Search Azure terms

Networking field-manual-complete Private IP address A private IP address is the address an Azure resource uses inside a virtual network instead of on the public internet. IP addressing fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking verified Public IP address A public IP address exposes an Azure resource to the internet or enables outbound communication. IP addressing fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium CIDR block A CIDR block expresses an IP address range with an address and prefix length, such as 10.0.0.0/16, for virtual network address space, subnets, and routes. IP addressing fundamentals 3 commands Aliases: CIDR Quick peek Open full term page

Analytics field-manual-complete Kusto private endpoint A Kusto private endpoint connects clients on an Azure virtual network to an Azure Data Explorer cluster through Azure Private Link, using private IP addressing so query and ingestion traffic can avoid public internet exposure and follow private DNS and approval controls. Azure Data Explorer advanced 6 commands Aliases: No aliases yet Quick peek Open full term page

Databases field-manual-complete Redis private endpoint A Redis private endpoint gives your application a private IP path to Redis inside an Azure virtual network. Instead of letting clients reach the cache through its public endpoint, you attach a private endpoint to a subnet and connect through Private Link. The cache remains a managed Azure service, but traffic from approved networks resolves to private address space. This is most useful when security policy, compliance rules, or network design require Redis to behave like an internal dependency rather than an internet-exposed service. Cache and in-memory data intermediate 5 commands Aliases: Redis Private Endpoint, Azure Redis private endpoint, Redis endpoint over Private Link, Private Redis endpoint Quick peek Open full term page

Containers premium API server authorized IP ranges API server authorized IP ranges are an AKS security setting that limits who can reach the Kubernetes control-plane endpoint. Instead of letting any public IP attempt a connection to the API server, the cluster allows only specified public CIDR ranges, such as corporate VPN, jump-host, automation,. Azure Kubernetes Service intermediate 5 commands Aliases: AKS API server authorized IP ranges, authorized API server IP ranges Quick peek Open full term page

Networking premium Load balancer frontend IP Microsoft Learn describes a Load Balancer frontend IP configuration as the address-facing entry point that receives client traffic for a load balancer. It can use a public or private IP address and is connected to rules, probes, and backend pools. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Storage learning-path-anchor Data Lake storage account A storage feature or access model in Data Lake Storage Gen2 that helps teams store, protect, move, and govern application or analytics data with clearer ownership, safety, and operational context. Data Lake Storage Gen2 advanced 19 commands Aliases: No aliases yet Quick peek Open full term page

Containers premium Kubenet Kubenet is an AKS network plugin where nodes receive virtual network IP addresses and pods receive IP addresses from a separate pod CIDR, with routing handled through user-defined routes. AKS networking Intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Analytics learning-path-anchor Synapse workspace firewall A Synapse workspace firewall is the IP allowlist around a Synapse workspace when it accepts public network traffic. It decides which client IPv4 ranges can attempt to connect before identity permissions are evaluated. It does not grant access by itself; a user or service still needs the right Azure, Synapse, or SQL permissions. It... Synapse Analytics intermediate 6 commands Aliases: Synapse IP firewall rule, workspace firewall rule, Synapse workspace IP allowlist, Synapse public endpoint firewall Quick peek Open full term page

Databases premium Azure SQL logical server An Azure SQL logical server is a logical administrative construct for Azure SQL Database and related SQL resources. Microsoft Learn describes it as the central point for managing a collection of databases, including logins, firewall rules, auditing, threat detection policies, and failover groups. Azure SQL Database fundamentals 16 commands Aliases: No aliases yet Quick peek Open full term page

Containers verified Registry private endpoint A registry private endpoint lets workloads reach Azure Container Registry through private network addressing instead of the public registry endpoint. Your registry remains a managed Azure service, but clients such as AKS nodes, self-hosted build agents, virtual machines, or container platforms connect Azure Container Registry intermediate 5 commands Aliases: ACR private endpoint, Azure Container Registry Private Link, private registry endpoint, container registry private endpoint Quick peek Open full term page

Storage premium Locally redundant storage Microsoft Learn describes locally redundant storage as Azure Storage redundancy that replicates data within the primary region in a local storage scale unit. LRS is the lowest-cost redundancy option and provides high durability, but it does not protect against regional disasters. Azure Storage intermediate 10 commands Aliases: LRS Quick peek Open full term page

Web premium App Service private endpoint An App Service private endpoint uses Azure Private Link to give an app a private IP address in a virtual network for inbound client access. App Service Networking intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Data Lake analytics workload A production analytics workload that stores, transforms, governs, and serves large data sets from a data lake using Azure services such as ADLS Gen2, Data Factory, Databricks, Synapse, or Fabric. Data Lake Storage Intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium DDoS Protection Azure DDoS Protection is a network-layer protection service that helps defend Azure public IP resources against distributed denial-of-service attacks using always-on traffic monitoring, adaptive mitigation, telemetry, and response capabilities. Network security intermediate 6 commands Aliases: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, distributed denial of service protection Quick peek Open full term page

Databases premium PostgreSQL flexible server The managed Azure PostgreSQL server resource that owns compute, storage, backups, networking, high availability, parameters, and databases. PostgreSQL flexible server fundamentals 6 commands Aliases: PostgreSQL flexible server, postgresql flexible server, Azure Database for PostgreSQL flexible server, managed PostgreSQL, backup retention, high availability, private access Quick peek Open full term page

Databases premium PostgreSQL high availability PostgreSQL high availability means Azure keeps a standby flexible server ready so the database can continue after certain failures or planned failover events. Instead of relying on one server instance, the primary and standby are kept in sync. Depending on the design, the standby can be in the same availability zone or a different zone. This reduces downtime risk, but it does not remove every responsibility. Applications still need retry logic, connection handling, monitoring, tested failover procedures, and a cost owner because high availability adds real infrastructure. PostgreSQL flexible server intermediate 6 commands Aliases: PostgreSQL high availability, postgresql high availability, Azure Database for PostgreSQL flexible server Quick peek Open full term page

Storage premium Service endpoint for Storage A service endpoint for Storage enables the Microsoft.Storage endpoint on a virtual network subnet and pairs it with storage account network rules. It lets workloads in that subnet reach Azure Storage over the Microsoft backbone while the account firewall allows only approved virtual network sources. Storage platform intermediate 6 commands Aliases: Azure Storage VNet rule, Microsoft.Storage service endpoint, Service endpoint for Storage, Storage service endpoint, service endpoint for storage, service-endpoint-for-storage Quick peek Open full term page

Storage premium Service SAS A service SAS is a shared access signature that delegates limited access to a specific Azure Storage service resource, such as a blob, queue, table, or file. It is signed with a storage account key and constrains permissions, resource scope, protocol, IP range, and expiry time. Blob Storage fundamentals 6 commands Aliases: Azure Storage service SAS, Service SAS, service sas, service shared access signature, service-sas, storage service SAS Quick peek Open full term page

Storage premium Account SAS An account SAS is a powerful storage access token signed with the account key. It can grant limited access across multiple storage services, but because it is key-based and hard to audit, keep permissions narrow and expiry short. Blob Storage fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Databases premium Active geo-replication Active geo-replication is an Azure SQL Database business-continuity feature that continuously replicates one primary database to a readable secondary database, often in another Azure region. It supports manual or programmatic geo-failover for individual databases and can also serve read-only workloads from the secondary. Azure SQL continuity advanced 5 commands Aliases: Azure SQL active geo-replication, geo-secondary, geo-replica Quick peek Open full term page

Containers premium AKS managed identity An AKS managed identity is a Microsoft Entra identity that an AKS cluster uses to manage Azure resources without stored service principal secrets. AKS identity Intermediate 5 commands Aliases: Azure Kubernetes Service managed identity, aks managed identity Quick peek Open full term page

Containers premium AKS private cluster Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation. AKS networking advanced 5 commands Aliases: Azure Kubernetes Service private cluster, aks private cluster Quick peek Open full term page

Databases premium Azure SQL Database Azure SQL Database is a fully managed relational database service in Azure that provides SQL Server-compatible engines as single databases, elastic pools, and serverless or provisioned compute choices. Microsoft Learn presents it as platform as a service with built-in availability, backups, patching, scaling, and security integration. Database intermediate 5 commands Aliases: Azure SQL DB, Azure SQL Database, Azure SQL pooled database, Azure SQL single database, SQL Database Quick peek Open full term page

Containers premium Container Apps ingress The Container Apps setting that controls whether and how HTTP or TCP traffic reaches a container app. Azure Container Apps intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Integration premium Event Hubs private endpoint An Event Hubs private endpoint is a Private Link network interface that lets clients reach an Event Hubs namespace through a private IP address in a virtual network. Teams use it to keep Event Hubs traffic on private network paths and restrict namespace access from public internet routes. It is not an outbound connection from Event Hubs into your subnet, a substitute for authentication, or a guarantee that every Azure service can still reach the namespace. Event Hubs intermediate 5 commands Aliases: Private Link for Event Hubs, Event Hubs Private Link, private endpoint connection Quick peek Open full term page

Networking premium Ingress Ingress controls how users, APIs, partners, and internal services can reach a workload and which network controls protect that entry point. Teams see it in container apps ingress settings, kubernetes ingress controllers. It is not egress, a firewall rule alone, a load balancer backend pool, or an application route inside code; confusing them can create public exposure, unreachable apps. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Application Networking Fundamentals 5 commands Aliases: incoming application traffic, inbound app traffic, Container Apps ingress, external ingress, internal ingress Quick peek Open full term page

Containers premium Internal ingress Internal ingress controls whether a Container Apps workload can receive traffic only from internal callers such as APIs, jobs, service meshes, or workloads on connected networks. Teams see it in container apps ingress settings, managed environments. It is not external ingress, private endpoint for another service, App Service VNet integration, Kubernetes ingress, or an Azure Firewall rule; confusing them can create public exposure of internal services, unreachable APIs. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Azure Container Apps Intermediate 5 commands Aliases: Container Apps internal ingress, private ingress, internal-only ingress, VNet ingress Quick peek Open full term page

Networking premium Internet egress Internet egress controls how workloads reach public endpoints for updates, APIs, package feeds, SaaS services, telemetry, and other internet-reachable dependencies. Teams see it in virtual networks, nat gateways. It is not inbound internet traffic, private endpoint traffic, ExpressRoute private peering, internal ingress, or Azure service-to-service traffic over private routes; confusing them can create data exfiltration paths, blocked updates. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Outbound connectivity Intermediate 5 commands Aliases: outbound internet traffic, egress to internet, public egress, internet-bound traffic Quick peek Open full term page

Security premium Just-in-time VM access Just-in-time VM access is the Microsoft Defender for Cloud control that locks down VM management ports and opens approved inbound access only for a limited time. Defender for Cloud intermediate 5 commands Aliases: JIT VM access, Defender for Cloud JIT, just in time access, JIT network access policy Quick peek Open full term page

Networking premium NAT Gateway NAT Gateway means a managed Azure networking service that provides outbound internet connectivity for private resources in associated subnets. You see it when teams let virtual machines, containers, or private application workloads reach updates, APIs, package feeds, or external services. Think of it as an outbound source address and SNAT boundary, not a firewall for all network traffic. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Outbound connectivity fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Network Security Group Network Security Group means an Azure rule set that filters inbound and outbound network traffic for subnets or network interfaces. You see it when teams restrict application ports, isolate workloads, permit administration, block unwanted traffic, or document network segmentation. Think of it as a prioritized traffic filter near the workload, not complete application security. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Network security fundamentals 5 commands Aliases: NSG Quick peek Open full term page

Management and Governance premium Policy definition The rule template that tells Azure Policy what to evaluate and which effect to apply when resources match. Azure Policy fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium POSIX ACL Azure Data Lake Storage supports POSIX-like access control lists on files and directories. Each ACL entry associates a user, group, service principal, or managed identity with permissions, so fine-grained authorization can complement broader Azure RBAC roles on the storage account. Data Lake Storage Gen2 fundamentals 5 commands Aliases: ADLS ACL, Azure Data Lake ACL, Data Lake POSIX ACL, path ACL Quick peek Open full term page

Databases premium PostgreSQL backup retention Azure Database for PostgreSQL automatically backs up flexible servers and retains the files and transaction logs for a configured window. The retention period defines how far back point-in-time restore can recover, with seven days as the default and up to thirty-five days configurable. PostgreSQL flexible server fundamentals 5 commands Aliases: Azure PostgreSQL backup retention, Flexible Server backup retention, PostgreSQL PITR retention Quick peek Open full term page

Databases premium PostgreSQL connection pooling PostgreSQL connection pooling reuses database connections instead of opening a new server process for every request. Azure Database for PostgreSQL supports pooling strategies including built-in PgBouncer on supported flexible server tiers to reduce idle and short-lived connection overhead. across applications. PostgreSQL flexible server fundamentals 5 commands Aliases: Azure PostgreSQL PgBouncer, PgBouncer, PostgreSQL pooling, database connection pooling Quick peek Open full term page

Databases premium PostgreSQL database A named PostgreSQL catalog inside a flexible server that holds schemas, tables, extensions, permissions, and application data. Azure Database for PostgreSQL fundamentals 5 commands Aliases: PostgreSQL database, postgresql database, Azure Database for PostgreSQL database, database catalog, schema migration, charset, collation Quick peek Open full term page

Databases premium PostgreSQL extension An allowlisted PostgreSQL add-on package that expands database behavior, such as statistics, geospatial, vector, or cryptographic capability. PostgreSQL intermediate 5 commands Aliases: PostgreSQL extension, postgresql extension, Azure PostgreSQL extension, azure.extensions, CREATE EXTENSION, pgvector, pg_stat_statements Quick peek Open full term page

Databases premium PostgreSQL firewall rule A public-network access rule that permits a specific IPv4 range to reach an Azure Database for PostgreSQL flexible server. PostgreSQL flexible server intermediate 5 commands Aliases: PostgreSQL firewall rule, postgresql firewall rule, Azure PostgreSQL firewall, public access, IPv4 allowlist, source IP, start IP address Quick peek Open full term page

Databases premium PostgreSQL maintenance window A PostgreSQL maintenance window is the time Azure is allowed to perform scheduled platform maintenance for a flexible server. With a system-managed schedule, Azure chooses a suitable window. With a custom schedule, the team chooses the day and start time for the one-hour window. This matters because maintenance can involve updates that briefly affect availability or performance. The window is not a promise that nothing will ever happen outside it, but it gives teams a predictable place to plan patching communication, staffing, workload quiet periods, and post-maintenance checks. Azure Database for PostgreSQL intermediate 5 commands Aliases: PostgreSQL maintenance window, postgresql maintenance window, Azure Database for PostgreSQL flexible server Quick peek Open full term page

Management and Governance premium Quota Microsoft Learn describes Azure quotas as adjustable limits applied to Azure resources and services within a subscription, region, or provider scope. Each subscription receives default quota values, and teams can review usage or request increases before planned scale, migration, or recovery work consumes available capacity. Capacity management fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Networking premium Service tag A service tag is a Microsoft-managed label that represents a changing set of IP address prefixes for an Azure service or network category. Administrators use service tags in NSG, firewall, and route rules so rules can reference the service name instead of manually maintained IP ranges. Network security fundamentals 5 commands Aliases: Service tag, service-tag, service tag, Service-tag Quick peek Open full term page

Storage premium Trusted Microsoft services access Trusted Microsoft services access is an Azure Storage firewall exception that allows selected Azure services to reach a restricted storage account when their service traffic cannot be represented by virtual network or IP rules. The services still authenticate and must be allowed for supported operations. Azure Storage intermediate 5 commands Aliases: trusted Azure services access, AzureServices bypass, allow trusted Microsoft services, storage trusted services access Quick peek Open full term page

Networking premium Application Gateway Application Gateway is an Azure web traffic load balancer for HTTP and HTTPS applications. It routes requests by host name, path, listener, rule, backend pool, and health status, and can add TLS termination and Web Application Firewall controls when those features are configured. Application delivery fundamentals 4 commands Aliases: Azure Application Gateway, App Gateway, regional layer 7 load balancer, HTTP application load balancer Quick peek Open full term page

Networking premium Application Gateway listener the Application Gateway component that waits for client requests on a frontend IP address, port, protocol, and optional hostname or certificate. Application delivery and API edge intermediate 4 commands Aliases: Application Gateway listener, application gateway listener Quick peek Open full term page

Security premium Application Gateway WAF policy An Application Gateway WAF policy stores Web Application Firewall configuration for Application Gateway v2. It includes managed rules, custom rules, exclusions, and policy settings, and can be associated globally, with a listener, or with a path-based rule for targeted web request inspection. Web application firewall intermediate 4 commands Aliases: Application Gateway WAF policy, WAF policy for Application Gateway, Azure WAF policy, regional WAF policy Quick peek Open full term page

Databases premium Automatic tuning Automatic tuning is Azure SQL Database’s built-in assistant for common query performance problems. In plain terms, Azure watches how queries behave and can recommend or apply changes that improve performance, such as index adjustments or plan correction. It is useful when workloads change faster than people can manually tune every query.. Azure SQL intermediate 4 commands Aliases: Azure SQL automatic tuning, SQL automatic tuning, automatic plan correction, automatic index tuning Quick peek Open full term page

Compute premium Availability zone Availability zone is a physically separate zone inside an Azure region with independent datacenter infrastructure such as power, cooling, and networking. In Azure, teams encounter it when architects choose whether a workload should pin resources to one zone or spread service instances across multiple zones. The useful question is what behavior it proves, who owns Availability fundamentals 4 commands Aliases: Azure availability zone, zone, zone-redundant deployment, zonal deployment Quick peek Open full term page