Glossary
Search Azure terms
Open a clear definition, then continue into exam context, architecture, commands, operational examples, common mistakes, and related concepts.
Search all
Commands
Learning guides
Concept graph
Compare
Search-first Azure knowledge base
Term results
Search for a term or click a category. Results render only after you ask for them, so the glossary does not dump every available term on first load. Each result includes Quick peek and Open full term page actions.
Start with a search or a category.
Try managed identity , resource group , az group , private endpoint , or click Databases to load all database-related terms.
Showing 50 of 1,987 matching terms. Narrow the search to reduce the list.
Containers
premium
kubeconfig
kubeconfig is the client configuration that tells kubectl and related tools which Kubernetes cluster, user credential, context, and namespace to use. Microsoft Learn describes AKS access through credentials retrieved with az aks get-credentials, where context selection determines which cluster receives operational commands.
AKS access and administration
Intermediate
5 commands
Aliases: Kubernetes config file, AKS kubeconfig, kubectl configuration, cluster credentials
Quick peek
Open full term page
Containers
premium
AKS private cluster
Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation.
AKS networking
advanced
5 commands
Aliases: Azure Kubernetes Service private cluster, aks private cluster
Quick peek
Open full term page
Containers
premium
AKS cluster
Microsoft Learn describes Azure Kubernetes Service as a managed Kubernetes service for deploying and managing containerized applications. An AKS cluster provides the managed Kubernetes control plane, node pools, networking, identity, scaling, and Azure integration points for running containers in Azure production environments.
Azure Kubernetes Service
fundamentals
5 commands
Aliases: Azure Kubernetes cluster, AKS managed cluster, Kubernetes cluster in Azure
Quick peek
Open full term page
Containers
premium
AKS ingress controller
Microsoft Learn explains AKS ingress through Kubernetes ingress resources and controllers that route HTTP or HTTPS traffic to services in a cluster. AKS application routing options can configure ingress controllers, DNS integration, TLS handling, and related networking components for production applications.
AKS networking
intermediate
5 commands
Aliases: AKS ingress, Ingress controller for AKS, Kubernetes ingress controller
Quick peek
Open full term page
Containers
premium
AKS managed identity
An AKS managed identity is a Microsoft Entra identity that an AKS cluster uses to manage Azure resources without stored service principal secrets.
AKS identity
Intermediate
5 commands
Aliases: Azure Kubernetes Service managed identity, aks managed identity
Quick peek
Open full term page
Containers
field-manual-complete
AKS workload identity
AKS workload identity lets a pod sign in to Azure as an approved identity without storing a password, client secret, or long-lived key inside the container. You connect a Kubernetes service account to a Microsoft Entra application or managed identity through federation. When the pod runs, Azure trusts the service account token from the cluster OIDC issuer and issues access tokens for allowed resources. The result is cleaner secret handling for applications running in AKS.
AKS Identity
intermediate
5 commands
Aliases: Microsoft Entra Workload ID for AKS, pod workload identity, AKS OIDC federation
Quick peek
Open full term page
Containers
field-manual-complete
AKS egress
AKS egress is outbound network traffic from AKS nodes or workloads to destinations outside the pod or cluster network. AKS egress behavior is shaped by outbound type choices such as load balancer, NAT Gateway, or user-defined routes.
Azure Kubernetes Service networking
intermediate
3 commands
Aliases: AKS outbound traffic, cluster egress, AKS outbound type, pod egress
Quick peek
Open full term page
Containers
strict-validated
AKS control plane
The AKS control plane is the Azure-managed Kubernetes API and orchestration layer that coordinates cluster state, authentication, upgrades, and communication with worker nodes.
Azure Kubernetes Service
fundamentals
3 commands
Aliases: Kubernetes control plane, AKS managed control plane, AKS API server, managed Kubernetes API
Quick peek
Open full term page
Analytics
premium
Databricks access connector
A first-party Azure resource that gives Azure Databricks a managed identity for Unity Catalog storage credentials and other governed service access.
Azure Databricks
intermediate
6 commands
Aliases: Access Connector for Azure Databricks, Azure Databricks access connector, Databricks managed identity connector
Quick peek
Open full term page
Identity
premium
Access package
An access package bundles resources someone may need for a job or project. Instead of asking separately for groups, apps, or sites, a user requests the package, and Entra applies approval, duration, review, and removal rules.
Identity operations
fundamentals
5 commands
Aliases: No aliases yet
Quick peek
Open full term page
Identity
premium
Access review
An access review is a governance check asking, “Should this access still exist?” It lets owners, managers, users, or admins review access to groups, apps, access packages, and privileged roles, then keep or remove access based on decisions and recommendations.
Governance
fundamentals
5 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Access tier
An access tier is the storage temperature for blob data. Hot is for frequent access, cool and cold are for less frequent access, and archive is cheapest to store but slowest to retrieve. Choose tiers based on real lifecycle and retrieval needs.
Blob Storage
fundamentals
5 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
premium
AKS Linux node pool
An AKS Linux node pool is a group of Linux-based nodes with shared configuration that runs Kubernetes workloads in an AKS cluster. Node pools let teams separate system components, application workloads, VM sizes, zones, scaling behavior, taints, labels, and upgrade settings.
AKS compute
Intermediate
5 commands
Aliases: Azure Kubernetes Service Linux node pool, aks linux node pool
Quick peek
Open full term page
Containers
premium
AKS maintenance window
An AKS maintenance window is a planned maintenance configuration that controls when AKS starts certain cluster and node image upgrade operations. It helps teams align automatic upgrades and maintenance-sensitive changes with approved business windows, while Azure platform maintenance for underlying infrastructure remains separate.
AKS operations
Intermediate
5 commands
Aliases: Azure Kubernetes Service maintenance window, aks maintenance window
Quick peek
Open full term page
Containers
premium
AKS network policy
An AKS network policy is a Kubernetes traffic-control policy used to restrict pod communication in Azure Kubernetes Service.
AKS networking
Intermediate
5 commands
Aliases: Azure Kubernetes Service network policy, aks network policy
Quick peek
Open full term page
Containers
premium
AKS node
Microsoft Learn explains that AKS nodes are the virtual machines that run your containerized applications, grouped into node pools with the same configuration. System node pools host core cluster pods, while user node pools typically host application workloads and can differ by size, operating system, taints, or purpose.
AKS compute
intermediate
5 commands
Aliases: AKS cluster node, Kubernetes node in AKS, AKS VM node
Quick peek
Open full term page
Storage
premium
Hot access tier
The hot access tier is an Azure Blob Storage tier optimized for data that is actively used and read frequently.
Azure Blob Storage
fundamentals
5 commands
Aliases: Hot access tier, hot access tier
Quick peek
Open full term page
Security
premium
Just-in-time VM access
Just-in-time VM access is the Microsoft Defender for Cloud control that locks down VM management ports and opens approved inbound access only for a limited time.
Defender for Cloud
intermediate
5 commands
Aliases: JIT VM access, Defender for Cloud JIT, just in time access, JIT network access policy
Quick peek
Open full term page
Security
premium
Key Vault access policy
Key Vault access policy controls which identities can read, write, list, delete, recover, sign, unwrap, or manage Key Vault objects when the vault uses policy-based access. Teams see it in key vault access policies blade, secret permissions. It is not Azure RBAC for Key Vault, a network firewall rule, a secret value, a certificate policy, or an application setting; confusing them can create overprivileged identities, broken secret retrieval. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior.
Secrets and keys
Intermediate
5 commands
Aliases: access policy, vault access policy, Key Vault policy permissions, data-plane access policy
Quick peek
Open full term page
Storage
premium
Trusted Microsoft services access
Trusted Microsoft services access is an Azure Storage firewall exception that allows selected Azure services to reach a restricted storage account when their service traffic cannot be represented by virtual network or IP rules. The services still authenticate and must be allowed for supported operations.
Azure Storage
intermediate
5 commands
Aliases: trusted Azure services access, AzureServices bypass, allow trusted Microsoft services, storage trusted services access
Quick peek
Open full term page
Storage
premium
Access ACL
An access ACL is path-level permission in ADLS Gen2. It decides who can read, write, or traverse a file or directory. It works alongside Azure RBAC, so storage access often depends on both role assignments and ACL entries.
Data Lake Storage Gen2
fundamentals
4 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Access control list inheritance
ACL inheritance in ADLS Gen2 means new files and folders can receive default permissions from a parent directory. It is not a magic fix for existing data; changing a default ACL affects future children unless you also update existing paths.
Azure Storage
intermediate
4 commands
Aliases: ACL inheritance
Quick peek
Open full term page
Identity
premium
Conditional Access
Conditional Access is the rule system that decides what a user, workload, or agent must prove before getting into an application. It is not just an MFA switch. A policy can ask who is signing in, where the request comes from, what device is used, which app is targeted, and whether risk signals look suspicious. Then it can allow access, block it, require stronger authentication, demand a compliant device, or.
Access control
fundamentals
4 commands
Aliases: Conditional Access, Microsoft Entra Conditional Access, conditional-access, Entra Conditional Access
Quick peek
Open full term page
Identity
premium
Conditional Access policy
Require phishing-resistant or multifactor authentication for privileged administrators accessing Azure management portals.; Block or challenge risky sign-ins based on sign-in risk, user risk, unfamiliar location, or impo
Privileged access
fundamentals
4 commands
Aliases: Conditional Access policy
Quick peek
Open full term page
Databases
premium
MySQL private access
MySQL private access means a MySQL Flexible Server networking model that keeps database connectivity inside a virtual network instead of exposing a public endpoint. You see it when teams host sensitive workloads, enforce network isolation, connect applications through private subnets, or meet compliance expectations. Think of it as private network reachability for the database, not permission to read the data. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path.
Azure Database for MySQL
intermediate
4 commands
Aliases: No aliases yet
Quick peek
Open full term page
Databases
premium
MySQL public access
MySQL public access means a MySQL Flexible Server networking model that allows connectivity through a public endpoint controlled by firewall rules. You see it when teams support vendor connections, migration tools, development access, or temporary operations when private connectivity is not available. Think of it as public reachability with strict rules, not open database access. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path.
Azure Database for MySQL
fundamentals
4 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
premium
AKS add-on
An AKS add-on is a Microsoft-supported capability that can be enabled on an Azure Kubernetes Service cluster to add functionality such as monitoring, policy, ingress, or security integration, with installation and lifecycle managed through AKS.
Azure Kubernetes Service
fundamentals
3 commands
Aliases: AKS addon, Azure Kubernetes Service add-on, managed AKS integration, AKS integration
Quick peek
Open full term page
Containers
premium
AKS Azure Policy add-on
The AKS Azure Policy add-on integrates Azure Policy with an AKS cluster so policy assignments can audit or enforce Kubernetes rules through in-cluster policy components and report compliance back to Azure Policy.
Azure Kubernetes Service
intermediate
3 commands
Aliases: Azure Policy add-on for AKS, AKS policy add-on, Gatekeeper add-on, Azure Policy for Kubernetes
Quick peek
Open full term page
Containers
premium
AKS cluster upgrade
An AKS cluster upgrade moves an AKS cluster and its node pools to a newer supported Kubernetes version or updates node images after checking available versions, planning surge capacity, and validating workload readiness.
Azure Kubernetes Service
intermediate
3 commands
Aliases: AKS upgrade, Kubernetes version upgrade, AKS node upgrade, cluster version upgrade
Quick peek
Open full term page
Containers
premium
AKS GitOps
AKS GitOps uses Git as the source of truth for Kubernetes configuration and application deployment, commonly through the Microsoft Flux extension, so AKS clusters continuously reconcile to the desired state declared in a repository.
Azure Kubernetes Service
intermediate
3 commands
Aliases: GitOps for AKS, Flux on AKS, microsoft.flux extension, AKS Flux configuration
Quick peek
Open full term page
Containers
premium
AKS horizontal pod autoscaler
The AKS Horizontal Pod Autoscaler is the Kubernetes HPA capability used in AKS to automatically change the number of pod replicas for a workload based on observed metrics such as CPU, memory, or custom metrics.
Azure Kubernetes Service scaling
intermediate
3 commands
Aliases: HPA on AKS, horizontal pod autoscaler, Kubernetes HPA, pod autoscaling
Quick peek
Open full term page
Containers
premium
AKS Windows node pool
An AKS Windows node pool is a group of Windows Server worker nodes in an AKS cluster, used to run Windows container workloads while Linux pools continue to host core Kubernetes system components.
AKS
intermediate
3 commands
Aliases: Windows node pool, Windows Server node pool, AKS Windows containers
Quick peek
Open full term page
Storage
premium
Blob access condition
Blob access condition is documented by Microsoft as part of the Blob Storage area in Azure.
Blob Storage
intermediate
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Blob last access time tracking
Blob last access time tracking is a Blob service setting that records a LastAccessTime property for blobs when supported access operations occur.
Blob Storage
intermediate
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Blob public access
Blob public access is optional anonymous read access for blobs or containers when the storage account and container configuration allow it.
Blob Storage
fundamentals
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Blob public access level
Blob public access level is the container setting that controls whether anonymous clients can read no data, blobs only, or both container listings and blobs.
Blob Storage
fundamentals
3 commands
Aliases: Blob public access level, public access level, blob public access level
Quick peek
Open full term page
Storage
premium
Cold access tier
A storage feature or access model in Blob Storage that helps teams store, protect, move, and govern application or analytics data with clearer ownership, safety, and operational context.
Blob Storage
fundamentals
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Container access level
the Blob Storage container setting that decides whether anonymous clients can read no data, individual blobs, or container listings and blobs
Storage platform
intermediate
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Container public access level
the Blob Storage container setting that decides whether anonymous reads are private, blob-only, or container-level
Blob Storage access
intermediate
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
premium
Cool access tier
A storage feature or access model in Blob Storage that helps teams store, protect, move, and govern application or analytics data with clearer ownership, safety, and operational context.
Blob Storage
fundamentals
3 commands
Aliases: No aliases yet
Quick peek
Open full term page
Security
premium
Managed identity for data access
Managed identity for data access is the pattern of using a managed identity to let a workload read or write data without embedded secrets. Teams use it when pipelines, applications, jobs, or analytics services need secure access to storage, databases, or other data services. In plain English, it gives operators a named control for least-privilege data access, reduced secret exposure, and cleaner audit trails instead of leaving the decision hidden in a portal setting, script, or deployment file. Treat it as production-ready only when the owner, dependencies, permission boundary, monitoring signal, and rollback evidence are clear.
Data access security
intermediate
3 commands
Aliases: Managed identity for data access, Microsoft Entra ID, Data access security
Quick peek
Open full term page
Storage
premium
Archive access tier
Archive access tier is the low-cost, offline storage tier for blob data that you keep for long retention but do not need to read quickly. It is useful for backups, compliance records, historical exports, and evidence that must remain available eventually, not immediately. The tradeoff is simple: storage is cheaper, but retrieval takes planning.
Blob Storage
intermediate
2 commands
Aliases: Azure Blob archive tier, Archive tier, Blob archive access tier
Quick peek
Open full term page
Storage
verified
Read-access geo-redundant storage
Read-access geo-redundant storage, or RA-GRS, replicates storage account data synchronously within the primary region and asynchronously to a paired secondary region, while exposing a secondary read endpoint. It lets applications read replicated data if the primary region becomes unavailable or secondary-read patterns are intentionally designed.
Storage redundancy
intermediate
10 commands
Aliases: RA-GRS, Standard_RAGRS, read-access GRS, read-access geo redundant storage, secondary read endpoint
Quick peek
Open full term page
Storage
complete
Storage account access key
A storage feature or access model in Storage accounts that helps teams store, protect, move, and govern application or analytics data with clearer ownership, safety, and operational context.
Storage accounts
advanced
10 commands
Aliases: storage access key, account key, shared key, storage key
Quick peek
Open full term page
Databases
verified
Redis access key
A single primary or secondary secret used by Redis clients when key-based authentication is enabled for an Azure Redis cache.
Cache
intermediate
7 commands
Aliases: No aliases yet
Quick peek
Open full term page
Databases
verified
Redis access keys
The primary and secondary key pair used for key-based authentication to an Azure Redis cache when that mode is enabled.
Cache and in-memory data
fundamentals
7 commands
Aliases: No aliases yet
Quick peek
Open full term page
Storage
field-manual-complete
Last access time tracking
Last access time tracking for Azure Blob Storage records when a blob was last read or written so lifecycle policies can use access age. Microsoft Learn describes the lastAccessTime condition, daily update behavior, billing considerations, and limitations when moving or deleting data based on recent access.
Storage platform
intermediate
6 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
field-manual-complete
AKS cluster autoscaler
The AKS cluster autoscaler changes how many Kubernetes nodes are available in an Azure Kubernetes Service cluster. When pods are waiting because there is not enough room, it can add nodes to a node pool. When nodes sit underused, it can remove them safely after checks. It is not the same as scaling application replicas; it scales the infrastructure those replicas land on. Good settings keep workloads moving without leaving expensive virtual machines idle all week.
Azure Kubernetes Service
intermediate
5 commands
Aliases: cluster autoscaler, AKS node autoscaler, node pool autoscaler, CA on AKS
Quick peek
Open full term page
Containers
field-manual-complete
AKS network plugin
An AKS network plugin is the networking choice that decides how Kubernetes pods get IP addresses and how traffic moves inside an Azure Kubernetes Service cluster.
AKS networking
Intermediate
5 commands
Aliases: Azure Kubernetes Service network plugin, aks network plugin
Quick peek
Open full term page
Containers
field-manual-complete
AKS node image
An AKS node image is the AKS-tested operating system image used by cluster nodes. Microsoft regularly publishes updated node images with security fixes, component updates, and bug fixes, and teams can upgrade node images separately from Kubernetes minor version upgrades.
AKS operations
Intermediate
5 commands
Aliases: AKS node image, aks-node-image, aks-cluster, aks-node, node-pool, aks-cluster-upgrade, aks-maintenance-window, kubernetes-version, aks-linux-node-pool, aks-windows-node-pool, node-image-upgrade, automatic-os-image-upgrade
Quick peek
Open full term page
No glossary terms matched that search.
Try a service name, acronym, command group, or category such as RBAC , az group , App Service , Application Insights , Databases , or Azure AI Search .
Clear filters and show matches
Reset search