Search Azure terms

Management and Governance premium Azure Policy Azure Policy is a governance service for creating, assigning, and managing rules that evaluate Azure resources. Azure Policy fundamentals 7 commands Aliases: Policy Quick peek Open full term page

Containers premium AKS Azure Policy add-on The AKS Azure Policy add-on integrates Azure Policy with an AKS cluster so policy assignments can audit or enforce Kubernetes rules through in-cluster policy components and report compliance back to Azure Policy. Azure Kubernetes Service intermediate 3 commands Aliases: Azure Policy add-on for AKS, AKS policy add-on, Gatekeeper add-on, Azure Policy for Kubernetes Quick peek Open full term page

Management and Governance premium Azure Lighthouse Azure Lighthouse enables secure delegated management of Azure resources across customer tenants, supporting service providers and central teams with scalable cross-tenant governance. Delegated resource management advanced 5 commands Aliases: Lighthouse, delegated resource management, Microsoft Managed Services delegation Quick peek Open full term page

Security premium Key Vault access policy Key Vault access policy controls which identities can read, write, list, delete, recover, sign, unwrap, or manage Key Vault objects when the vault uses policy-based access. Teams see it in key vault access policies blade, secret permissions. It is not Azure RBAC for Key Vault, a network firewall rule, a secret value, a certificate policy, or an application setting; confusing them can create overprivileged identities, broken secret retrieval. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Secrets and keys Intermediate 5 commands Aliases: access policy, vault access policy, Key Vault policy permissions, data-plane access policy Quick peek Open full term page

Management and Governance premium Policy alias A policy alias is the name Azure Policy uses to point at a real resource property. Instead of writing a policy against an awkward raw JSON path, you use an alias such as a storage account or virtual machine property. Azure Policy then knows what part of the resource to evaluate. Aliases are what make many deny, audit, append, and modify rules practical. If the alias is wrong, unsupported, or misunderstood, the policy may miss resources or block the wrong deployment. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

DevOps premium Policy as Code Policy as Code means treating Azure guardrails like application code. Instead of clicking policies into existence one subscription at a time, teams write policy definitions, initiatives, assignments, parameters, and exemptions in files, review them in pull requests, test them in lower environments, and deploy them through pipelines. It makes governance repeatable and traceable. A learner should think of it as the difference between a shared checklist and an automated rulebook that can be versioned, approved, rolled back, and proven during audits. Governance operations intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy assignment The object that applies a policy or initiative to a management group, subscription, resource group, or resource scope. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy assignment enforcement mode Policy assignment enforcement mode is the safety switch on a policy assignment. When it is Default, Azure Policy can enforce the policy effect, such as deny, modify, audit, or deployIfNotExists, during resource changes. When it is DoNotEnforce, Azure still evaluates resources for compliance, but the effect does not block or change deployments. That makes it useful for testing a new guardrail. It is not the same as deleting the assignment or using the Disabled effect, because evaluation can still show expected impact. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy assignment scope Policy assignment scope answers a simple question: where does this policy apply? If a policy is assigned at a management group, subscriptions under that management group can inherit it. If it is assigned at a resource group, resources in that group are targeted. Scope is not just a label; it determines who feels the rule. Exclusions and exemptions can narrow the effect, but a broad assignment can still reach many teams. Good scope choices make governance predictable, explainable, and safer to operate. Azure Policy intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy compliance state Policy compliance state is the status Azure Policy reports after evaluating a resource against an assigned rule. It tells you whether the resource appears compliant, non-compliant, exempt, conflicting, or not fully known for that evaluation. This is not just a dashboard color. It is the evidence operators use to decide whether a deployment broke a rule, whether a remediation task is needed, or whether an exemption is hiding risk. A learner should connect compliance state to a specific resource, policy assignment, definition, timestamp, and scope. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy definition The rule template that tells Azure Policy what to evaluate and which effect to apply when resources match. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy definition mode Policy definition mode tells Azure Policy what kind of resources the policy should evaluate. The all mode evaluates resource groups, subscriptions, and resource types. The indexed mode focuses on resource types that support tags and location, which is useful for tag and location policies. Some built-in policies use resource provider modes for deeper surfaces such as Kubernetes or Key Vault data. Choosing the wrong mode can make a policy miss resources, mark the wrong resources non-compliant, or fail to behave the way authors expect. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Policy effect A policy effect is the action Azure Policy takes after a rule matches a resource. The rule asks a question, such as whether a storage account allows public access, and the effect decides the response. Some effects only record a finding, some block the request, some add or change properties, and some deploy supporting settings later. For a learner or operator, the effect is the difference between a policy that warns, a policy that prevents drift, and a policy that actively repairs configuration. Azure Policy intermediate 5 commands Aliases: Policy effect, policy-effect Quick peek Open full term page

Management and Governance premium Policy event A policy event is a record or notification that something changed in Azure Policy evaluation. It can tell you that a resource became compliant, became non-compliant, or had a policy state created or removed. Instead of waiting for someone to refresh a portal report, teams can query policy events or route state-change events through Event Grid. For operators, this makes policy activity visible close to the time it happens, so compliance changes can trigger alerts, tickets, evidence capture, or remediation workflows. Azure Policy intermediate 5 commands Aliases: Policy event, policy-event Quick peek Open full term page

Management and Governance premium Policy exemption A policy exemption is an approved exception to an Azure Policy assignment. It says that a resource, resource group, subscription, or management group should not be evaluated by a specific policy or initiative for a documented reason. The resource still appears in compliance reporting, but the exemption explains why it is not treated like ordinary non-compliance. Exemptions are useful when a migration, vendor dependency, outage response, or compensating control makes immediate compliance unrealistic. They should be owned, time-bound, and reviewed. Azure Policy intermediate 5 commands Aliases: Policy exemption, policy-exemption Quick peek Open full term page

Management and Governance premium Policy initiative A policy initiative is a bundle of related Azure Policy definitions. Instead of assigning ten separate policies for tags, allowed regions, diagnostics, encryption, and public access, a team can group them into one initiative and assign that package to a scope. It makes a governance baseline easier to deploy, review, and explain. For learners, think of an initiative as a control set: the individual policies still do the checking, but the initiative provides the organized package, shared parameters, and management structure. Azure Policy intermediate 5 commands Aliases: Policy initiative, Policy set definition, policy-initiative Quick peek Open full term page

Management and Governance premium Policy Insights Policy Insights is where Azure Policy compliance evidence becomes queryable. Azure Policy definitions and assignments describe what should happen, but Policy Insights shows what Azure observed after evaluation. It stores state records that show current compliance and event records that show recent evaluation activity. Operators use it to answer questions such as which resources are non-compliant, which assignment is responsible, when the state changed, and whether remediation improved results. It turns policy from a static rule set into operational telemetry. Azure Policy intermediate 5 commands Aliases: Policy Insights, policy-insights Quick peek Open full term page

Management and Governance premium Policy notScope Policy notScope is the list of places where an Azure Policy assignment should not apply. Think of it as a surgical exclusion inside a larger assignment. A governance team might assign a location policy to an entire management group, then exclude a disaster recovery resource group or migration subscription that needs temporary freedom. The assignment still exists at the parent scope, but Azure Policy skips the excluded child scope during evaluation, so those resources do not appear as non-compliant for that assignment. Azure Policy intermediate 5 commands Aliases: notScopes, Policy notScope, policy-not-scope Quick peek Open full term page

Management and Governance premium Policy parameter A policy parameter is a safe input box for Azure Policy. Instead of writing separate policies for each allowed region, tag name, diagnostic workspace, or enforcement effect, you define the rule once and pass different values when assigning it. That makes policies easier to reuse across management groups, subscriptions, and environments. Parameters can include defaults, allowed values, friendly display names, and metadata, so platform teams can offer controlled choices without asking every application team to understand the full policy JSON. Azure Policy intermediate 5 commands Aliases: Policy parameter, policy-parameter Quick peek Open full term page

Management and Governance premium Policy remediation Policy remediation is Azure Policy’s controlled repair job for resources that already exist. A deny policy can stop a bad new deployment, but it cannot automatically fix old resources. Remediation is for policies with modify or deployIfNotExists effects, such as adding required tags or deploying missing diagnostic settings. You create a remediation task, Azure finds the affected resources, and the assignment’s managed identity performs the configured change. It is governance automation, but it still needs careful scope, permission, and result review. Azure Policy intermediate 5 commands Aliases: Policy remediation, policy-remediation Quick peek Open full term page

Management and Governance premium Policy state Policy state is the evidence record behind an Azure Policy compliance result. It answers practical questions such as which resource was evaluated, which policy assignment applied, whether the resource was compliant, and when Azure last knew that result. The portal summarizes these states, but operators often query them directly through Azure CLI, REST, or Resource Graph when they need proof. Policy state is especially useful when a dashboard says “non-compliant” and the team needs to locate the exact resource, policy, scope, and reason. Azure Policy intermediate 5 commands Aliases: Policy state, policy-state Quick peek Open full term page

Management and Governance premium Azure Advisor Azure Advisor is the Azure recommendation service that reviews resource configuration and usage signals, then suggests best-practice actions for healthier cloud deployments. In Azure, teams encounter it when platform teams need a prioritized backlog for cost savings, reliability fixes, security hardening, performance improvements, and operational excellence. The useful question is what behavior it proves, who Optimization fundamentals 4 commands Aliases: Advisor, Azure Advisor recommendations, Advisor score Quick peek Open full term page

Hybrid and Multicloud premium Azure Arc-enabled Kubernetes An Azure Arc capability that connects Kubernetes clusters running anywhere to Azure for centralized management, governance, security, and application operations. Hybrid management fundamentals 4 commands Aliases: Arc-enabled Kubernetes, Azure Arc Kubernetes, connected Kubernetes cluster Quick peek Open full term page

Monitoring and Observability premium Diagnostic settings policy A diagnostic settings policy is an Azure Policy definition or initiative that audits, denies, or deploys diagnostic settings at scale so supported resources send logs and metrics to approved destinations. Governance operations intermediate 4 commands Aliases: Azure Policy for diagnostic settings, diagnostic settings Azure Policy, policy-based diagnostic settings, deploy diagnostic settings policy Quick peek Open full term page

Management and Governance premium Allowed locations policy An allowed locations policy is an Azure Policy definition that restricts the Azure regions users can select when deploying resources, helping enforce geo-compliance and regional governance requirements. Azure Policy intermediate 3 commands Aliases: Allowed locations, location allowlist policy, regional restriction policy Quick peek Open full term page

Management and Governance premium Allowed resource types policy An allowed resource types policy is an Azure Policy definition that lets an organization specify which Azure resource types can be deployed, reducing uncontrolled services, complexity, cost risk, and attack surface. Azure Policy fundamentals 3 commands Aliases: Allowed resource types, resource type allowlist policy, allowed types policy Quick peek Open full term page

AI and Machine Learning verified Responsible AI policy Microsoft Learn guidance for Responsible AI practices in Azure OpenAI emphasizes defined content policies, misuse detection, user blocking mechanisms, human review, safety evaluation, and escalation. In Azure, a Responsible AI policy is the operating rule set that turns those practices into enforceable product behavior. Azure OpenAI intermediate 7 commands Aliases: AI safety policy, Azure OpenAI responsible AI policy, generative AI policy, AI acceptable use policy, Responsible AI guardrails Quick peek Open full term page

Management and Governance verified Required tag policy A required tag policy uses Azure Policy to enforce tagging rules so resources are created with expected organizational tags. Depending on the definition and effect, it can deny noncompliant deployments, audit missing tags, modify requests, or remediate existing resources with standardized tag values. Azure Policy intermediate 6 commands Aliases: require tag policy, mandatory tag policy, Azure Policy tag enforcement, tag governance policy, required tag and value policy Quick peek Open full term page

Management and Governance verified Resource group policy assignment A resource group policy assignment applies an Azure Policy definition or initiative to one resource group so resources inside that group are audited, denied, modified, or remediated according to the assignment. Azure Policy intermediate 5 commands Aliases: policy assignment at resource group, Azure Policy resource group scope, resource group scoped policy, RG policy assignment, policy scope resource group Quick peek Open full term page

Management and Governance field-manual-complete Subscription policy assignment A subscription policy assignment is a rule or initiative applied to an entire Azure subscription. Instead of assigning the policy one resource group at a time, the assignment covers all resource groups and resources under that subscription unless exclusions or exemptions narrow it. It can audit, deny, append, modify, or deploy supporting settings depending on the policy effect. Think of it as a subscription-wide guardrail with parameters, scope, enforcement mode, and compliance reporting. It is powerful because it is broad, so it deserves careful review before production use. Azure Policy intermediate 5 commands Aliases: subscription scoped policy assignment, Azure Policy assignment at subscription scope, subscription governance assignment Quick peek Open full term page

Management and Governance premium field-manual Management group policy assignment A management group policy assignment is an Azure Policy assignment applied at management-group scope so it affects child subscriptions and resources. Teams use it when governance teams need consistent guardrails across multiple subscriptions from one parent scope. In plain English, it gives operators a named control for centralized policy enforcement, compliance reporting, and fewer repeated subscription-level assignments instead of leaving the decision hidden in a portal setting, script, or deployment file. Treat it as production-ready only when the owner, dependencies, permission boundary, monitoring signal, and rollback evidence are clear. Azure Policy intermediate 4 commands Aliases: Management group policy assignment, Azure Policy, policy definition, policy initiative, resource group policy assignment, Azure Policy and management groups, policy assignment at management group scope, inherited policy assignment, Azure Policy at management group scope Quick peek Open full term page

Governance learning-path-anchor Tag inheritance Tag inheritance is the controlled reuse of tags from a higher Azure or billing scope. Cost Management can apply higher-scope tags to usage records for reporting, while Azure Policy can copy selected parent tag values onto resources for governance at scale. Resource tagging fundamentals 5 commands Aliases: inherited tags, Azure tag inheritance, billing tag inheritance, policy tag inheritance Quick peek Open full term page

Management and Governance learning-path-anchor Tag value A tag value is the answer attached to a tag name. If the tag name is Environment, the value might be Production, Test, or Sandbox. If the name is CostCenter, the value might be a finance code. Values are where governance becomes meaningful, because they separate one owner, workload, data class, or lifecycle state from another. A good value is standardized, approved, and easy to query. A bad value is free-text chaos: prod, production, PROD, live, and critical all trying to mean the same thing. Tags and naming fundamentals 5 commands Aliases: tag values, Azure tag value, resource tag value, tag metadata value Quick peek Open full term page

Management and Governance learning-path-anchor Tagging strategy A tagging strategy is the playbook for using tags without making a mess. It answers simple but important questions: which tags are required, who owns the list, which values are allowed, where tags are applied, and what happens when a resource is missing one. Without a strategy, tags become random notes. With a strategy, tags become a dependable system for cost allocation, ownership, lifecycle cleanup, compliance evidence, and operational routing. The best strategies are small enough to follow and strict enough to m Tags and naming fundamentals 5 commands Aliases: Azure tagging strategy, tag governance strategy, tag taxonomy, resource tagging standard Quick peek Open full term page

Management and Governance learning-path-anchor Tags Tags are labels you attach to Azure things so people and tools can understand what they are for. A tag has a name and a value, such as Owner=DataPlatform or Environment=Prod. Tags do not make a virtual machine faster, secure a database, or change a web app setting. They make the estate easier to organize, report on, govern, and automate. Useful tags answer questions the business actually asks: who owns this, what does it support, what environment is it, and who pays for it? Tags and naming advanced 5 commands Aliases: Azure tags, resource tags, name-value tags, Azure metadata tags Quick peek Open full term page

Analytics premium Databricks managed resource group The Azure resource group created or referenced for Databricks-managed infrastructure that supports a workspace and its classic compute resources. Azure Databricks intermediate 6 commands Aliases: managed resource group, Azure Databricks managed resource group, workspace managed resource group Quick peek Open full term page

Networking premium DDoS Protection Azure DDoS Protection is a network-layer protection service that helps defend Azure public IP resources against distributed denial-of-service attacks using always-on traffic monitoring, adaptive mitigation, telemetry, and response capabilities. Network security intermediate 6 commands Aliases: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, distributed denial of service protection Quick peek Open full term page

Management and Governance premium Exemption An Exemption in Azure Policy records an approved exception that excludes a resource hierarchy or individual resource from evaluation of a policy assignment. Teams use it to document a justified policy exception with scope, reason, category, expiration, and evidence instead of silently ignoring noncompliance. It is not a policy exclusion in assignment scope, a deny override, a remediation task, or permission to bypass governance without approval and review. In production, confirm assignment ID, exemption scope, category, expiration, metadata, policy definition references, approving owner, affected resources, compliance impact, and review evidence before treating the design as healthy or ready for release. Azure Policy intermediate 6 commands Aliases: policy exemption, Azure Policy exemption, waiver Quick peek Open full term page

Containers premium Flux extension The Flux extension is the microsoft.flux Kubernetes cluster extension for Azure Kubernetes Service or Azure Arc-enabled Kubernetes that installs Flux v2 controllers for GitOps reconciliation. Teams use it to sync Git, OCI, Helm, or Kustomize sources to Kubernetes clusters so desired configuration is versioned, reconciled, audited, and applied consistently across AKS and Arc-enabled environments. It is not a CI pipeline by itself, a replacement for cluster security, a guarantee that every manifest is safe, or a reason to let unreviewed repository changes modify production clusters. Kubernetes GitOps intermediate 6 commands Aliases: microsoft.flux extension, GitOps Flux extension, AKS Flux extension, Azure Arc Flux extension Quick peek Open full term page

Management and Governance premium Drift detection Drift detection identifies differences between the expected configuration baseline and the actual state of resources, policies, workloads, or managed infrastructure. Operational compliance intermediate 5 commands Aliases: configuration drift detection, resource drift detection, drift monitoring, infrastructure drift detection Quick peek Open full term page

Integration premium Event Grid filter Event Grid filter is the matching configuration on an Event Grid event subscription that decides which events are delivered to a handler. In Azure, it shows up when subscribers should receive only relevant events based on event type, subject prefix or suffix, or advanced fields inside the event payload. Teams use it to review included event types, subject begins-with and ends-with filters, advanced filters, case sensitivity, schema field names, test payloads, and monitoring for matched events before changing production behavior. It is not a firewall rule, diagnostic query, handler-side if statement, or Azure Policy filter. Event routing intermediate 5 commands Aliases: Event Grid subscription filter, Event Grid event filter Quick peek Open full term page

Storage premium Immutable blob versioning Immutable blob versioning is version-level immutability for Azure Blob Storage, where protected blob versions can be retained in a write-once, read-many state. Blob Storage intermediate 5 commands Aliases: Immutable blob versioning, immutable blob versioning, immutable-blob-versioning Quick peek Open full term page

Storage premium Immutable storage Immutable storage is Azure Blob Storage configured to protect data in a write-once, read-many state so it cannot be modified or deleted during a retention period. Data protection intermediate 5 commands Aliases: Immutable storage, immutable storage, immutable-storage Quick peek Open full term page

Management and Governance premium Indexed mode Indexed mode is the Azure concept that controls which Azure resources are considered during evaluation of a policy definition. Teams see it when working with azure policy definitions, policy mode field. It is not the all mode, an indexed search field, a database index, or an Azure AI Search index; that distinction matters because bad assumptions create resources not evaluated, false compliance confidence. Use the term when reviewing ownership, access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same resource, setting, or behavior. Azure Policy Intermediate 5 commands Aliases: Azure Policy indexed mode, policy definition indexed mode, indexed policy mode, mode indexed Quick peek Open full term page

Storage premium Infrastructure encryption for storage Infrastructure encryption for storage controls how Azure Storage applies optional double encryption to blobs, files, queues, or tables depending on account and scope configuration. Teams see it in storage account creation, encryption blade. It is not blob immutability, soft delete, encryption in transit, customer-managed key rotation, or disabling shared key authorization; confusing them can create storage accounts that cannot meet compliance, rebuild-only remediation. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Azure Storage Security Intermediate 5 commands Aliases: storage infrastructure encryption, storage account double encryption, require infrastructure encryption, double encryption for Azure Storage Quick peek Open full term page

Management and Governance premium Invoice section Invoice section controls how Microsoft Customer Agreement charges are grouped on invoices so finance and engineering teams can allocate ownership and review monthly spend. Teams see it in cost management and billing portal, billing accounts. It is not an invoice model, resource group, management group, cost center tag, billing profile, subscription, or Azure Policy assignment; confusing them can create misallocated cloud spend, subscription charges on the wrong invoice group. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Cost Management and Billing Fundamentals 5 commands Aliases: MCA invoice section, billing invoice section, Azure invoice section, invoice grouping Quick peek Open full term page

Management and Governance premium Platform baseline A platform baseline is the minimum set of governance, security, identity, networking, monitoring, and cost controls an Azure environment should inherit before workloads deploy. It sets standard expectations for subscriptions, landing zones, policy assignments, RBAC, logging, tags, and operational ownership across the estate. Governance operations fundamentals 5 commands Aliases: Azure platform baseline, governance baseline, enterprise platform baseline Quick peek Open full term page

Storage premium Trusted Microsoft services for storage Trusted Microsoft services for Azure Storage are specific Azure services that Microsoft documents as eligible for storage firewall exceptions. Depending on the service, access may be based on tenant registration, supported operations, or managed identity authorization combined with Azure RBAC or Data Lake ACLs. Storage platform intermediate 5 commands Aliases: trusted Azure services for Storage, storage trusted services list, Azure Storage trusted services, trusted services storage firewall Quick peek Open full term page

Storage premium ZRS redundancy ZRS redundancy is the storage-account redundancy setting that enables zone-redundant storage. It synchronously replicates data across availability zones in the primary Azure region, so blobs, files, queues, and tables can remain accessible during a zonal outage without relying on asynchronous secondary-region replication. Storage accounts fundamentals 5 commands Aliases: Standard_ZRS, Premium_ZRS, ZRS SKU, zonal redundancy, zone redundant SKU Quick peek Open full term page

Management and Governance premium Append effect an Azure Policy effect that adds configured fields to a create or update request when a resource matches the policy rule. Azure Policy fundamentals 4 commands Aliases: Append effect, append effect Quick peek Open full term page