Search Azure terms

Networking premium DNS zone A DNS zone is an Azure DNS container for record sets that answer names under a domain. Public zones publish internet-resolvable records after registrar delegation, while private zones resolve only for linked virtual networks and support private endpoint and internal naming patterns. DNS fundamentals 4 commands Aliases: Azure DNS zone, DNS zone, public DNS zone, private DNS zone, hosted zone Quick peek Open full term page

Networking field-manual-complete Private DNS zone A private DNS zone is the private address book Azure uses when a virtual network needs internal name resolution. Instead of sending a service name to public DNS and getting a public address, linked virtual networks can resolve records inside the private zone. Private endpoints depend on this heavily because the application usually keeps calling the normal service hostname, while DNS quietly returns the private endpoint IP. When this is wrong, everything looks like a network outage even though the endpoint exists. DNS fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Storage learning-path-anchor Table service endpoint A Table service endpoint is the address your application uses when it talks to Azure Table Storage. For a normal Azure Storage account, it looks like an account-specific table URL. That address is not just a string in a connection setting; it determines DNS resolution, firewall evaluation, private endpoint routing, TLS, SDK configuration, and what operators test during an outage. If the endpoint is wrong, the table might exist and credentials might be valid, but clients still fail to connect. Table Storage intermediate 5 commands Aliases: Azure Table endpoint, Table Storage endpoint, storage table endpoint, Table data-plane endpoint Quick peek Open full term page

Containers learning-path-anchor System node pool A system node pool is the AKS worker pool that keeps the cluster itself functioning. It hosts core Kubernetes and AKS add-on pods such as DNS, networking agents, metrics, and connectivity components. You can technically run application pods there, but experienced teams avoid that because noisy workloads can starve the services that make the... Azure Kubernetes Service intermediate 4 commands Aliases: AKS system pool, system mode node pool, AKS platform node pool, kube-system node pool Quick peek Open full term page

Web premium App Service private endpoint An App Service private endpoint uses Azure Private Link to give an app a private IP address in a virtual network for inbound client access. App Service Networking intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium ExpressRoute ExpressRoute lets organizations extend on-premises networks into Microsoft cloud services over private connectivity provided through a connectivity provider. Teams use it to connect datacenters, branches, or colocation environments to Azure with predictable private paths for workloads that need stronger latency, bandwidth, and routing control than public internet connections. It is not a VPN tunnel, a private endpoint, an internet performance guarantee, or proof that every connected application is secure, redundant, or correctly routed. In production, confirm circuit state, provider state, peering configuration, BGP routes, gateway SKU, connected virtual networks, bandwidth, metrics, DNS path, firewall path, and provider escalation details before. Hybrid connectivity intermediate 6 commands Aliases: Azure ExpressRoute, ExpressRoute circuit, private Microsoft cloud connectivity Quick peek Open full term page

Databases premium Failover Failover is the process of moving an application, database, or service workload from a primary resource to a secondary resource when the primary is unavailable, unhealthy, or intentionally switched. Teams use it to keep a business service running by directing traffic, reads, writes, or recovery operations to a standby region, zone, replica, failover group, or disaster recovery target. It is not a backup by itself, a promise of zero data loss, automatic repair for every dependency, or proof that clients, DNS, identity, and downstream services will follow correctly. Business continuity intermediate 6 commands Aliases: service failover, regional failover, database failover, planned failover, unplanned failover Quick peek Open full term page

Storage premium File service endpoint A File service endpoint is the Azure Storage endpoint used by clients and services to access Azure Files shares in a storage account through supported protocols and network paths. Teams use it to connect applications, users, file sync agents, and automation to Azure file shares through the correct public endpoint, private endpoint, or virtual network service endpoint path. It is not a file share itself, a private endpoint by itself, a DNS record alone, authorization proof, or a guarantee that SMB, NFS, FileREST, firewall, and identity settings all match. Azure Files intermediate 6 commands Aliases: Azure Files endpoint, storage file endpoint, file endpoint, Azure Storage file service endpoint Quick peek Open full term page

Databases premium PostgreSQL connection string Application configuration that identifies the PostgreSQL server, database, port, authentication method, and TLS path used by a workload. Data platform intermediate 6 commands Aliases: PostgreSQL connection string, postgresql connection string, connection string, Azure Database for PostgreSQL connection string, FQDN, port 5432, port 6432 Quick peek Open full term page

Storage premium Service endpoint for Storage A service endpoint for Storage enables the Microsoft.Storage endpoint on a virtual network subnet and pairs it with storage account network rules. It lets workloads in that subnet reach Azure Storage over the Microsoft backbone while the account firewall allows only approved virtual network sources. Storage platform intermediate 6 commands Aliases: Azure Storage VNet rule, Microsoft.Storage service endpoint, Service endpoint for Storage, Storage service endpoint, service endpoint for storage, service-endpoint-for-storage Quick peek Open full term page

Containers premium AKS ingress controller Microsoft Learn explains AKS ingress through Kubernetes ingress resources and controllers that route HTTP or HTTPS traffic to services in a cluster. AKS application routing options can configure ingress controllers, DNS integration, TLS handling, and related networking components for production applications. AKS networking intermediate 5 commands Aliases: AKS ingress, Ingress controller for AKS, Kubernetes ingress controller Quick peek Open full term page

Containers premium AKS network policy An AKS network policy is a Kubernetes traffic-control policy used to restrict pod communication in Azure Kubernetes Service. AKS networking Intermediate 5 commands Aliases: Azure Kubernetes Service network policy, aks network policy Quick peek Open full term page

Containers premium AKS private cluster Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation. AKS networking advanced 5 commands Aliases: Azure Kubernetes Service private cluster, aks private cluster Quick peek Open full term page

Web premium App Service VNet integration Microsoft Learn describes App Service virtual network integration as the feature that lets an App Service app access resources in or through an Azure virtual network. It affects outbound traffic from the app; inbound private access uses other controls, such as private endpoints and access restrictions. App Service Networking intermediate 5 commands Aliases: App Service virtual network integration, regional VNet integration, Web App VNet integration Quick peek Open full term page

Containers premium Azure Container Registry A managed private registry service for building, storing, and managing container images and OCI artifacts for container deployments. Container images fundamentals 5 commands Aliases: ACR Quick peek Open full term page

Containers premium Container Apps custom domain A custom hostname assigned to a Container App ingress endpoint. Azure Container Apps intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Analytics premium Databricks workspace Private Link Databricks workspace Private Link is the Azure Private Link configuration that provides private connectivity paths to Azure Databricks workspace resources and related Databricks services without exposing traffic to the public internet. Azure Databricks advanced 5 commands Aliases: Azure Databricks Private Link, Databricks private endpoint, workspace private endpoint, front-end Private Link Quick peek Open full term page

Integration premium Event Grid domain Event Grid domain is an Event Grid resource that provides one publishing endpoint for many related domain topics in a large or multi-tenant event solution. In Azure, it shows up when a platform needs to manage thousands of related topics, tenant-specific subscriptions, or application-specific event streams without creating unrelated standalone topics. Teams use it to review domain endpoint, domain topics, access keys or identity controls, event subscriptions, RBAC, filters, publishing application logic, metrics, and tenant ownership model before changing production behavior. It is not a DNS custom domain, Event Grid namespace custom hostname, single custom topic, or Service Bus namespace. Event routing advanced 5 commands Aliases: Azure Event Grid domain, event domain Quick peek Open full term page

Integration premium Event Hubs private endpoint An Event Hubs private endpoint is a Private Link network interface that lets clients reach an Event Hubs namespace through a private IP address in a virtual network. Teams use it to keep Event Hubs traffic on private network paths and restrict namespace access from public internet routes. It is not an outbound connection from Event Hubs into your subnet, a substitute for authentication, or a guarantee that every Azure service can still reach the namespace. Event Hubs intermediate 5 commands Aliases: Private Link for Event Hubs, Event Hubs Private Link, private endpoint connection Quick peek Open full term page

Networking premium Front Door Azure Front Door is Microsoft’s global edge service for modern web applications. Microsoft Learn describes it as a cloud CDN that provides fast, reliable, and secure access to static and dynamic content through Microsoft’s global edge network worldwide. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door, AFD, Azure Front Door Standard, Azure Front Door Premium, global edge Quick peek Open full term page

Networking premium Front Door profile Front Door profile is the top-level Azure Front Door Standard or Premium resource that groups edge endpoints, routes, origins, domains, rule sets, security associations, and delivery settings. Teams use it to manage a global application entry point without treating each endpoint, route, or origin as a separate product. In daily Azure work, it shows up when engineers review edge architecture, add a new website, tune routing, attach custom domains, configure WAF, or troubleshoot global traffic. It is not the same thing as a single endpoint, DNS name, backend app, CDN cache rule, or web application firewall policy. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door profile, AFD profile, Front Door Standard/Premium profile Quick peek Open full term page

AI and Machine Learning premium Index alias Index alias is the Azure concept that controls how applications keep a stable search name while teams rebuild or swap the underlying index. Teams see it when working with azure ai search aliases, target index mappings. It is not a custom domain, a DNS record, a replica, or a second copy of index data; that distinction matters because bad assumptions create queries hitting stale indexes, broken cutovers. Use the term when reviewing ownership, access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same resource, setting, or behavior. Azure AI Search Intermediate 5 commands Aliases: search index alias, Azure AI Search alias, alias for search index, blue green search alias Quick peek Open full term page

Networking premium Ingress Ingress controls how users, APIs, partners, and internal services can reach a workload and which network controls protect that entry point. Teams see it in container apps ingress settings, kubernetes ingress controllers. It is not egress, a firewall rule alone, a load balancer backend pool, or an application route inside code; confusing them can create public exposure, unreachable apps. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Application Networking Fundamentals 5 commands Aliases: incoming application traffic, inbound app traffic, Container Apps ingress, external ingress, internal ingress Quick peek Open full term page

Containers premium Internal ingress Internal ingress controls whether a Container Apps workload can receive traffic only from internal callers such as APIs, jobs, service meshes, or workloads on connected networks. Teams see it in container apps ingress settings, managed environments. It is not external ingress, private endpoint for another service, App Service VNet integration, Kubernetes ingress, or an Azure Firewall rule; confusing them can create public exposure of internal services, unreachable APIs. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Azure Container Apps Intermediate 5 commands Aliases: Container Apps internal ingress, private ingress, internal-only ingress, VNet ingress Quick peek Open full term page

Networking premium Internet egress Internet egress controls how workloads reach public endpoints for updates, APIs, package feeds, SaaS services, telemetry, and other internet-reachable dependencies. Teams see it in virtual networks, nat gateways. It is not inbound internet traffic, private endpoint traffic, ExpressRoute private peering, internal ingress, or Azure service-to-service traffic over private routes; confusing them can create data exfiltration paths, blocked updates. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Outbound connectivity Intermediate 5 commands Aliases: outbound internet traffic, egress to internet, public egress, internet-bound traffic Quick peek Open full term page

Management and Governance premium Platform landing zone A platform landing zone is the shared Azure foundation that hosts common services for workload landing zones. It commonly includes connectivity, identity integration, management groups, policy, security monitoring, private DNS, logging, and automation so application teams can build on consistent enterprise guardrails. Governance operations fundamentals 5 commands Aliases: Azure platform landing zone, shared platform landing zone, enterprise-scale platform landing zone Quick peek Open full term page

Integration premium Service Bus geo-replication Service Bus geo-replication is a Premium-tier feature that continuously replicates a namespace's metadata and message data from the primary region to a secondary region. It lets operators promote the secondary when the primary region degrades, preserving queues, topics, subscriptions, filters, and message state. Service Bus advanced 5 commands Aliases: Service Bus data replication, Service Bus regional replication, Service Bus secondary region, Service Bus namespace replication, Service Bus Premium geo replication Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Management and Governance premium Azure data plane The Azure data plane is the part of Azure you use after a resource exists, when you interact with the capability that resource provides. Microsoft Learn anchors this term in Azure control plane and data plane, but this field-manual definition is intentionally wider than an older short glossary entry because the page must teach what to inspect, what can break, who owns the decision, and which evidence proves the Azure environment is behaving as intended. In field use, start with the technical boundary: Technically, data-plane operations are service-specific operations against. Azure Resource Manager fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Azure Files NFS share Azure Files NFS share is a specific Azure file share created for NFS access rather than SMB access. It helps Linux application owners and storage teams give workloads a managed shared POSIX-style file path without operating separate NFS appliances for every project. You see it when research clusters, Linux application farms, container platforms, or data processing systems need one shared path across many clients. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. NFS file shares intermediate 4 commands Aliases: NFS file share, NFS Azure file share Quick peek Open full term page

Storage premium Azure Files private endpoint Azure Files private endpoint connects Azure file share traffic to a storage account through a private IP address in a virtual network. It helps network, security, and storage teams keep SMB or NFS access on private network paths without exposing file access directly over public endpoints. You see it when regulated workloads need private access, branch users connect through VPN, or applications must mount shares without public storage exposure. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Private connectivity intermediate 4 commands Aliases: Private endpoint for Azure Files, Azure Files Private Link Quick peek Open full term page

Web premium Custom domain an organization-controlled DNS name bound to an Azure-hosted endpoint instead of the default service hostname. Domains and TLS fundamentals 4 commands Aliases: custom hostname, custom DNS name, application custom domain Quick peek Open full term page

Analytics premium Data Factory private endpoint A Private Link connection that exposes Data Factory or related data movement targets through a private IP address instead of a public network path. Data integration and orchestration Intermediate 4 commands Aliases: Data Factory private endpoint, ADF private endpoint, data factory private endpoint Quick peek Open full term page

Networking premium Front Door endpoint A Front Door endpoint is a logical grouping of one or more routes associated with domain names in an Azure Front Door profile. Application delivery and API edge intermediate 4 commands Aliases: Azure Front Door endpoint, AFD endpoint, azurefd.net endpoint Quick peek Open full term page

Management and Governance premium Global resource Global resource is an Azure resource or service configuration whose behavior is global or nonregional instead of being deployed as a normal workload in one Azure region. Teams use it to understand why resources such as Azure Front Door, DNS-related services, or tenant-level identity features do not behave like regional compute or storage resources. In daily Azure work, it shows up when engineers choose a resource group location for metadata, design global routing, review service availability, explain compliance scope, or troubleshoot why a regional outage affects dependencies differently. Azure Resource Manager intermediate 4 commands Aliases: nonregional Azure resource, global Azure resource, Azure global service resource Quick peek Open full term page

Web premium Managed certificate A managed certificate in Azure App Service is a platform-created TLS certificate for a supported custom domain. Azure can issue and renew it for basic HTTPS protection, but it has limitations compared with uploaded, Key Vault, or purchased certificates. That context supports safer operational decisions. TLS fundamentals 4 commands Aliases: App Service managed certificate, free managed certificate Quick peek Open full term page

Databases premium MySQL private access MySQL private access means a MySQL Flexible Server networking model that keeps database connectivity inside a virtual network instead of exposing a public endpoint. You see it when teams host sensitive workloads, enforce network isolation, connect applications through private subnets, or meet compliance expectations. Think of it as private network reachability for the database, not permission to read the data. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Integration premium Service Bus namespace A Service Bus namespace is the Azure management, DNS, identity, and network container for Service Bus messaging entities. It scopes queues, topics, subscriptions, rules, authorization settings, SKU choice, diagnostics, and access endpoints so applications can exchange brokered messages through one named service boundary. Messaging fundamentals 4 commands Aliases: Azure Service Bus namespace, Namespace, Service Bus broker namespace Quick peek Open full term page

Integration premium Service Bus private endpoint A Service Bus private endpoint is an Azure Private Link network interface that maps a virtual network to a Service Bus Premium namespace. It lets approved clients reach the namespace over private connectivity, reducing public exposure when DNS, network rules, and application routing are configured correctly. Service Bus advanced 4 commands Aliases: Azure Service Bus private endpoint, Service Bus Private Link, Private endpoint for Service Bus Quick peek Open full term page

AI and Machine Learning premium AI service endpoint An AI service endpoint is the HTTPS base address that applications use to call an Azure AI or Foundry Tools resource. It identifies the resource, region or custom subdomain, and may resolve through public DNS or a private endpoint. Azure AI services fundamentals 3 commands Aliases: Azure AI endpoint, Cognitive Services endpoint, Foundry Tools endpoint, AI resource URL Quick peek Open full term page

AI and Machine Learning premium AI services endpoint An AI services endpoint is the base URL for a multi-service Azure AI or Microsoft Foundry resource. Applications combine this endpoint with a supported API path and authentication method to call the resource. Azure AI services fundamentals 3 commands Aliases: multi-service endpoint, Foundry resource endpoint, AIServices endpoint, Cognitive Services endpoint Quick peek Open full term page

Storage premium Blob service endpoint Blob service endpoint is the address used to reach a storage account’s Blob service and is also the network target controlled by firewall, private endpoint, or service endpoint rules. Storage platform intermediate 3 commands Aliases: Blob service endpoint, service endpoint, blob service endpoint Quick peek Open full term page

Containers premium Container group the Azure Container Instances unit where containers share scheduling, lifecycle, local network, exposed endpoints, resources, and storage volumes Serverless containers fundamentals 3 commands Aliases: No aliases yet Quick peek Open full term page

Analytics field-manual-complete Synapse private endpoint A Synapse private endpoint is an Azure Private Link network interface that lets clients reach a Synapse workspace over a private IP address instead of the public internet. It is used with workspace development, SQL, and private-link patterns to reduce exposure and control network access. Synapse Analytics advanced 8 commands Aliases: Azure Synapse private endpoint, Synapse workspace private endpoint, Private Link for Synapse, private endpoint for Synapse workspace Quick peek Open full term page

Storage complete Storage account endpoint Storage account endpoint is documented by Microsoft as part of the Storage accounts area in Azure. Storage accounts fundamentals 8 commands Aliases: storage endpoint, blob endpoint, dfs endpoint, storage service URL Quick peek Open full term page

Storage complete Storage account failover Storage account failover is documented by Microsoft as part of the Storage accounts area in Azure. Storage accounts advanced 8 commands Aliases: account failover, storage failover, customer-managed failover, planned storage failover Quick peek Open full term page

Analytics field-manual-complete Kusto private endpoint A Kusto private endpoint connects clients on an Azure virtual network to an Azure Data Explorer cluster through Azure Private Link, using private IP addressing so query and ingestion traffic can avoid public internet exposure and follow private DNS and approval controls. Azure Data Explorer advanced 6 commands Aliases: No aliases yet Quick peek Open full term page

Web field-manual-complete App Service custom domain An App Service custom domain lets people use your real website name instead of the default azurewebsites.net address. You prove that you own the DNS name, point DNS records at the web app, and add the hostname to App Service. The setting is simple on the surface, but production success depends on DNS propagation, ownership verification, TLS certificates, redirects, and whether traffic also passes through Front Door, Traffic Manager, or another edge service. Plan it like a release. App Service intermediate 5 commands Aliases: app service custom domain, custom domain Quick peek Open full term page

App Hosting field-manual-complete App Service managed certificate An App Service managed certificate is a free certificate that Azure App Service can issue for an eligible custom domain on a web app or function app. App Service TLS Intermediate 5 commands Aliases: Azure App Service managed certificate, app service managed certificate Quick peek Open full term page

Web field-manual-complete App Service TLS binding An App Service TLS binding tells App Service which certificate to use for a custom domain. Without it, your app might be reachable by name but still show browser warnings, serve the wrong certificate, or fail HTTPS checks. The binding connects a hostname, a certificate thumbprint, and a binding type such as SNI. For users, it is the difference between a trusted secure site and a launch that looks broken or unsafe. Treat it as launch-blocking configuration. App Service Security intermediate 5 commands Aliases: TLS binding, SSL binding, App Service certificate binding, custom domain HTTPS binding Quick peek Open full term page