decoding; GetWaveFormatPCM applies to uncompressed audio instead.

Compute cluster (AmlCompute)

Azure Machine Learning compute of several managed CPU or GPU nodes that scales from min_instances to max_instances with each job; set the minimum to 0 and an idle scale-down time so you pay only when jobs are running.

Computer use tool (computer use)

Tool giving an agent's model control of a graphical interface, reading screenshots, clicking and typing, so GUI tasks can be automated.

Computer vision

AI workload concerned with understanding images and video, for example spotting faces, people, logos, objects or areas of flooding.

Conda specification (conda file)

To build a versioned Azure Machine Learning environment, this YAML file names the Python packages to be layered onto a base Docker image.

Conditional Access

Policy engine in Microsoft Entra ID P1 that, depending on signals such as risk or named locations, allows access subject to controls like MFA or a compliant device, or blocks it.

Conditional Access App Control

Routes browser sessions through a Defender for Cloud Apps reverse proxy so that Entra Conditional Access can enforce access and session policies on them as they happen.

Conditional forwarder

Rule on a DNS server that sends lookups for a particular domain to named servers; it doesn't make those networks reachable.

Confidence score

Value between 0 and 1 attached to every prediction or extracted field to express the model's certainty; unlike accuracy, it isn't measured across a test set.

Confidential disk encryption

Available just for confidential VMs, this encrypts the OS disk with keys bound to that VM's TPM, meaning the disk is unreadable anywhere else.

Confidential VM

Virtual machine on Intel TDX or AMD SEV-SNP hardware, with memory encrypted against the host; it requires a confidential size such as DCasv5 or ECasv5 and a supported image.

Configuration server

Appliance that orchestrated replication of VMware machines for the older Site Recovery experience; you ran it on-premises, importing an OVF template into vSphere. Microsoft retired that classic approach in March 2026.

configure_azure_monitor

Single setup call in the Azure Monitor OpenTelemetry distro: pass it an Application Insights connection_string and your app's telemetry (logs, metrics, traces) flows into Azure Monitor.

Connected organization

In entitlement management, an outside partner's directory that you register so access-package policies are able to include its users.

Connected registry

Premium ACR capability providing an edge or on-premises copy of a registry, read-only by default or read-write, that keeps images in sync with its parent in the cloud.

Connection (virtual network gateway connection)

Resource that attaches a virtual network gateway to its peer, which may be an ExpressRoute circuit, a second VNet gateway (Vnet2Vnet) or a local network gateway over IPsec. Resetting it recovers a single tunnel and avoids rebooting the whole gateway.

Connection Monitor

Continuously probes network paths from sources to destinations in Network Watcher. Each monitor accepts source VMs only from its own region, so multiple source regions mean multiple monitors.

Connection troubleshoot

One-time Network Watcher check from a VM to another VM, an FQDN, a URI or an IP and port, reporting whether it is reachable, the latency and which hop (route or NSG) breaks it.

Connections Active (ConnectionsActive)

Online endpoint metric in Azure Monitor showing how many client TCP connections are open at once.

Connectivity configuration

Virtual Network Manager setting that creates mesh or hub-and-spoke topologies, using peerings or connected groups, over a network group; route exchange between gateways isn't part of it.

Connectivity provider (ExpressRoute partner)

Telecoms partner that, given the circuit's service key, provisions ExpressRoute at a peering location; with ExpressRoute Direct you connect without one.

Consent statement (verbal statement)

Before a custom voice is built, the voice talent records set wording giving permission for their voice to be used; the .wav or .mp3 must match the training data's language and recording conditions.

Consumption (Functions plan)

Serverless, event-driven Azure Functions hosting plan charged per execution; runs are capped at 10 minutes and VNet integration isn't available.

Consumption-only environment

Legacy v1 type of Container Apps environment limited to the Consumption plan. If you bring your own VNet, the subnet can't be delegated and needs a size of /23 or bigger.

Contained user (contained database user)

Database user that authenticates at database level with no login in master, such as an Entra user, group or managed identity added through CREATE USER ... FROM EXTERNAL PROVIDER.

Container Apps environment

Boundary that groups Azure Container Apps for security, isolation and networking; decisions about workload profiles versus Consumption only, a custom VNet, and internal or external access can't be changed after creation.

Container Apps environments

Each one gives Azure Container Apps an isolated boundary in its own VNet and can host Consumption as well as Dedicated workload profiles; its network setup can't be altered after creation.

Container Apps peer-to-peer encryption

Environment option, disabled by default, that encrypts app-to-app traffic in Container Apps with TLS using platform-managed certificates; apps are authenticated to one another, but calls between them aren't authorised by it.

Container Apps workload profiles

The default Container Apps environment type, offering Consumption and Dedicated profiles on a subnet of at least /27; unlike the legacy Consumption-only type (/23), it supports UDRs, private endpoints and NAT Gateway egress.

Container group

ACI's top-level unit, comparable to a Kubernetes pod: one or more containers placed on the same host, sharing ports, an IP, volumes and a lifecycle; if it holds several containers, it must run Linux.

Container image vulnerability assessment

Agentless CVE scanning by Defender for Containers that covers images in registries and those running in clusters, kicked off when an image is pushed, imported or recently pulled.

Container insights

Gathers logs and performance data from AKS and other containerised workloads as part of Azure Monitor.

Content extraction

Content Understanding begins here, converting whatever comes in to text plus metadata, by transcribing audio and video or by running OCR and layout analysis on documents.

Content filter (guardrail controls)

Guardrail set up in Foundry that rates prompts and completions for risks such as hate, violence, sexual content, self-harm, prompt attacks and protected material, blocking anything at or above a chosen severity.

Content Moderator (Azure Content Moderator)

Older moderation service that Azure AI Content Safety has replaced; deprecated in February 2024, it retires on 15 March 2027.

Content Safety severity levels

How harm is graded within each category: images come back only as 0, 2, 4 or 6 (safe, low, medium, high), while text uses 0 to 7 or the reduced set 0, 2, 4, 6.

Content Safety Studio

Web portal where, with nothing more than a Content Safety resource, you can try out image and text moderation while tuning severity thresholds, look after blocklists, track usage and export code.

Content Safety text and image moderation

Scores a piece of text or an image for severity across four harms (hate, sexual, violence, self-harm) in Azure AI Content Safety; prompt injection is outside its scope.

Content Understanding agentic mode

In preview from API version 2026-06-01-preview, this Content Understanding mode works through the evidence in a document to validate content and perform calculations; to begin with, each request takes a single file.

Content Understanding analyzer (analyzer)

Defines in Content Understanding how input is processed and what fields come out, either through a prebuilt analyzer or through a field schema you write yourself.

Content Understanding pro mode

Preview mode, offered only through the 2025-05-01-preview API that has since been retired, which brought reasoning, several input files and a reference knowledge base for checking across documents; agentic mode is taking its place.

Content Understanding service limits

Caps on what Content Understanding accepts; for documents, supported formats are PDF, TIFF, JPEG, PNG, BMP, HEIF/HEIC and Office files, while WebP is not.

Content Understanding standard mode

Cheapest, fastest Content Understanding mode and the default, handling one file per request; a good fit for large volumes of individual documents like invoices.

ContentSafetyClient

Content Safety SDK client built from an endpoint plus either a key or an Entra credential; moderation runs through its AnalyzeText and AnalyzeImage methods (analyze_text and analyze_image in Python).

ContentSafetyEvaluator

Combined evaluator that checks a query and response for the severity of self-harm, sexual, violent and hateful or unfair content in one pass.

ContentUnderstandingClient

Content Understanding client for Python; calling its begin_analyze() kicks off an analysis and hands back a poller.

Context window

How many tokens, counting input and output together, a model can handle in one request; GPT-4.1-mini manages roughly 1M, for instance, against 128k for the now-retired Phi-3-mini.

Contract model (prebuilt-contract)

Prebuilt Document Intelligence model that pulls fields out of contracts, among them Title, Contract ID, Parties and Jurisdictions.

Contributor

Built-in Azure role with full management of resources, except that it can't give access to anyone.

Conversation (Foundry Agent Service) (conversation object)

Server-side object, identified by an ID, that persists items such as messages, tool calls and their outputs across turns and sessions; running a response against it supplies the whole history and adds the new output to it.

Conversational AI

Workload in which software holds a back-and-forth exchange, understanding questions and answering them, as chat bots and generative AI chat apps and agents do.

Cool (tier)

Online blob tier that is cheaper than Hot to store data in but dearer to access.

Cooldown

How long autoscale waits after scaling before any rule may act again, 5 minutes by default; this differs from the period over which the metric is evaluated.

Copilot Studio (Microsoft Copilot Studio)

Microsoft's low-code tool for building workflows and AI agents. Its generative agents may hand each tool call they intend to make to an external threat detection service, Microsoft Defender for example, for checking.

Copilot Studio external threat detection

Preview option in the Power Platform admin center whereby each tool call a generative Copilot Studio agent plans is sent to a provider endpoint, authorised via an Entra app ID, that permits or blocks it; with no reply within one second, the call is allowed.

copy (ARM template)

Loop element in ARM templates for creating several resources, properties (for example storageProfile.dataDisks), variables or outputs, with a ceiling of 800 iterations.

Copy activity

Activity in a Data Factory pipeline that moves data from one store to another.

COPY statement (COPY INTO)

The quickest and recommended method of loading a Synapse dedicated SQL pool; it doesn't need external tables or file formats.

copyIndex()

Returns the current iteration of an ARM copy loop, counting from zero; inside a property loop, give it the loop name, as in copyIndex('dataDisks'), so every disk gets its own LUN and name.

CoreDNS (kube-dns)

AKS's default cluster DNS, running as pods in kube-system, that resolves internal names and enables service discovery; its service IP can only be reached within the cluster.

CorrelationRemover

Applied before training, this Fairlearn transformer cancels out the correlation that other features share with sensitive ones; you then need to train the model again.

Cosine similarity (cosine distance)

Scores how semantically close two embedding vectors are by the angle between them; vector search relies on it.

Cosmos DB (Azure Cosmos DB)

NoSQL database distributed globally, offering writes in multiple regions, automatic indexing and latency below 10 ms.

Cosmos DB Built-in Data Reader

Data-plane RBAC role native to Cosmos DB that lets Microsoft Entra ID tokens be used to read data.

Cosmos DB for NoSQL (SQL API)

The native API of Cosmos DB, storing JSON documents and querying them with SQL-style syntax.

Cosmos DB for Table

API in Cosmos DB that is compatible with Azure Table storage, so moving across mostly means swapping the connection string.

Cost analysis

Lets you slice and explore Azure spending in Cost Management by scope, tag, service or time period.

Cost Management

Azure's service for analysing costs, setting budgets and reporting by tag on resources that already run in Azure; it can't forecast what a migration will cost beforehand.

Cost reporting

Tracking spending across subscriptions by tagging resources and then grouping Cost Management budgets and reports on those tags.

CPE (customer premises equipment)

The equipment at a branch, typically an SD-WAN appliance or router, through which that site connects into a Virtual WAN hub; stands for customer premises equipment.

CPU (central processing unit)

The processor that runs a VM's workload (central processing unit); while B-series VMs run under their baseline, they accumulate CPU credits.

CQL (Cassandra Query Language)

Query language of Apache Cassandra, used by Cosmos DB's API for Cassandra.

Crash-consistent snapshot

Captures just what has already been written to disk, which happens if the VM is shut down or deallocated when backup runs or if an app-consistent snapshot can't be taken; a recovery point is still created.

Create new (restore option)

Restores an Azure VM from a recovery point as a brand-new VM, or as disks only, in the same region, leaving the original machine running.

CREATE USER FROM EXTERNAL PROVIDER

Statement in T-SQL that adds a contained database user for an Entra identity, whether a person, group, managed identity or service principal. Doing so enables Entra sign-in to that database but leaves SQL logins working.

Credential passthrough

Older Premium-tier Azure Databricks feature that let users reach ADLS under their own identity; it has been deprecated since Databricks Runtime 15.0, and Unity Catalog is the recommended replacement.

Cross-region load balancer (global load balancer)

Global tier of Standard Load Balancer: a single anycast public IP fronts a backend pool made up of regional public Standard load balancers, and traffic goes to whichever healthy region is closest. Basic SKUs can't take part.

Cross-tenant access settings

Determine, in Microsoft Entra, how far your tenant trusts and collaborates over B2B with other tenants, for both incoming and outgoing access.

Cross-tenant CMK (cross-tenant customer-managed keys)

Setup in which a storage account's customer-managed key comes from a key vault in a different Entra tenant, accessed through a multitenant application with a federated credential.

Cross-tenant synchronization

Entra capability, set up on the source tenant, that provisions, updates and deprovisions that tenant's users in a target tenant automatically.

CRS (Core Rule Set)

The OWASP Core Rule Set, on which the Application Gateway WAF bases its rules.

CSV (comma-separated values)

Plain-text format with comma-separated values, often used for flat exports such as an HR file feeding API-driven provisioning.

Curated environment

Azure Machine Learning environment that Microsoft prepares and publishes in its managed azureml registry for use without modification; when changes are needed, create a custom environment.

Custom analyzer (Content Understanding)

Built on top of a base analyzer like prebuilt-document, this is where you add a field schema, methods and validation instructions of your own in Content Understanding.

Custom audience (custom audience app ID)

Lets each point-to-site gateway admit only certain groups: register an app, set its client ID as that gateway's Audience and authorise the Azure VPN Client app as a client, creating one such registration per gateway.

Custom categories (Content Safety)

Lets Content Safety detect categories you define, either in standard form (trained over several hours and retiring on 1 September 2026) or in rapid form from samples; for a handful of niche terms, a blocklist takes less effort.

Custom classification model (custom classifier)

Document Intelligence model, trained on two or more document types, that sorts and splits incoming files by type ahead of extraction; you apply confidence thresholds to what it returns.

Custom DNS server

DNS server addresses configured on a VNet, or overridden on a NIC, in place of Azure-provided DNS, such as AD DS domain controllers; VMs need to be able to reach that private IP.

Custom domain

A DNS name of your own attached to a service. In an Entra tenant it is verified through a TXT or MX record, and every on-premises UPN suffix used to sign in must be one (.local can't be); for App Service it is bound with CNAME or TXT validation.

Custom evaluators

When none of the built-in evaluators suit, you can write your own as an LLM-as-judge prompt or as Python code.

Custom extraction model

Trained on your labelled documents, sometimes only five of them, to extract the fields you specify; Document Intelligence offers it as either custom neural or custom template.

Custom health probe (custom probe)

Application Gateway probe tied to backend settings in which you choose host, path, interval, match criteria and (on v2) port, for example to test port 8080.

Custom IPsec/IKE policy (IPsec/IKE connection policy)

Set of algorithms for IKE Phase 1 and IPsec Phase 2, together with DH and PFS groups and SA lifetimes, applied to one connection rather than the gateway; each connection takes one policy, and every parameter has to be filled in.

Custom keys connection

Foundry connection that holds any key-value secrets you choose. Name an API key to match the securitySchemes entry in an OpenAPI spec, for example, and the header is supplied for you at run time.

Custom log table (_CL table)

Table in Log Analytics whose name ends in _CL and whose schema you define, populated through a DCR with data no standard table suits.

Custom NER (custom named entity recognition)

Trainable Azure Language capability for detecting the entity types your own domain cares about; it locates them without redacting anything.

Custom neural model

Custom extraction model in Document Intelligence based on deep learning that copes with differing layouts of the same document type, structured or semi-structured; Microsoft recommends starting with it rather than custom template.

Custom roles (Azure custom roles)

Azure RBAC roles containing actions you pick yourself, for when no built-in role fits; a tenant can hold as many as 5,000.

Custom route table

Route table you create in a Virtual WAN hub to isolate traffic, for instance for a set of VNets; it can't be used once routing intent is turned on.

Custom Script Extension

Runs PowerShell or Bash scripts on a VM after pulling them from GitHub, Azure Storage or another location the VM can reach; a common use is installing NGINX or IIS.

Custom speech

Improves recognition of domain vocabulary by fine-tuning a base speech model on your text, or on audio paired with transcripts. You start a project and choose the base model, then upload data and train it, and finally test and deploy.

Custom speech endpoint

Needed for real-time recognition with a custom speech model and identified by its endpointId. Batch transcription doesn't require one, and the model behind it can be replaced without any downtime.

Custom speech model expiration

What happens once a custom speech model expires: real-time endpoint calls drop back to the newest base model for that locale, whereas batch jobs naming the model fail with a 4xx error; the model itself remains.

Custom string masking function (partial())

The partial() function in dynamic data masking, which reveals a chosen number of characters at the start and end and fills the middle with custom padding.

Custom subdomain (Foundry Tools) (custom domain name)

Endpoint unique to a resource, https://<name>.cognitiveservices.azure.com, that Microsoft Entra ID authentication requires because regional endpoints reject Entra tokens; once set, it can't be undone.

Custom template model (custom form)

Custom extraction model in Document Intelligence for documents with one fixed layout, trained in 1-5 minutes; any variation in layout calls for a separate model.

Custom text classification

Trainable Azure Language capability that labels each whole document with one of your own classes, like telling personal email from work email.

Custom Vision (Azure AI Custom Vision)

Lets you train image classifiers and object detectors on your own labelled pictures as a Foundry Tool. It is being retired, with support running until 25 September 2028, and it can't extract fields from documents.

Custom voice (custom neural voice, brand voice)

Text to speech feature with limited access that produces a distinctive synthetic voice, for a brand or character, trained on recordings of a real speaker.

Custom voice endpoint (deploymentId endpoint)

Synthesises speech from a custom voice you have deployed, at voice.speech.microsoft.com/cognitiveservices/v1?deploymentId=...; it offers no way to list available voices.

Custom Web API skill (WebApiSkill)

Azure AI Search skill (Microsoft.Skills.Custom.WebApiSkill) that sends enrichment calls to an HTTP endpoint you supply in uri, for example an Azure Function fronting a Document Intelligence model. Setting a context that ends in /* makes it run per item.

Customer edge router (CE)

For ExpressRoute, the router owned by you or your partner that forms BGP sessions with Microsoft's Enterprise Edge routers (MSEEs); BFD gets configured here.

Customer-managed account failover

Makes the secondary of a geo-redundant storage account the new primary while keeping its DNS names. A planned failover preserves geo-redundancy, whereas after an unplanned one the account stays LRS until you set up geo-replication again.

Customer-managed keys (CMK)

RSA or RSA-HSM key of 2048, 3072 or 4096 bits that you keep in Key Vault or Managed HSM to wrap a storage account's encryption key. You can switch it on later, except for tables and queues, whose CMK support must be chosen at creation.

Customer-managed keys (Azure AI Search) (CMK)

Adds a further encryption layer to Azure AI Search, protecting indexes and synonym maps with an RSA key you hold in Key Vault or Managed HSM, which the service reaches using its managed identity. Expect queries up to 30-60% slower and no added capacity.

CVE (Common Vulnerabilities and Exposures)

Public, numbered list of known software vulnerabilities (Common Vulnerabilities and Exposures) that vulnerability assessment findings refer to.

D-series

Family of general-purpose VMs with a balanced ratio of CPU to memory, suited to web servers, enterprise applications and dev/test.

DACPAC

Package capturing a database schema as a SQL data-tier application, used for example to build the target schema ahead of a migration.

Daemon app

Service or background process that runs without anyone signed in, authenticating as itself via client credentials, which is why it needs application permissions with admin consent.

Daily cap

Limit on a Log Analytics workspace that halts data ingestion for the rest of the day once a set volume is hit.

DALL-E (dall-e-3)

OpenAI's former image-generation model; Azure retired dall-e-3 on 4 March 2026, with the gpt-image series taking over.

Dapr

Distributed Application Runtime, offered in Container Apps and as an AKS extension, which gives apps ready-made building blocks like pub/sub and state management.

Data access governance reports (DAG reports)

Oversharing reports found in the SharePoint admin center with SharePoint Advanced Management. Snapshot reports list site permissions and content shared with Everyone or EEEU, while activity reports track sharing links and EEEU sharing across the previous 28 days.

Data asset

In Azure Machine Learning, a versioned, named pointer to a storage location (uri_file, uri_folder or mltable) that behaves like a bookmark, leaving the data where it is rather than copying it.

Data Box

Physical device shipped for moving large amounts of data into Azure offline; Data Box Gateway uploads in one direction only, and neither offers continuous synchronisation.

Data Catalog

Older Azure service for cataloguing data, now replaced by Microsoft Purview; it isn't used for grouping resources.

Data collection endpoint (DCE)

Where data sent through the Logs Ingestion API arrives; adding it to an Azure Monitor Private Link Scope (AMPLS) keeps ingestion private.

Data collection rule (DCR)

Rule in Azure Monitor specifying what the Azure Monitor Agent or Logs Ingestion API gathers (XPath event filters, for example), any transformation applied, and the destination.

Data Collector Set

In Performance Monitor, a scheduled bundle that logs chosen counters together with ETW traces and configuration information.

Data connector (Microsoft Sentinel data connector)

Brings data into the Microsoft Sentinel workspace from Azure resources, Microsoft services or third-party sources; ingestion is its only job, with no detection or response.

Data Discovery & Classification

Capability in Azure SQL that finds columns holding sensitive data and labels them, without encrypting or masking anything.

Data disk

A managed disk for application data, connected to the VM at a specific LUN. Attaching it while the VM is running causes no downtime.

Data drift

Monitoring signal that checks how the production distribution of each input feature differs from a baseline, normally the training data, with measures like PSI or Jensen-Shannon distance; crossing a threshold can kick off retraining.

Data Lake Storage Gen1 (ADLS Gen1)

First generation of Azure Data Lake storage, which reached retirement in February 2024; ADLS Gen2 is its successor.

Data lake tier (Microsoft Sentinel data lake)

Sentinel storage option priced low for logs you rarely touch. You can still query it via search jobs, KQL jobs and ordinary KQL, and keep data for as long as 12 years in total.

Data Migration Assistant (DMA)

Deprecated Microsoft utility for evaluating SQL Server readiness and copying schema plus data into Azure SQL Database. Its assessment role has passed to Azure Arc-enabled SQL Server and to SSMS.

Data Path Availability

Metric reporting frontend (VIP) availability on a Standard Load Balancer; check it first when a VM behind the load balancer appears to be down.

Data plane

Operations that act on what is inside a resource, for example the secrets, keys and certificates held in a vault; in Key Vault these are authorised through data roles or access policies and filtered by the Key Vault firewall.

Data Security Posture Management (DSPM)

Brings together DLP, Insider Risk Management and sensitivity-label insights in Microsoft Purview to surface risks to sensitive data, and adds data risk assessments plus remediation for oversharing.

Data zone

Boundary set by Microsoft, covering the US, the EU or Asia Pacific and spanning several countries and regions, within which Data Zone deployments keep data processing.

Data Zone Batch (DataZoneBatch)

Batch deployment type matching Global Batch in discount and 24-hour target turnaround, except that jobs are processed only inside the data zone.

Data Zone Standard (DataZoneStandard)

Deployment type billed per token that can route requests to any region inside a Microsoft-defined data zone (US, EU or APAC), giving higher quota than regional deployments.

DataActions

Section of a role definition listing data-plane operations, such as reading blobs or logging in to a VM; putting these operations under Actions instead has no effect.

Database scoped credential

A credential that belongs to one database, made using CREATE DATABASE SCOPED CREDENTIAL by someone holding CONTROL permission there.

Database-level auditing

Auditing policy on a single Azure SQL database that operates alongside server-level auditing with destinations of its own; turning it off never halts the server's audit of that database.

Databricks (Azure Databricks)

Analytics platform built on Apache Spark where data is processed in notebooks; Unity Catalog is the governance model it recommends.

Databricks service principal

Non-human identity for calling Azure Databricks from scripts, pipelines or other automation running outside Azure; personal access tokens, by contrast, belong to individual users.

Datastore

A named pointer in the workspace to Blob, Azure Files or ADLS Gen2 storage that keeps the connection details, so code never needs to carry storage keys itself.

Dataverse

The data store behind Power Platform; a shortcut can surface its data in Microsoft Fabric.

davinci-002

Older base model for plain text completion only, so it can't be fine-tuned on images.

DB2

Relational database from IBM; its schemas and data can be moved to Azure SQL using SQL Server Migration Assistant (SSMA).

db_datareader

Built-in database role whose members may query every user table; paired with db_datawriter it gives read and write access without broader privileges.

db_datawriter

Built-in database role allowing inserts, updates and deletes on every user table, without permission to select from them.

db_owner

Built-in role granting complete control over a database, which is too much for everyday data access. If membership comes only through an Entra group, creating a database scoped credential fails with error 2760.

DBFS (Databricks File System)

Abstraction in Databricks that presents underlying storage, ADLS Gen2 for example, as a file system.

DC (domain controller)

A server running AD DS. Placing these servers in Azure as well as on-premises keeps synchronisation and user sign-in working if one location fails.

DCasv5 (DCadsv5)

General-purpose confidential VM sizes protected by AMD SEV-SNP. Sizes with lookalike names, such as Ddsv5 or D2ads_v5, offer no confidential computing.

DCR transformation (transformation)

A KQL statement inside a data collection rule that drops or reshapes incoming records before storage. Selecting which Windows events the agent gathers is done with XPath instead.

DDoS Network Protection

Plan enabled on virtual networks to shield their public IP addresses, bundling rapid-response support, cost protection and reduced WAF pricing.

Dedicated (Functions plan)

Running Azure Functions on an App Service plan, which removes the execution time limit and offers VNet integration on Basic and higher tiers.

Dedicated cluster (Log Analytics)

To encrypt Azure Monitor Logs with your own keys, the Log Analytics workspace must be linked to this cluster tier. Setting a CMK on a storage account gives Log Analytics no such protection.

Dedicated data endpoints

On Premium container registries, per-region data host names of the form <registry>.<region>.data.azurecr.io that let firewalls allow just that registry. They control network reach only, not permissions.

Dedicated host groups

Collections of physical dedicated hosts that live in one availability zone each, so covering several zones requires a separate group per zone.

Dedicated SQL pool (formerly SQL Data Warehouse)

Massively parallel warehouse in Synapse, previously named SQL Data Warehouse, which spreads data across 60 distributions and runs no more than 128 queries at once.

Default health probe

Automatic Application Gateway probe built from the protocol and port in the backend settings, aimed at 127.0.0.1 when no host is given. Problems on any other port go unnoticed.

Default outbound access

Outbound internet connectivity Azure gives a VM through a Microsoft-owned public IP when nothing explicit is configured. Private subnets, the default in VNets created from 31 March 2026, don't get it.

Default route (0.0.0.0/0)

The 0.0.0.0/0 route matching any destination. Advertised by on-premises routers through BGP on ExpressRoute private peering (Microsoft peering won't do), it sends internet traffic from connected VNets back on-premises.

Default security rules (NSG)

Built-in NSG rules at priorities 65000-65500: AllowVnetInBound, AllowAzureLoadBalancerInBound and DenyAllInBound, plus AllowVnetOutBound, AllowInternetOutBound and DenyAllOutBound. Removal is impossible; custom rules at 100-4096 take precedence.

Default share-level permission

Account-wide option granting one SMB share role to all authenticated identities on every file share, so individual users don't need their own assignments.

Default Site

In forced tunnelling, the route-based VPN gateway is pointed at one local network gateway as its default, and every internet-bound packet goes there. That on-premises device must permit 0.0.0.0/0 in its traffic selectors.

Default to Microsoft Entra authorization in the Azure portal

When enabled on a storage account, the portal accesses data with the signed-in user's Entra identity instead of keys. Identity-based SMB access does not depend on it.

Default user permissions

Entra settings governing ordinary users, such as whether they may register applications or open the Microsoft Entra admin portal. Blocking the portal only hides the UI and does not secure anything.

default() masking function

Dynamic data masking option that hides a value completely, returning XXXX for text, zero for numeric types, 1900-01-01 for a date and 1900-01-01 00:00:00.0000 for a datetime.

DefaultAzureCredential

Credential type in the Azure SDKs that works through several sources in turn: a developer's own sign-in on a workstation, or the managed identity through IMDS when hosted in Azure. No keys or secrets need storing.

defaultRouteTable (Default route table)

Every Virtual WAN hub ships with this route table, labelled Default. Unless configured otherwise, each connection associates with it and propagates routes to it, and branches are required to remain associated.

Defender Antivirus passive mode

Mode in which another vendor's antivirus is primary, so Microsoft Defender Antivirus stops remediating while EDR carries on. Windows Server needs ForceDefenderPassiveMode set to enter it.

Defender CSPM

Defender for Cloud's paid posture tier. On top of the free foundations it brings agentless scanning, attack path analysis, AI security posture management and the cloud security explorer.

Defender EASM inventory filters

Inventory view filters in Defender EASM. Because State = Approved is applied by default, clear that filter to list assets in any other state.

Defender EASM labels

Free-form tags for recording business context on Defender EASM assets. Adding one alters neither an asset's state nor its scanning or ownership.

Defender for Cloud Apps session policy

Policy in Conditional Access App Control that watches or restricts what users do in browser sessions, such as downloading, uploading or copying. Tool calls made by AI agents fall outside it.

Defender for Cloud Data and AI security dashboard

A per-subscription overview of data and AI resources showing their coverage, internet exposure and leading issues. A complete picture depends on enabling Defender for Storage, Defender for Databases, AI threat protection and Defender CSPM including sensitive data discovery.

Defender for Cloud DevOps security (Defender for DevOps)

Brings GitHub, GitLab and Azure DevOps into Defender for Cloud, showing IaC, dependency, secret and code findings side by side. Problems are caught early, yet deployments that skip the pipeline are not blocked.

Defender for Cloud email notifications

Emailed security alerts from Defender for Cloud. Out of the box only High severity is sent, and each recipient receives roughly four high, two medium and one low per day at most.

Defender for Cloud pull request annotations (PR annotations)

DevOps security comments on IaC problems, posted only against the lines a pull request changes, in GitHub or Azure DevOps. Defender CSPM is a prerequisite; on Azure DevOps you also need Contributor or Owner rights and a Build Validation policy on main.

Defender for Cloud workload protection plans (Azure Defender)

Paid threat-protection plans for specific resource types: Servers, Storage, Databases, Containers, App Service, Key Vault, Resource Manager and APIs. Virtual networks have no plan of their own.

Defender for container registries

Former Defender plan, now retired and folded into Microsoft Defender for Containers, which scanned ACR images when pushed, imported or recently pulled.

Defender for Containers runtime threat protection

Detection, powered by the Defender sensor, of suspicious behaviour across Kubernetes clusters, nodes and workloads. Alerts follow once pods are running; nothing is blocked at admission.

Defender for Identity (Microsoft Defender for Identity)

Microsoft Defender service for detecting threats against on-premises Active Directory; it does no access reviews or identity governance.

Defender for Servers Plan 1

The lower of the two Defender for Servers tiers: it includes Defender for Endpoint integration, giving EDR and anti-malware, plus vulnerability assessment through an agent. JIT access, FIM and agentless scanning come only with Plan 2.

Defender for Servers Plan 2

Top Defender for Servers tier, which includes FIM, JIT VM access, agentless scanning and, from August 2023, Defender for DNS alerts. You turn it on per subscription or per Log Analytics workspace.

Defender for Storage malware scanning (on-upload malware scanning)

As blobs are uploaded, Microsoft Defender Antivirus checks them. Charges are per GB, limited each month per account (10,000 GB by default), and results can land in blob index tags, Event Grid, Log Analytics or security alerts.

Defender security for AI agents

Set up in the Defender portal by connecting Copilot Studio and the Microsoft 365 app connector, which share one Entra App ID. Agent tool calls are then checked at run time, risky ones blocked, and alerts and incidents raised.

Defender sensor

DaemonSet from Defender for Containers that runs on each node and gathers runtime telemetry with eBPF for threat detection. AKS gets it as a security profile; EKS and GKE get it as an Arc extension.

Degraded

Status Traffic Manager gives an endpoint whose health checks are failing. Such endpoints are omitted from DNS answers, except when all of them are degraded at once.

DEK (data encryption key)

The symmetric AES key that actually encrypts the data; a protector, for example the TDE protector, wraps it in turn.

Delegated permissions

Entra permission type under which an app works on behalf of whoever is signed in, reaching only the data that user can access.

Delta Lake

Table format adding transactions to files in the data lake. In Synapse, Spark pools can write these tables, while serverless SQL pools can only query them.

Demographic parity

A fairness constraint that mitigates allocation harms by asking for comparable selection rates in every sensitive group.

Deny (Policy effect)

An Azure Policy effect that stops any create or update request that would break the policy.

Deny assignments

Azure RBAC entries that block actions even where a role assignment allows them. Once only Azure services such as deployment stacks made them; users can now create them too (New-AzDenyAssignment or az role deny-assignment create), covering write, delete and action operations but not groups.

Deny effect

When a create or update request would be non-compliant, this Azure Policy effect rejects it, which leaves Audit with no non-compliant resources to flag.

Deny settings (DenyDelete, DenyWriteAndDelete)

On a deployment stack, DenyDelete or DenyWriteAndDelete applies deny assignments to the managed resources that bind every principal, Owners too, apart from any excluded.

DenyAllInBound

The priority-65500 default NSG rule that drops any inbound traffic, internet included, which no earlier rule has allowed.

Dependency (Defender EASM asset state)

Asset state in Defender EASM for infrastructure run by third parties that your own assets rely on directly; these are tracked apart from the Approved Inventory.

dependsOn

In an ARM template, the list of resource names or IDs (commonly built with resourceId()) to deploy before this resource. It controls sequencing only and provides no iteration.

DeployIfNotExists (Policy effect)

When a related resource is absent, this Azure Policy effect deploys an ARM template to create it. Resources that already exist are corrected only by a remediation task running as the assignment's managed identity.

Deployment (Virtual Network Manager)

Pushes a Virtual Network Manager configuration, as the goal state, to selected regions. Nothing changes until this happens, and each deployment applies to every VNet within the region.

Deployment credentials (FTPS, basic authentication)

Username and password pairs for local Git and FTP/S on App Service. They use basic authentication and are not Entra identities.

Deployment modes (Incremental, Complete)

The two ways ARM can deploy: Incremental, the default, creates or updates what the template lists and ignores everything else; Complete also removes resource group contents absent from the template.

Deployment slots

Extra App Service environments, available from the Standard tier, that you warm up and then swap with production, keeping the ability to swap back.

Deployment stacks

Azure resources treating a set of jointly deployed resources as a single managed unit; together with Template Specs they replace Blueprints.

Deployment type (Foundry Models)

Chosen when you deploy a model, it decides two things: billing (provisioned, batch or standard pay-per-token) and where inference data may be processed (anywhere globally, within a data zone or inside one geography).

Description (Image Analysis 3.2) (Describe, VisualFeatureTypes.Description)

Visual feature in Image Analysis 3.2 that produces natural-language caption sentences sorted by confidence, read from Description.Captions[0].Text. Version 4.0 swaps it for Caption.

Detection mode

A WAF setting in which managed and custom rule matches are only logged and no request is blocked.

Deterministic encryption

Always Encrypted option where a given value always encrypts to identical ciphertext. That allows equality searches, joins, grouping and indexes, at the cost of exposing patterns in the data.

Developer deployment type (DeveloperTier)

Deployment type meant purely for trying out fine-tuned models; each deployment lasts 24 hours and comes with no SLA or data residency commitment, so it isn't suitable for production.

Device code (grant)

OAuth grant for devices that lack a browser or keyboard: sign-in is completed on a separate device.

DevTest Labs User

Azure role that lets someone create and work with their own virtual machines, limited to a DevTest Labs lab.

DH group (Diffie-Hellman group)

The Diffie-Hellman group chosen for key exchange during IKE Phase 1 (Main Mode) in a custom IPsec/IKE policy, such as DHGroup24 or DHGroup14.

DHCP (Dynamic Host Configuration Protocol)

Azure delivers each NIC's private IP to the guest operating system using this protocol, so keep the OS set to obtain addresses automatically and configure any static IP on the Azure NIC.

Diagnostic setting

Configuration sending a resource's metrics and logs to a storage account, Event Hubs, Log Analytics or a partner solution; a resource can have five at most.

Diarization (speaker diarization)

Splitting a transcript by voice so each segment shows which speaker was talking. Speech and the Content Understanding audio analyzers both offer it.

DIP (direct IP)

Direct IP: the address of an individual back-end instance sitting behind a load balancer. Its availability is what the Health Probe Status metric reports.

Direct Lake

Mode for Fabric semantic models that loads Delta or Parquet files from OneLake straight into VertiPaq, giving almost import-level performance without duplicating data.

DirectAccess

Older Windows Server feature giving remote clients an always-connected link, since replaced by Always On VPN. It does not connect sites or virtual networks.

Directory Reader (Directory Readers)

An Entra role, not an Azure role, allowing basic directory information to be read. Members can already do that by default, though guests might require the role.

Directory.Read.All

Graph permission for reading users, groups, apps and other directory data. A daemon that reads the directory needs at least this as an application permission, which always requires admin consent.

DirectQuery

Power BI connection mode in which reports fetch data from the source in real time; Direct Lake outperforms it.

Disconnected (peering state)

Shown when the other VNet's side of a peering has been removed, so traffic stops. The remedy is to delete the peering and create it again on both networks.

Discovery group

In Defender EASM, a set of seeds and exclusions discovered together on its own schedule, weekly unless changed. Removing the group, or any seed in it, can delete all assets it found.

Discovery seeds

Starting points such as domains, hosts, IP blocks, ASNs, email contacts and WHOIS organisations, from which Defender EASM recursively finds related internet-facing assets. Private IP addresses are not accepted.

Disk Backup Reader

Built-in role that must be granted on the source managed disk to the Backup vault's managed identity, letting Azure Disk Backup read the disk.

Disk Snapshot Contributor

For Azure Disk Backup to create and clean up snapshots, the Backup vault's managed identity must hold this built-in role over the resource group where snapshots are kept.

Distributed availability group

An availability group built across two other availability groups, each on its own cluster; it supports scenarios like migrating SQL Server from Windows to Linux.

Distributed network name (DNN)

A SQL Server listener option on Azure VMs. Unlike a virtual network name (VNN) it works without any Azure Load Balancer and completes failover faster.

Distribution group (distribution list)

Exchange group with an email address whose only purpose is delivering mail to members; it cannot be used to assign permissions or as an Azure Monitor alert recipient.

DM-Crypt

Azure Disk Encryption encrypts the disks of Linux VMs by using this kernel subsystem.

DNAT rule (destination network address translation)

Azure Firewall rule, evaluated before any other, that maps a public IP and port on the firewall to an internal IP and port, with the translated traffic allowed automatically.

DNS (Domain Name System)