Wraps Kerberos pre-authentication in an encrypted tunnel; Group Policy must enable support on both clients and domain controllers.
Also called Flexible Authentication Secure Tunneling, FAST.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Kerberos armoring in context, with comparison tables and the common traps.
Terms in this definition
- Kerberos
Authentication protocol based on tickets, native to Windows and Active Directory. Azure Files, Entra Domain Services and application proxy KCD all support it.
- Pre-authentication
An application proxy option. With Microsoft Entra ID, the recommended default, users must sign in to Entra first so MFA, SSO and Conditional Access take effect; with Passthrough, requests reach the app without Entra authentication and none of those protections apply.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- Domain
A way of grouping workspaces by area of the business, in support of a data mesh approach. Items take on their workspace's domain, letting you filter the OneLake catalog by it, and certain tenant settings can be passed to domain admins; domains have no effect on access permissions.
Related terms
- Active Directory site
An AD DS object grouping IP subnets with fast links between them. Sites shape how replication flows and help clients find a domain controller close by.
- Azure Data Explorer
KQL-based service for fast, interactive analysis of telemetry and logs at petabyte scale; Time Series Insights users moved to it as the successor.
- Block cloning
VHDX merges and file copies on ReFS run fast because clusters are remapped rather than data being read then rewritten.
- Endpoint analytics
Scores devices in Intune on Work from anywhere readiness, app reliability and how fast they start up. An overall weighted score is shown once at least five devices are reporting.
- Expedite policy
An Intune policy, built on Windows Autopatch, that pushes one selected security quality update (or an eligible non-security one) out as fast as possible, ignoring the deferrals in update rings.
- Instant Restore
Azure VM backup snapshots held with the disks to make restores fast, retained 1 to 5 days under Standard policy or as many as 30 under Enhanced. Anything older is restored from the vault tier.
- IOPS
Input/output operations per second measure how fast a disk performs; a P50 disk, for instance, offers 7,500.
- Memory-optimized table
An In-Memory OLTP table held entirely in RAM, giving very fast access with no latching. SCHEMA_AND_DATA makes it durable and SCHEMA_ONLY doesn't. Azure SQL Database offers it on Business Critical and Premium only.