Search Azure terms

Networking premium Application Gateway Application Gateway is an Azure web traffic load balancer for HTTP and HTTPS applications. It routes requests by host name, path, listener, rule, backend pool, and health status, and can add TLS termination and Web Application Firewall controls when those features are configured. Application delivery fundamentals 4 commands Aliases: Azure Application Gateway, App Gateway, regional layer 7 load balancer, HTTP application load balancer Quick peek Open full term page

Networking premium Application Gateway backend pool the group of backend targets that an Application Gateway can forward matched requests to after a listener and routing rule select them. Application delivery and API edge intermediate 4 commands Aliases: Application Gateway backend pool, application gateway backend pool Quick peek Open full term page

Networking premium Application Gateway HTTP setting the Application Gateway backend configuration that controls how the gateway connects to backend servers for HTTP or HTTPS requests. Application delivery and API edge intermediate 4 commands Aliases: Application Gateway HTTP setting, application gateway http setting Quick peek Open full term page

Networking premium Application Gateway listener the Application Gateway component that waits for client requests on a frontend IP address, port, protocol, and optional hostname or certificate. Application delivery and API edge intermediate 4 commands Aliases: Application Gateway listener, application gateway listener Quick peek Open full term page

Networking premium Application Gateway routing rule the Application Gateway component that connects a listener to a backend pool, backend settings, redirect, or path-based routing decision. Application delivery and API edge intermediate 4 commands Aliases: Application Gateway routing rule, application gateway routing rule Quick peek Open full term page

Networking premium Application security group An application security group lets you group virtual machine network interfaces so network security group rules can target application roles instead of explicit IP addresses. Network security fundamentals 2 commands Aliases: ASG, application security group Quick peek Open full term page

Networking premium Azure Bastion A fully managed Azure service that provides secure RDP and SSH access to virtual machines without exposing VM public IP addresses. Remote access fundamentals 4 commands Aliases: Azure Bastion host, Bastion, RDP SSH over Bastion, managed jump box Quick peek Open full term page

Networking premium Azure Firewall Azure Firewall is a managed, stateful network firewall service for filtering traffic to and from Azure virtual network resources. It helps network security and platform teams centralize traffic control, logging, and threat protection across workloads without deploying self-managed firewall appliances for every landing zone. You see it when hub-spoke networks need egress control, applications require segmentation, regulated workloads need inspection, or teams need consistent firewall policy logging. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Network security intermediate 4 commands Aliases: Azure network firewall Quick peek Open full term page

Networking premium CIDR block A CIDR block expresses an IP address range with an address and prefix length, such as 10.0.0.0/16, for virtual network address space, subnets, and routes. IP addressing fundamentals 3 commands Aliases: CIDR Quick peek Open full term page

Networking premium DDoS Protection Azure DDoS Protection is a network-layer protection service that helps defend Azure public IP resources against distributed denial-of-service attacks using always-on traffic monitoring, adaptive mitigation, telemetry, and response capabilities. Network security intermediate 6 commands Aliases: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, distributed denial of service protection Quick peek Open full term page

Networking premium DNS zone A DNS zone is an Azure DNS container for record sets that answer names under a domain. Public zones publish internet-resolvable records after registrar delegation, while private zones resolve only for linked virtual networks and support private endpoint and internal naming patterns. DNS fundamentals 4 commands Aliases: Azure DNS zone, DNS zone, public DNS zone, private DNS zone, hosted zone Quick peek Open full term page

Networking premium ExpressRoute ExpressRoute lets organizations extend on-premises networks into Microsoft cloud services over private connectivity provided through a connectivity provider. Teams use it to connect datacenters, branches, or colocation environments to Azure with predictable private paths for workloads that need stronger latency, bandwidth, and routing control than public internet connections. It is not a VPN tunnel, a private endpoint, an internet performance guarantee, or proof that every connected application is secure, redundant, or correctly routed. In production, confirm circuit state, provider state, peering configuration, BGP routes, gateway SKU, connected virtual networks, bandwidth, metrics, DNS path, firewall path, and provider escalation details before. Hybrid connectivity intermediate 6 commands Aliases: Azure ExpressRoute, ExpressRoute circuit, private Microsoft cloud connectivity Quick peek Open full term page

Networking premium Firewall rule A firewall rule is a gatekeeping setting that decides which network sources can reach a protected Azure service. For Azure SQL, it often means allowing one public IP range to connect to a logical server or a specific database. For storage, MySQL, Cosmos DB, and other services, similar network rules limit where requests can come from. A firewall rule is not user authorization; it only answers whether the network path is allowed. Users or applications still need valid identity, credentials, and permissions after traffic gets through. Network security intermediate 4 commands Aliases: Azure firewall rule, IP firewall rule, server firewall rule, network access rule Quick peek Open full term page

Networking premium Front Door Azure Front Door is Microsoft’s global edge service for modern web applications. Microsoft Learn describes it as a cloud CDN that provides fast, reliable, and secure access to static and dynamic content through Microsoft’s global edge network worldwide. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door, AFD, Azure Front Door Standard, Azure Front Door Premium, global edge Quick peek Open full term page

Networking premium Front Door cache purge A Front Door cache purge removes selected cached content from Azure Front Door edge locations so future requests retrieve fresh content from the origin. Application delivery and API edge intermediate 4 commands Aliases: Azure Front Door cache purge, AFD cache purge, Front Door purge content Quick peek Open full term page

Networking premium Front Door endpoint A Front Door endpoint is a logical grouping of one or more routes associated with domain names in an Azure Front Door profile. Application delivery and API edge intermediate 4 commands Aliases: Azure Front Door endpoint, AFD endpoint, azurefd.net endpoint Quick peek Open full term page

Networking premium Front Door origin A Front Door origin is a backend application or service endpoint that Azure Front Door can route client requests to through an origin group. Application delivery and API edge intermediate 4 commands Aliases: Azure Front Door origin, AFD origin, origin server, backend origin Quick peek Open full term page

Networking premium Front Door origin group A Front Door origin group is a logical grouping of origins that receives similar traffic and controls health probing and load balancing behavior. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door origin group, AFD origin group, backend pool in Front Door, origin pool Quick peek Open full term page

Networking premium Front Door profile Front Door profile is the top-level Azure Front Door Standard or Premium resource that groups edge endpoints, routes, origins, domains, rule sets, security associations, and delivery settings. Teams use it to manage a global application entry point without treating each endpoint, route, or origin as a separate product. In daily Azure work, it shows up when engineers review edge architecture, add a new website, tune routing, attach custom domains, configure WAF, or troubleshoot global traffic. It is not the same thing as a single endpoint, DNS name, backend app, CDN cache rule, or web application firewall policy. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door profile, AFD profile, Front Door Standard/Premium profile Quick peek Open full term page

Networking premium Front Door route Front Door route is the Azure Front Door configuration that decides which domain and path patterns send user requests to which origin group. Teams use it to connect edge endpoints and custom domains to backend applications while controlling accepted protocols, forwarding behavior, caching, and rule-set association. In daily Azure work, it shows up when engineers add APIs, split static and dynamic paths, migrate origins, route traffic between regions, or investigate why a request reached the wrong backend. Application delivery and API edge intermediate 4 commands Aliases: AFD route, Azure Front Door route, edge route Quick peek Open full term page

Networking premium Front Door rules engine Front Door rules engine is the Azure Front Door capability that applies edge rules to matching requests before they are sent to an origin. Teams use it to move selected routing, redirect, rewrite, header, and cache behavior to the edge instead of baking every rule into application code. In daily Azure work, it shows up when engineers tune SEO redirects, add security headers, rewrite paths, vary caching, preserve legacy URLs, or explain unexpected behavior before the origin ever receives traffic. Application delivery and API edge advanced 4 commands Aliases: Front Door rule set, AFD rule set, rules engine Quick peek Open full term page

Networking premium Hybrid Connection A Hybrid Connection lets an Azure App Service app reach a specific TCP host and port in another network through Azure Relay. Azure App Service and Azure Relay fundamentals 5 commands Aliases: Hybrid Connection, hybrid connection Quick peek Open full term page

Networking premium Ingress Ingress controls how users, APIs, partners, and internal services can reach a workload and which network controls protect that entry point. Teams see it in container apps ingress settings, kubernetes ingress controllers. It is not egress, a firewall rule alone, a load balancer backend pool, or an application route inside code; confusing them can create public exposure, unreachable apps. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Application Networking Fundamentals 5 commands Aliases: incoming application traffic, inbound app traffic, Container Apps ingress, external ingress, internal ingress Quick peek Open full term page

Networking premium Internet egress Internet egress controls how workloads reach public endpoints for updates, APIs, package feeds, SaaS services, telemetry, and other internet-reachable dependencies. Teams see it in virtual networks, nat gateways. It is not inbound internet traffic, private endpoint traffic, ExpressRoute private peering, internal ingress, or Azure service-to-service traffic over private routes; confusing them can create data exfiltration paths, blocked updates. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Outbound connectivity Intermediate 5 commands Aliases: outbound internet traffic, egress to internet, public egress, internet-bound traffic Quick peek Open full term page

Networking premium Load Balancer Azure Load Balancer distributes TCP and UDP traffic across backend virtual machines, virtual machine scale sets, or IP configurations. It uses frontend IPs, backend pools, health probes, and rules to provide low-latency Layer 4 traffic distribution for public or internal workloads. Load balancing fundamentals 4 commands Aliases: Azure Load Balancer, Standard Load Balancer, internal load balancer, public load balancer, layer 4 load balancer Quick peek Open full term page

Networking premium Load balancer frontend IP Microsoft Learn describes a Load Balancer frontend IP configuration as the address-facing entry point that receives client traffic for a load balancer. It can use a public or private IP address and is connected to rules, probes, and backend pools. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Load balancer health probe Microsoft Learn describes an Azure Load Balancer health probe as the check that determines whether backend pool instances are healthy enough to receive new traffic. Probe configuration includes protocol, port, interval, and threshold choices that influence traffic distribution. Operators should review it with the connected Azure resource settings. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Load balancer rule Microsoft Learn describes a load-balancing rule as the configuration that maps a frontend IP address and port to backend pool addresses and ports. The rule defines how incoming traffic is distributed and which health probe validates backend availability. Operators should review it with the connected Azure resource settings. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium NAT Gateway NAT Gateway means a managed Azure networking service that provides outbound internet connectivity for private resources in associated subnets. You see it when teams let virtual machines, containers, or private application workloads reach updates, APIs, package feeds, or external services. Think of it as an outbound source address and SNAT boundary, not a firewall for all network traffic. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Outbound connectivity fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Network Security Group Network Security Group means an Azure rule set that filters inbound and outbound network traffic for subnets or network interfaces. You see it when teams restrict application ports, isolate workloads, permit administration, block unwanted traffic, or document network segmentation. Think of it as a prioritized traffic filter near the workload, not complete application security. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Network security fundamentals 5 commands Aliases: NSG Quick peek Open full term page

Networking premium Network Watcher Network Watcher means an Azure diagnostics service that helps inspect, monitor, and troubleshoot network behavior across supported Azure resources. You see it when teams test connectivity, capture packets, review flow logs, inspect topology, or prove whether a problem is network-related. Think of it as a network evidence toolkit, not a replacement for application logs or security analytics. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Diagnostics fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Outbound rule An outbound rule is a Standard Azure Load Balancer configuration that controls outbound SNAT for backend pool instances. It defines which frontend IP configurations are used, which backend pool receives outbound access, protocol behavior, allocated SNAT ports, idle timeout, and optional TCP reset handling. Application delivery and API edge intermediate 4 commands Aliases: Load Balancer outbound rule, outbound NAT rule, SNAT rule, Standard Load Balancer egress rule Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Networking premium Service tag A service tag is a Microsoft-managed label that represents a changing set of IP address prefixes for an Azure service or network category. Administrators use service tags in NSG, firewall, and route rules so rules can reference the service name instead of manually maintained IP ranges. Network security fundamentals 5 commands Aliases: Service tag, service-tag, service tag, Service-tag Quick peek Open full term page

Networking premium Web Application Firewall Azure Web Application Firewall is a centralized protection service for HTTP applications. It can run with Application Gateway, Front Door, Application Gateway for Containers, or Azure CDN, using managed and custom rules to detect and block common exploits such as SQL injection and cross-site scripting. Application security fundamentals 6 commands Aliases: WAF, Azure WAF, Application Gateway WAF, Front Door WAF Quick peek Open full term page

Networking field-manual-complete Load balancer backend pool Microsoft Learn describes a backend pool as the collection of resources that receive traffic from an Azure Load Balancer. Backend pools can include instances added through network interfaces or IP addresses, and multiple pools can serve different traffic groups. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete NSG flow logs NSG flow logs are records of traffic decisions made by Azure network security groups. They show whether flows were allowed or denied, which rule was involved, and where the traffic was headed. In 2026 they are a legacy operational signal: existing logs still matter for investigations, but new NSG flow logs can no longer be created. A learner should understand them as historical evidence and a migration concern, not as the preferred design for new network logging. Diagnostics fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking verified Packet capture Azure Network Watcher packet capture creates capture sessions that track traffic to and from a virtual machine or virtual machine scale set. It helps diagnose network anomalies, gather packet-level evidence, inspect client-server communication, and save filtered capture files locally or in storage. Network diagnostics intermediate 5 commands Aliases: Network Watcher packet capture, VM packet capture, packet trace, pcap capture Quick peek Open full term page

Networking field-manual-complete Private DNS zone A private DNS zone is the private address book Azure uses when a virtual network needs internal name resolution. Instead of sending a service name to public DNS and getting a public address, linked virtual networks can resolve records inside the private zone. Private endpoints depend on this heavily because the application usually keeps calling the normal service hostname, while DNS quietly returns the private endpoint IP. When this is wrong, everything looks like a network outage even though the endpoint exists. DNS fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete Private Endpoint A private endpoint gives an Azure service a private IP address inside your virtual network. Instead of your app reaching a storage account, database, vault, or AI service through a public endpoint, traffic goes to a private network interface tied to that service. The service still exists as a managed Azure resource; the endpoint is the private doorway to it. DNS, firewall rules, approval state, and public network access settings decide whether the design is actually private and usable. Networking advanced 5 commands Aliases: private link endpoint Quick peek Open full term page

Networking field-manual-complete Private IP address A private IP address is the address an Azure resource uses inside a virtual network instead of on the public internet. IP addressing fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete Private Link Private Link is Azure’s way to reach supported services through private network connections instead of sending traffic to their public endpoints. Private access fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking verified Public IP address A public IP address exposes an Azure resource to the internet or enables outbound communication. IP addressing fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking verified Public network access Whether a resource can be reached over public endpoints. Networking advanced 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete Subnet A subnet is a smaller address range inside an Azure virtual network. It is where many network-connected resources actually land, such as virtual machines, private endpoints, container nodes, and delegated platform services. Subnets let teams separate workloads, apply network security groups, attach route tables, reserve IP space, and control private connectivity. A good subnet plan gives every workload enough addresses and the right network controls. A bad plan creates overlapping ranges, blocked traffic, exhausted IPs, or painful migrations later. Virtual networking fundamentals 5 commands Aliases: Azure subnet, VNet subnet, virtual network subnet, subnet address prefix Quick peek Open full term page

Networking field-manual-complete Traffic Manager Azure Traffic Manager is a DNS-based traffic-routing service that directs clients to healthy application endpoints according to a configured routing method. It monitors endpoints and returns DNS answers, but it is not a proxy, so client traffic flows directly to the selected endpoint. Global routing intermediate 5 commands Aliases: Azure Traffic Manager, DNS traffic routing, traffic manager profile, global DNS routing, DNS failover Quick peek Open full term page

Networking field-manual-complete URL path map A URL path map is an Azure Application Gateway configuration that routes requests to different backend pools based on path patterns in the URL. It connects path rules, backend targets, and HTTP settings so one gateway can serve multiple application paths. Application Gateway intermediate 5 commands Aliases: path-based routing map, Application Gateway path map, URL route map, path rule map Quick peek Open full term page

Networking field-manual-complete User-defined route A user-defined route overrides default Azure routing for selected subnet traffic. Routing fundamentals 5 commands Aliases: UDR, custom route, route table route Quick peek Open full term page

Networking field-manual-complete Virtual network An Azure private network boundary for subnets, routing, filtering, peering, and private connectivity. Azure Virtual Network beginner 5 commands Aliases: Azure VNet, VNet, virtual network in Azure, private Azure network, virtual network Quick peek Open full term page

Networking verified VNet peering VNet peering connects two Azure virtual networks so resources can communicate privately over the Microsoft backbone, within a region or across regions. Each side has a peering object, and routing, DNS, security rules, and gateway settings still require design securely. Virtual networking fundamentals 5 commands Aliases: virtual network peering, Azure VNet peering, peered virtual networks, hub-spoke peering Quick peek Open full term page

Networking verified VPN Gateway VPN Gateway is an Azure virtual network gateway that creates encrypted VPN tunnels between an Azure virtual network and on-premises networks, remote clients, or other VNets, using configurations such as site-to-site, point-to-site, and VNet-to-VNet connections. for hybrid networks. Hybrid connectivity fundamentals 6 commands Aliases: Azure VPN Gateway, virtual network gateway for VPN, site-to-site VPN gateway, point-to-site VPN gateway Quick peek Open full term page

Networking top-250-pre130-priority-upgraded Inbound NAT rule Inbound NAT rule is an Azure Load Balancer rule that maps a frontend IP address and port to a backend virtual machine or scale-set instance port for inbound connectivity in Azure. Application delivery and API edge intermediate 5 commands Aliases: Inbound NAT rule, inbound nat rule, inbound-nat-rule Quick peek Open full term page

Networking template-specs-upgraded Rewrite rule Application Gateway rule logic for modifying request or response headers and URLs before backend handling. Application delivery and API edge intermediate 6 commands Aliases: Application Gateway rewrite rule, URL rewrite rule, HTTP header rewrite rule, rewrite rule set, App Gateway rewrite Quick peek Open full term page

Networking template-specs-upgraded Route table Microsoft Learn explains that Azure creates default routes for each virtual network subnet, and custom routes can be placed in route tables associated with subnets. A route table contains routes with address prefixes and next hop types that influence outbound traffic selection. Routing fundamentals 7 commands Aliases: UDR table, Azure route table, custom route table, subnet route table, user-defined route table Quick peek Open full term page

Networking complete SNAT / ephemeral ports Microsoft Learn explains that outbound connections use ephemeral ports so destinations can maintain distinct traffic flows. When those ports are used for source network address translation, they are SNAT ports, and exhaustion can cause intermittent outbound connection failures in services such as App Service. Networking intermediate 6 commands Aliases: SNAT ports, ephemeral ports, source NAT ports, outbound connection ports Quick peek Open full term page