Glossary
Search Azure terms
Open a clear definition, then continue into exam context, architecture, commands, operational examples, common mistakes, and related concepts.
Search all
Commands
Learning guides
Concept graph
Compare
Search-first Azure knowledge base
Term results
Search for a term or click a category. Results render only after you ask for them, so the glossary does not dump every available term on first load. Each result includes Quick peek and Open full term page actions.
Start with a search or a category.
Try managed identity , resource group , az group , private endpoint , or click Databases to load all database-related terms.
Showing 50 of 527 matching terms. Narrow the search to reduce the list.
Containers
premium
AKS managed identity
An AKS managed identity is a Microsoft Entra identity that an AKS cluster uses to manage Azure resources without stored service principal secrets.
AKS identity
Intermediate
5 commands
Aliases: Azure Kubernetes Service managed identity, aks managed identity
Quick peek
Open full term page
Containers
field-manual-complete
AKS workload identity
AKS workload identity lets a pod sign in to Azure as an approved identity without storing a password, client secret, or long-lived key inside the container. You connect a Kubernetes service account to a Microsoft Entra application or managed identity through federation. When the pod runs, Azure trusts the service account token from the cluster OIDC issuer and issues access tokens for allowed resources. The result is cleaner secret handling for applications running in AKS.
AKS Identity
intermediate
5 commands
Aliases: Microsoft Entra Workload ID for AKS, pod workload identity, AKS OIDC federation
Quick peek
Open full term page
Containers
premium
Kubelet identity
Kubelet identity controls how AKS nodes authenticate to Azure resources for node-level tasks, especially pulling container images from registries without embedded secrets. Teams see it in aks identity profile, node pools. It is not cluster control-plane identity, workload identity, pod managed identity, service account token, kubeconfig credential, or container registry admin user; confusing them can create image pull failures, overbroad registry access. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior.
AKS identity
Intermediate
5 commands
Aliases: AKS kubelet identity, node pool kubelet identity, AKS node managed identity, identityProfile kubeletidentity
Quick peek
Open full term page
Analytics
learning-path-anchor
Synapse workspace managed identity
A Synapse workspace managed identity is the workspace's own identity in Microsoft Entra ID. Instead of saving passwords, keys, or connection strings inside pipelines and notebooks, Synapse can use this identity to ask for tokens and reach trusted Azure resources. It is commonly used for Data Lake Storage, Key Vault, SQL, and linked service...
Synapse Analytics
intermediate
8 commands
Aliases: Synapse managed service identity, Synapse MSI, workspace system-assigned identity, Synapse workspace identity
Quick peek
Open full term page
Containers
premium
AKS cluster
Microsoft Learn describes Azure Kubernetes Service as a managed Kubernetes service for deploying and managing containerized applications. An AKS cluster provides the managed Kubernetes control plane, node pools, networking, identity, scaling, and Azure integration points for running containers in Azure production environments.
Azure Kubernetes Service
fundamentals
5 commands
Aliases: Azure Kubernetes cluster, AKS managed cluster, Kubernetes cluster in Azure
Quick peek
Open full term page
AI and Machine Learning
premium
Azure OpenAI managed identity
Azure OpenAI managed identity uses Microsoft Entra identities so Azure workloads can call model endpoints without stored keys.
Azure OpenAI
intermediate
5 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
premium
AKS add-on
An AKS add-on is a Microsoft-supported capability that can be enabled on an Azure Kubernetes Service cluster to add functionality such as monitoring, policy, ingress, or security integration, with installation and lifecycle managed through AKS.
Azure Kubernetes Service
fundamentals
3 commands
Aliases: AKS addon, Azure Kubernetes Service add-on, managed AKS integration, AKS integration
Quick peek
Open full term page
Identity
learning-path-anchor
System-assigned managed identity
A system-assigned managed identity lets one Azure resource authenticate without a stored password, client secret, or certificate managed by your app team. You turn it on for a resource such as a web app, function, virtual machine, data factory, or automation account. Azure creates an identity for that resource, and the resource can request...
Managed identities
intermediate
4 commands
Aliases: system assigned identity, resource managed identity, SystemAssigned identity, managed service identity
Quick peek
Open full term page
Identity
verified
Workload identity federation
Workload identity federation lets an external workload exchange a trusted token for Microsoft Entra access tokens without storing long-lived secrets. Microsoft Entra validates the issuer, subject, and audience in a federated credential, then allows automation such as GitHub Actions, Kubernetes, or other platforms to access protected resources.
Identity operations
fundamentals
5 commands
Aliases: Federated workload identity, OIDC federation for workloads, Federated identity credential, Secretless workload authentication
Quick peek
Open full term page
Containers
strict-validated
AKS control plane
The AKS control plane is the Azure-managed Kubernetes API and orchestration layer that coordinates cluster state, authentication, upgrades, and communication with worker nodes.
Azure Kubernetes Service
fundamentals
3 commands
Aliases: Kubernetes control plane, AKS managed control plane, AKS API server, managed Kubernetes API
Quick peek
Open full term page
Identity
premium
Federated identity credential
A Federated identity credential is a Microsoft Entra credential object that defines the issuer, subject, and audience trusted for workload identity federation. Teams use it to allow a specific external workload identity to authenticate as an Entra application or user-assigned managed identity without storing a client secret or certificate. It is not a role assignment, token issued by Azure, user sign-in method, broad trust for every workflow in a repository, or evidence that the workload can access resources without RBAC.
Workload identity
intermediate
6 commands
Aliases: Microsoft Entra federated identity credential, FIC, workload identity credential, OIDC federation credential
Quick peek
Open full term page
Containers
premium
AKS ingress controller
Microsoft Learn explains AKS ingress through Kubernetes ingress resources and controllers that route HTTP or HTTPS traffic to services in a cluster. AKS application routing options can configure ingress controllers, DNS integration, TLS handling, and related networking components for production applications.
AKS networking
intermediate
5 commands
Aliases: AKS ingress, Ingress controller for AKS, Kubernetes ingress controller
Quick peek
Open full term page
Containers
premium
AKS Linux node pool
An AKS Linux node pool is a group of Linux-based nodes with shared configuration that runs Kubernetes workloads in an AKS cluster. Node pools let teams separate system components, application workloads, VM sizes, zones, scaling behavior, taints, labels, and upgrade settings.
AKS compute
Intermediate
5 commands
Aliases: Azure Kubernetes Service Linux node pool, aks linux node pool
Quick peek
Open full term page
Containers
premium
AKS maintenance window
An AKS maintenance window is a planned maintenance configuration that controls when AKS starts certain cluster and node image upgrade operations. It helps teams align automatic upgrades and maintenance-sensitive changes with approved business windows, while Azure platform maintenance for underlying infrastructure remains separate.
AKS operations
Intermediate
5 commands
Aliases: Azure Kubernetes Service maintenance window, aks maintenance window
Quick peek
Open full term page
Containers
premium
AKS network policy
An AKS network policy is a Kubernetes traffic-control policy used to restrict pod communication in Azure Kubernetes Service.
AKS networking
Intermediate
5 commands
Aliases: Azure Kubernetes Service network policy, aks network policy
Quick peek
Open full term page
Containers
premium
AKS node
Microsoft Learn explains that AKS nodes are the virtual machines that run your containerized applications, grouped into node pools with the same configuration. System node pools host core cluster pods, while user node pools typically host application workloads and can differ by size, operating system, taints, or purpose.
AKS compute
intermediate
5 commands
Aliases: AKS cluster node, Kubernetes node in AKS, AKS VM node
Quick peek
Open full term page
Containers
premium
AKS private cluster
Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation.
AKS networking
advanced
5 commands
Aliases: Azure Kubernetes Service private cluster, aks private cluster
Quick peek
Open full term page
Integration
premium
Event Grid managed identity delivery
Event Grid managed identity delivery is the pattern where Event Grid uses a managed identity on a topic, domain, or system topic to authenticate event delivery to supported destinations. In Azure, it shows up when teams want to deliver events to Azure destinations without storing destination keys or embedding secrets in event subscription configuration. Teams use it to review system-assigned or user-assigned identity, Event Grid topic or domain identity settings, destination RBAC role assignments, delivery identity settings, dead-letter identity settings, and monitoring before changing production behavior.
Event routing
advanced
5 commands
Aliases: Event Grid managed identity event delivery, managed identity delivery for Event Grid
Quick peek
Open full term page
Integration
premium
Service Bus managed identity
Service Bus managed identity means using Microsoft Entra managed identities so Azure-hosted applications can access Service Bus without stored credentials. Applications receive RBAC roles such as Data Sender or Data Receiver, while Service Bus namespace identities may also be assigned for service-managed scenarios such as encryption configuration.
Service Bus
fundamentals
5 commands
Aliases: Service Bus identity-based access, Service Bus Entra authentication, managed identity for Service Bus, Service Bus secretless authentication, Service Bus RBAC identity
Quick peek
Open full term page
Analytics
premium
Data Factory managed identity
The Microsoft Entra identity assigned to a Data Factory so pipelines and linked services can access Azure resources without embedded passwords.
Data integration and orchestration
Intermediate
4 commands
Aliases: Data Factory managed identity, ADF managed identity, data factory managed identity
Quick peek
Open full term page
Internet of Things
premium
Device identity
A device identity is the IoT Hub identity registry entry that represents a permitted device or module, including its device ID, authentication material, status, and connection-related metadata.
IoT identity
fundamentals
4 commands
Aliases: IoT Hub device identity, IoT device registry identity, device registry entry, IoT device ID
Quick peek
Open full term page
Web
premium
Function app managed identity
Function app managed identity is a Microsoft Entra identity assigned to a function app so its code and supported bindings can access Azure resources without storing passwords or connection strings. Teams use it to replace secrets in app settings with identity-based access to services such as Storage, Service Bus, Key Vault, Event Hubs, SQL, or monitoring resources. In daily Azure work, it shows up when engineers grant a function app data-plane permissions, remove leaked connection strings, configure identity-based bindings, or investigate why a trigger cannot reach its dependency.
Azure Functions
intermediate
4 commands
Aliases: Azure Functions managed identity, managed identity for Functions, function app identity
Quick peek
Open full term page
Identity
premium
Identity Governance
Identity Governance is a Microsoft Entra set of capabilities for managing identity lifecycle, access lifecycle, access reviews, entitlement management, and privileged access.
Identity operations
intermediate
4 commands
Aliases: Entra ID Governance, identity governance, Identity Governance, Microsoft Entra Identity Governance
Quick peek
Open full term page
Identity
premium
Identity Protection
Identity Protection is a Microsoft Entra capability that detects, investigates, and helps remediate risky users and risky sign-ins.
Security
intermediate
4 commands
Aliases: Entra ID Protection, identity protection, Identity Protection, identity risk protection, Microsoft Entra ID Protection
Quick peek
Open full term page
Integration
premium
Logic Apps managed identity
A Logic Apps managed identity is the Microsoft Entra identity assigned to a Logic Apps workflow or Standard logic app resource so the workflow can authenticate to supported Azure resources without storing passwords, shared keys, or long-lived secrets in governed production environments.
Azure Logic Apps
intermediate
4 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
premium
AKS Azure Policy add-on
The AKS Azure Policy add-on integrates Azure Policy with an AKS cluster so policy assignments can audit or enforce Kubernetes rules through in-cluster policy components and report compliance back to Azure Policy.
Azure Kubernetes Service
intermediate
3 commands
Aliases: Azure Policy add-on for AKS, AKS policy add-on, Gatekeeper add-on, Azure Policy for Kubernetes
Quick peek
Open full term page
Containers
premium
AKS cluster upgrade
An AKS cluster upgrade moves an AKS cluster and its node pools to a newer supported Kubernetes version or updates node images after checking available versions, planning surge capacity, and validating workload readiness.
Azure Kubernetes Service
intermediate
3 commands
Aliases: AKS upgrade, Kubernetes version upgrade, AKS node upgrade, cluster version upgrade
Quick peek
Open full term page
Containers
premium
AKS GitOps
AKS GitOps uses Git as the source of truth for Kubernetes configuration and application deployment, commonly through the Microsoft Flux extension, so AKS clusters continuously reconcile to the desired state declared in a repository.
Azure Kubernetes Service
intermediate
3 commands
Aliases: GitOps for AKS, Flux on AKS, microsoft.flux extension, AKS Flux configuration
Quick peek
Open full term page
Containers
premium
AKS horizontal pod autoscaler
The AKS Horizontal Pod Autoscaler is the Kubernetes HPA capability used in AKS to automatically change the number of pod replicas for a workload based on observed metrics such as CPU, memory, or custom metrics.
Azure Kubernetes Service scaling
intermediate
3 commands
Aliases: HPA on AKS, horizontal pod autoscaler, Kubernetes HPA, pod autoscaling
Quick peek
Open full term page
Containers
premium
AKS Windows node pool
An AKS Windows node pool is a group of Windows Server worker nodes in an AKS cluster, used to run Windows container workloads while Linux pools continue to host core Kubernetes system components.
AKS
intermediate
3 commands
Aliases: Windows node pool, Windows Server node pool, AKS Windows containers
Quick peek
Open full term page
Identity
premium
Managed identity
A managed identity is an automatically managed Microsoft Entra identity assigned to a supported Azure resource. It lets workloads authenticate to services that support Microsoft Entra authentication without storing passwords, certificates, or client secrets in code, configuration, or deployment pipelines.
Microsoft Entra workload identity
intermediate
3 commands
Aliases: Managed identity, system-assigned managed identity, user-assigned managed identity, Azure workload identity, secretless authentication, system-assigned identity, user-assigned identity, Microsoft Entra ID, Microsoft Entra workload identity
Quick peek
Open full term page
Security
premium
Managed identity for data access
Managed identity for data access is the pattern of using a managed identity to let a workload read or write data without embedded secrets. Teams use it when pipelines, applications, jobs, or analytics services need secure access to storage, databases, or other data services. In plain English, it gives operators a named control for least-privilege data access, reduced secret exposure, and cleaner audit trails instead of leaving the decision hidden in a portal setting, script, or deployment file. Treat it as production-ready only when the owner, dependencies, permission boundary, monitoring signal, and rollback evidence are clear.
Data access security
intermediate
3 commands
Aliases: Managed identity for data access, Microsoft Entra ID, Data access security
Quick peek
Open full term page
Identity
premium
Assignment managed identity
Assignment managed identity is the identity Azure Policy uses when a policy assignment must change resources during remediation. It matters most for effects such as modify and deployIfNotExists, where Policy is not just reporting non-compliance but attempting to fix or deploy something. The identity needs Azure RBAC permissions at the right scope. Without those.
Azure Policy
intermediate
2 commands
Aliases: Policy assignment identity, Azure Policy managed identity, policy remediation identity, assignment identity
Quick peek
Open full term page
Identity
verified
Workload identity
A workload identity is an identity assigned to software, such as an application, service, script, or container, so it can authenticate to Microsoft Entra protected resources. In Azure, examples include app registrations, service principals, managed identities, and federated workload identities.
Workload identity
fundamentals
6 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
field-manual-complete
AKS cluster autoscaler
The AKS cluster autoscaler changes how many Kubernetes nodes are available in an Azure Kubernetes Service cluster. When pods are waiting because there is not enough room, it can add nodes to a node pool. When nodes sit underused, it can remove them safely after checks. It is not the same as scaling application replicas; it scales the infrastructure those replicas land on. Good settings keep workloads moving without leaving expensive virtual machines idle all week.
Azure Kubernetes Service
intermediate
5 commands
Aliases: cluster autoscaler, AKS node autoscaler, node pool autoscaler, CA on AKS
Quick peek
Open full term page
Containers
field-manual-complete
AKS network plugin
An AKS network plugin is the networking choice that decides how Kubernetes pods get IP addresses and how traffic moves inside an Azure Kubernetes Service cluster.
AKS networking
Intermediate
5 commands
Aliases: Azure Kubernetes Service network plugin, aks network plugin
Quick peek
Open full term page
Containers
field-manual-complete
AKS node image
An AKS node image is the AKS-tested operating system image used by cluster nodes. Microsoft regularly publishes updated node images with security fixes, component updates, and bug fixes, and teams can upgrade node images separately from Kubernetes minor version upgrades.
AKS operations
Intermediate
5 commands
Aliases: AKS node image, aks-node-image, aks-cluster, aks-node, node-pool, aks-cluster-upgrade, aks-maintenance-window, kubernetes-version, aks-linux-node-pool, aks-windows-node-pool, node-image-upgrade, automatic-os-image-upgrade
Quick peek
Open full term page
Identity
field-manual-complete
Privileged Identity Management
Privileged Identity Management, usually called PIM, is the Microsoft Entra feature that keeps powerful access from being permanently active unless someone really needs it.
Access control
fundamentals
5 commands
Aliases: PIM
Quick peek
Open full term page
Identity
verified
Resource identity
A resource identity is the Azure identity a workload uses when it needs permission to call another service. Most teams see it as a system-assigned or user-assigned managed identity on a VM, App Service, Function, container app, automation account, or data service. Instead of storing a password or client secret, the resource receives a Microsoft Entra identity and uses tokens. Operators then grant that identity roles on Key Vault, Storage, SQL, Cosmos DB, or other dependencies.
Identity operations
fundamentals
5 commands
Aliases: Workload identity for a resource, Managed identity surface
Quick peek
Open full term page
Identity
field-manual-complete
User-assigned managed identity
A standalone managed identity that can be attached to one or more Azure resources.
Managed identities
fundamentals
5 commands
Aliases: UAMI, user managed identity, reusable managed identity
Quick peek
Open full term page
Compute
verified
VM system-assigned identity
VM system-assigned identity is a Microsoft Entra managed identity created directly on an Azure virtual machine. Azure manages its credentials, ties its lifecycle to that VM, and lets the guest request tokens for authorized Azure resources without storing secrets in code.
Virtual Machines
intermediate
5 commands
Aliases: VM system-assigned identity, vm system-assigned identity
Quick peek
Open full term page
Compute
verified
VM user-assigned identity
VM user-assigned identity is a reusable managed identity resource attached to a virtual machine so software on that VM can request Microsoft Entra tokens without stored credentials. Its lifecycle and permissions are managed separately from the VM across rebuilds and fleets.
Virtual Machines
intermediate
5 commands
Aliases: VM user-assigned managed identity, user-assigned managed identity for virtual machines, virtual machine user-assigned identity, managed identity attached to VM
Quick peek
Open full term page
Containers
strict-validated
AKS service mesh
AKS service mesh is a service-to-service traffic layer for AKS workloads, commonly delivered through the Istio-based add-on for traffic management, mTLS, and telemetry.
AKS networking
Advanced
5 commands
Aliases: Azure Kubernetes Service service mesh, aks service mesh
Quick peek
Open full term page
Containers
field-manual-complete
AKS egress
AKS egress is outbound network traffic from AKS nodes or workloads to destinations outside the pod or cluster network. AKS egress behavior is shaped by outbound type choices such as load balancer, NAT Gateway, or user-defined routes.
Azure Kubernetes Service networking
intermediate
3 commands
Aliases: AKS outbound traffic, cluster egress, AKS outbound type, pod egress
Quick peek
Open full term page
Analytics
learning-path-anchor
Synapse Spark pool
A Synapse Spark pool is the workspace compute definition Azure Synapse uses to start Apache Spark sessions. It records node size, node count, autoscale behavior, runtime version, packages, and idle timeout so notebooks, Spark jobs, and pipelines get repeatable distributed processing.
Synapse Analytics
fundamentals
8 commands
Aliases: Apache Spark pool, Spark pool, Synapse Apache Spark pool, serverless Spark pool
Quick peek
Open full term page
Compute
premium
Azure Functions
Azure Functions is Azure serverless compute for running code from triggers such as HTTP requests, queues, timers, events, and service integrations without managing servers.
Serverless compute
intermediate
6 commands
Aliases: Functions, Function App, serverless functions
Quick peek
Open full term page
Containers
premium
Azure Kubernetes Service
Azure Kubernetes Service is Azure’s managed Kubernetes service for deploying, scaling, and operating containerized applications while Azure manages much of the cluster control plane.
Managed Kubernetes
advanced
6 commands
Aliases: AKS, managed Kubernetes
Quick peek
Open full term page
Containers
premium
Event-driven job
An Event-driven job in Azure Container Apps starts job executions when a configured scale rule detects work from an event source. Teams use it to run finite container work such as queue processing, batch enrichment, report generation, or cleanup only when events or messages are waiting. It is not a continuously running container app, an AKS deployment, a scheduled job, or a guarantee that every event is processed exactly once. In production, confirm job trigger type, scale rule, minimum and maximum executions, polling interval, image version, secret references, managed identity, execution status, logs, retries, and queue depth before treating the.
Azure Container Apps
intermediate
6 commands
Aliases: Container Apps event-driven job, KEDA job, event-triggered container job
Quick peek
Open full term page
Containers
premium
Kubernetes Deployment
A Kubernetes Deployment is a workload controller that declaratively manages ReplicaSets and pods for stateless applications.
Kubernetes workloads
Intermediate
6 commands
Aliases: No aliases yet
Quick peek
Open full term page
Containers
premium
ACR admin user
The ACR admin user is the quick username-and-password login for a registry. It can be convenient for tests, but it weakens accountability because it is shared. For production, prefer Entra identities, managed identities, tokens, or scoped access patterns.
Azure Container Registry
intermediate
5 commands
Aliases: ACR
Quick peek
Open full term page
No glossary terms matched that search.
Try a service name, acronym, command group, or category such as RBAC , az group , App Service , Application Insights , Databases , or Azure AI Search .
Clear filters and show matches
Reset search