Search Azure terms

Identity premium Identity Governance Identity Governance is a Microsoft Entra set of capabilities for managing identity lifecycle, access lifecycle, access reviews, entitlement management, and privileged access. Identity operations intermediate 4 commands Aliases: Entra ID Governance, identity governance, Identity Governance, Microsoft Entra Identity Governance Quick peek Open full term page

Identity premium Assignment managed identity Assignment managed identity is the identity Azure Policy uses when a policy assignment must change resources during remediation. It matters most for effects such as modify and deployIfNotExists, where Policy is not just reporting non-compliance but attempting to fix or deploy something. The identity needs Azure RBAC permissions at the right scope. Without those. Azure Policy intermediate 2 commands Aliases: Policy assignment identity, Azure Policy managed identity, policy remediation identity, assignment identity Quick peek Open full term page

Identity verified Resource identity A resource identity is the Azure identity a workload uses when it needs permission to call another service. Most teams see it as a system-assigned or user-assigned managed identity on a VM, App Service, Function, container app, automation account, or data service. Instead of storing a password or client secret, the resource receives a Microsoft Entra identity and uses tokens. Operators then grant that identity roles on Key Vault, Storage, SQL, Cosmos DB, or other dependencies. Identity operations fundamentals 5 commands Aliases: Workload identity for a resource, Managed identity surface Quick peek Open full term page

Identity verified Workload identity federation Workload identity federation lets an external workload exchange a trusted token for Microsoft Entra access tokens without storing long-lived secrets. Microsoft Entra validates the issuer, subject, and audience in a federated credential, then allows automation such as GitHub Actions, Kubernetes, or other platforms to access protected resources. Identity operations fundamentals 5 commands Aliases: Federated workload identity, OIDC federation for workloads, Federated identity credential, Secretless workload authentication Quick peek Open full term page

Identity premium Access package An access package bundles resources someone may need for a job or project. Instead of asking separately for groups, apps, or sites, a user requests the package, and Entra applies approval, duration, review, and removal rules. Identity operations fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Trusted Microsoft services access Trusted Microsoft services access is an Azure Storage firewall exception that allows selected Azure services to reach a restricted storage account when their service traffic cannot be represented by virtual network or IP rules. The services still authenticate and must be allowed for supported operations. Azure Storage intermediate 5 commands Aliases: trusted Azure services access, AzureServices bypass, allow trusted Microsoft services, storage trusted services access Quick peek Open full term page

Storage premium Trusted Microsoft services for storage Trusted Microsoft services for Azure Storage are specific Azure services that Microsoft documents as eligible for storage firewall exceptions. Depending on the service, access may be based on tenant registration, supported operations, or managed identity authorization combined with Azure RBAC or Data Lake ACLs. Storage platform intermediate 5 commands Aliases: trusted Azure services for Storage, storage trusted services list, Azure Storage trusted services, trusted services storage firewall Quick peek Open full term page

Identity premium App role An app role is an application-defined permission or responsibility, such as Reader, Approver, or Orders.Write. The resource application defines the role, and users, groups, or client applications can be assigned to it. When the user or application gets a token, the role can appear as a claim for. Identity operations fundamentals 4 commands Aliases: application role, Microsoft Entra app role Quick peek Open full term page

Identity premium App role assignment An app role assignment is the actual grant that connects a principal to an app role. The principal might be a user, group, or service principal, and the role is defined by the resource application. Without an assignment, the role exists but nobody receives it. With an assignment, tokens or. Identity operations intermediate 4 commands Aliases: application role assignment, Microsoft Entra app role assignment Quick peek Open full term page

Identity premium Application permission An application permission is an app-only permission, also exposed as an app role, that lets a client application access a resource without a signed-in user after consent is granted. Identity operations fundamentals 4 commands Aliases: application permission Quick peek Open full term page

AI and Machine Learning premium Azure AI Foundry hub Azure AI Foundry hub is the classic Foundry hub resource used to group AI projects that share common security, data access, connections, and platform settings. In Azure, teams encounter it when teams need hub-based projects for selected Foundry and Azure Machine Learning scenarios such as fine-tuning, shared connections, and custom ML work. The useful question AI platform advanced 4 commands Aliases: AI Hub, Foundry AI Hub, hub-based project, Azure AI hub Quick peek Open full term page

AI and Machine Learning premium Azure AI Foundry project An Azure AI Foundry project is the working area where a team builds and organizes an AI application inside Microsoft Foundry. It keeps related agents, evaluations, files, indexes, tools, connections, and model usage together instead of scattering them across a shared portal. Think of it as the project boundary for one AI product, prototype, or team. It is useful because AI work quickly becomes messy: prompts, test data, model deployments, safety checks, and access decisions all need a home with ownership and repeatable operations. AI platform advanced 4 commands Aliases: AI Foundry project, AI project, Foundry project, Microsoft Foundry project Quick peek Open full term page

AI and Machine Learning premium Azure AI Language Azure AI Language is the Azure natural-language processing service for analyzing and understanding text with prebuilt and customizable language capabilities. AI services intermediate 4 commands Aliases: Azure Language, Azure Language in Foundry Tools, Azure Language service, Language in Foundry Tools, Language service Quick peek Open full term page

AI and Machine Learning premium Azure AI Search data source Azure AI Search data source is the connection definition an Azure AI Search indexer uses to read content from a supported external data store. AI platform and search intermediate 4 commands Aliases: Search data source, SearchIndexerDataSourceConnection, data source connection, indexer data source, search data source connection Quick peek Open full term page

AI and Machine Learning premium Azure AI services Azure AI services is the family of Azure cloud AI APIs and resources, surfaced through Foundry Tools, for vision, speech, language, translation, content, and generative scenarios. AI services fundamentals 4 commands Aliases: AI services, Azure AI services account, Cognitive Services, Foundry Tools Quick peek Open full term page

Identity premium Delegated permission A delegated permission is a Microsoft identity platform permission that lets an application act on behalf of a signed-in user, limited by both the granted permission and the user’s own access. Identity operations intermediate 4 commands Aliases: OAuth delegated permission, Microsoft Graph delegated permission, user delegated permission Quick peek Open full term page

Identity premium Break-glass account A break-glass account is an emergency access account reserved for tenant recovery when normal administrative sign-in or Conditional Access paths fail. Privileged access fundamentals 3 commands Aliases: emergency access account Quick peek Open full term page

Identity premium Consent grant the Microsoft Entra permission approval that lets an application call an API with delegated user scopes or application roles Identity operations fundamentals 3 commands Aliases: No aliases yet Quick peek Open full term page

Identity field-manual-complete User consent User consent is the process where a signed-in user allows an application to access protected resources on the user’s behalf. In Microsoft Entra ID, tenant settings and permission policies control whether users can grant consent and which delegated permissions are allowed. Application consent intermediate 5 commands Aliases: OAuth user consent, delegated consent, application consent prompt, consent grant Quick peek Open full term page

Compute verified VM user data VM user data is scripts or metadata associated with an Azure virtual machine and retrievable from the Instance Metadata Service after provisioning. It can be added or updated outside the VM, persists for the VM lifetime, and must not contain confidential information. Virtual Machines intermediate 5 commands Aliases: VM user data, vm user data Quick peek Open full term page

Identity field-manual-complete Security group A security group is a named set of identities that receive access together. Identity operations fundamentals 4 commands Aliases: Microsoft Entra security group, Entra security group, access group Quick peek Open full term page

Analytics learning-path-anchor Synapse workspace managed identity A Synapse workspace managed identity is the workspace's own identity in Microsoft Entra ID. Instead of saving passwords, keys, or connection strings inside pipelines and notebooks, Synapse can use this identity to ask for tokens and reach trusted Azure resources. It is commonly used for Data Lake Storage, Key Vault, SQL, and linked service... Synapse Analytics intermediate 8 commands Aliases: Synapse managed service identity, Synapse MSI, workspace system-assigned identity, Synapse workspace identity Quick peek Open full term page

Containers premium AKS managed identity An AKS managed identity is a Microsoft Entra identity that an AKS cluster uses to manage Azure resources without stored service principal secrets. AKS identity Intermediate 5 commands Aliases: Azure Kubernetes Service managed identity, aks managed identity Quick peek Open full term page

Containers premium Kubelet identity Kubelet identity controls how AKS nodes authenticate to Azure resources for node-level tasks, especially pulling container images from registries without embedded secrets. Teams see it in aks identity profile, node pools. It is not cluster control-plane identity, workload identity, pod managed identity, service account token, kubeconfig credential, or container registry admin user; confusing them can create image pull failures, overbroad registry access. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. AKS identity Intermediate 5 commands Aliases: AKS kubelet identity, node pool kubelet identity, AKS node managed identity, identityProfile kubeletidentity Quick peek Open full term page

Analytics premium Data Factory managed identity The Microsoft Entra identity assigned to a Data Factory so pipelines and linked services can access Azure resources without embedded passwords. Data integration and orchestration Intermediate 4 commands Aliases: Data Factory managed identity, ADF managed identity, data factory managed identity Quick peek Open full term page

Integration premium Logic Apps managed identity A Logic Apps managed identity is the Microsoft Entra identity assigned to a Logic Apps workflow or Standard logic app resource so the workflow can authenticate to supported Azure resources without storing passwords, shared keys, or long-lived secrets in governed production environments. Azure Logic Apps intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Security premium Managed identity for data access Managed identity for data access is the pattern of using a managed identity to let a workload read or write data without embedded secrets. Teams use it when pipelines, applications, jobs, or analytics services need secure access to storage, databases, or other data services. In plain English, it gives operators a named control for least-privilege data access, reduced secret exposure, and cleaner audit trails instead of leaving the decision hidden in a portal setting, script, or deployment file. Treat it as production-ready only when the owner, dependencies, permission boundary, monitoring signal, and rollback evidence are clear. Data access security intermediate 3 commands Aliases: Managed identity for data access, Microsoft Entra ID, Data access security Quick peek Open full term page

Identity learning-path-anchor System-assigned managed identity A system-assigned managed identity lets one Azure resource authenticate without a stored password, client secret, or certificate managed by your app team. You turn it on for a resource such as a web app, function, virtual machine, data factory, or automation account. Azure creates an identity for that resource, and the resource can request... Managed identities intermediate 4 commands Aliases: system assigned identity, resource managed identity, SystemAssigned identity, managed service identity Quick peek Open full term page

Compute verified VM system-assigned identity VM system-assigned identity is a Microsoft Entra managed identity created directly on an Azure virtual machine. Azure manages its credentials, ties its lifecycle to that VM, and lets the guest request tokens for authorized Azure resources without storing secrets in code. Virtual Machines intermediate 5 commands Aliases: VM system-assigned identity, vm system-assigned identity Quick peek Open full term page

Identity premium Federated identity credential A Federated identity credential is a Microsoft Entra credential object that defines the issuer, subject, and audience trusted for workload identity federation. Teams use it to allow a specific external workload identity to authenticate as an Entra application or user-assigned managed identity without storing a client secret or certificate. It is not a role assignment, token issued by Azure, user sign-in method, broad trust for every workflow in a repository, or evidence that the workload can access resources without RBAC. Workload identity intermediate 6 commands Aliases: Microsoft Entra federated identity credential, FIC, workload identity credential, OIDC federation credential Quick peek Open full term page

AI and Machine Learning premium Azure OpenAI managed identity Azure OpenAI managed identity uses Microsoft Entra identities so Azure workloads can call model endpoints without stored keys. Azure OpenAI intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Integration premium Event Grid managed identity delivery Event Grid managed identity delivery is the pattern where Event Grid uses a managed identity on a topic, domain, or system topic to authenticate event delivery to supported destinations. In Azure, it shows up when teams want to deliver events to Azure destinations without storing destination keys or embedding secrets in event subscription configuration. Teams use it to review system-assigned or user-assigned identity, Event Grid topic or domain identity settings, destination RBAC role assignments, delivery identity settings, dead-letter identity settings, and monitoring before changing production behavior. Event routing advanced 5 commands Aliases: Event Grid managed identity event delivery, managed identity delivery for Event Grid Quick peek Open full term page

Integration premium Service Bus managed identity Service Bus managed identity means using Microsoft Entra managed identities so Azure-hosted applications can access Service Bus without stored credentials. Applications receive RBAC roles such as Data Sender or Data Receiver, while Service Bus namespace identities may also be assigned for service-managed scenarios such as encryption configuration. Service Bus fundamentals 5 commands Aliases: Service Bus identity-based access, Service Bus Entra authentication, managed identity for Service Bus, Service Bus secretless authentication, Service Bus RBAC identity Quick peek Open full term page

Internet of Things premium Device identity A device identity is the IoT Hub identity registry entry that represents a permitted device or module, including its device ID, authentication material, status, and connection-related metadata. IoT identity fundamentals 4 commands Aliases: IoT Hub device identity, IoT device registry identity, device registry entry, IoT device ID Quick peek Open full term page

Web premium Function app managed identity Function app managed identity is a Microsoft Entra identity assigned to a function app so its code and supported bindings can access Azure resources without storing passwords or connection strings. Teams use it to replace secrets in app settings with identity-based access to services such as Storage, Service Bus, Key Vault, Event Hubs, SQL, or monitoring resources. In daily Azure work, it shows up when engineers grant a function app data-plane permissions, remove leaked connection strings, configure identity-based bindings, or investigate why a trigger cannot reach its dependency. Azure Functions intermediate 4 commands Aliases: Azure Functions managed identity, managed identity for Functions, function app identity Quick peek Open full term page

Identity premium Identity Protection Identity Protection is a Microsoft Entra capability that detects, investigates, and helps remediate risky users and risky sign-ins. Security intermediate 4 commands Aliases: Entra ID Protection, identity protection, Identity Protection, identity risk protection, Microsoft Entra ID Protection Quick peek Open full term page

Identity premium Managed identity A managed identity is an automatically managed Microsoft Entra identity assigned to a supported Azure resource. It lets workloads authenticate to services that support Microsoft Entra authentication without storing passwords, certificates, or client secrets in code, configuration, or deployment pipelines. Microsoft Entra workload identity intermediate 3 commands Aliases: Managed identity, system-assigned managed identity, user-assigned managed identity, Azure workload identity, secretless authentication, system-assigned identity, user-assigned identity, Microsoft Entra ID, Microsoft Entra workload identity Quick peek Open full term page

Identity verified Workload identity A workload identity is an identity assigned to software, such as an application, service, script, or container, so it can authenticate to Microsoft Entra protected resources. In Azure, examples include app registrations, service principals, managed identities, and federated workload identities. Workload identity fundamentals 6 commands Aliases: No aliases yet Quick peek Open full term page

Containers field-manual-complete AKS workload identity AKS workload identity lets a pod sign in to Azure as an approved identity without storing a password, client secret, or long-lived key inside the container. You connect a Kubernetes service account to a Microsoft Entra application or managed identity through federation. When the pod runs, Azure trusts the service account token from the cluster OIDC issuer and issues access tokens for allowed resources. The result is cleaner secret handling for applications running in AKS. AKS Identity intermediate 5 commands Aliases: Microsoft Entra Workload ID for AKS, pod workload identity, AKS OIDC federation Quick peek Open full term page

Identity field-manual-complete Privileged Identity Management Privileged Identity Management, usually called PIM, is the Microsoft Entra feature that keeps powerful access from being permanently active unless someone really needs it. Access control fundamentals 5 commands Aliases: PIM Quick peek Open full term page

Identity field-manual-complete User-assigned managed identity A standalone managed identity that can be attached to one or more Azure resources. Managed identities fundamentals 5 commands Aliases: UAMI, user managed identity, reusable managed identity Quick peek Open full term page

Compute verified VM user-assigned identity VM user-assigned identity is a reusable managed identity resource attached to a virtual machine so software on that VM can request Microsoft Entra tokens without stored credentials. Its lifecycle and permissions are managed separately from the VM across rebuilds and fleets. Virtual Machines intermediate 5 commands Aliases: VM user-assigned managed identity, user-assigned managed identity for virtual machines, virtual machine user-assigned identity, managed identity attached to VM Quick peek Open full term page

Identity learning-path-anchor Tenant ID A tenant ID is the globally unique identifier for a Microsoft Entra tenant. Microsoft Entra fundamentals 4 commands Aliases: Tenant ID, tenant id, Azure Tenant ID, Microsoft Entra tenant ID, directory ID, tenantId Quick peek Open full term page

Analytics command-rich Synapse workspace A Synapse workspace is the main container where a team builds and operates Azure Synapse Analytics. It gives the team one named place for SQL pools, Spark pools, pipelines, notebooks, linked services, access rules, monitoring, and the connection to the default data lake. The workspace is not just a folder in the portal; it... Analytics platform fundamentals 9 commands Aliases: Azure Synapse workspace, Synapse Analytics workspace, workspace in Azure Synapse, Synapse analytics boundary Quick peek Open full term page

Storage command-rich Table row key A Table row key is the unique name of an entity inside one Azure Table partition. PartitionKey gets you to the right group; RowKey identifies the exact record in that group. Together they form the entity primary key. RowKey design often carries an order ID, device ID, timestamp pattern, sequence number, or composite value. It matters because point reads, updates, deletes, duplicate detection, and... Storage platform intermediate 5 commands Aliases: Azure Table RowKey, Table Storage RowKey, Table row key value, RowKey property Quick peek Open full term page

Analytics learning-path-anchor Synapse Spark pool A Synapse Spark pool is the workspace compute definition Azure Synapse uses to start Apache Spark sessions. It records node size, node count, autoscale behavior, runtime version, packages, and idle timeout so notebooks, Spark jobs, and pipelines get repeatable distributed processing. Synapse Analytics fundamentals 8 commands Aliases: Apache Spark pool, Spark pool, Synapse Apache Spark pool, serverless Spark pool Quick peek Open full term page

Developer Tools premium Azure CLI A cross-platform command-line tool for connecting to Azure and executing administrative commands on Azure resources. Command line fundamentals 6 commands Aliases: az, Azure command-line interface Quick peek Open full term page

Containers premium Azure Kubernetes Service Azure Kubernetes Service is Azure’s managed Kubernetes service for deploying, scaling, and operating containerized applications while Azure manages much of the cluster control plane. Managed Kubernetes advanced 6 commands Aliases: AKS, managed Kubernetes Quick peek Open full term page

Analytics premium Data Factory Azure’s managed data integration service for creating pipelines that move, transform, schedule, and orchestrate data across cloud, SaaS, and hybrid stores. Data integration and orchestration Intermediate 6 commands Aliases: Data Factory, Data Factory, data factory Quick peek Open full term page

Management and Governance premium Explicit dependency An Explicit dependency is a manually declared deployment ordering relationship, commonly expressed with dependsOn in ARM templates or Bicep. Teams use it to force one Azure resource, module, or deployment step to wait for another when implicit dependency detection is not enough. It is not a runtime application dependency, a network dependency, a policy assignment, or a reason to serialize every resource deployment unnecessarily. In production, confirm resource or module names, dependsOn entries, implicit references, parent-child declarations, deployment operations, failed operation timestamps, what-if output, and whether ordering is truly required before treating the design as healthy or ready for release. ARM deployments advanced 6 commands Aliases: dependsOn dependency, manual deployment dependency, Bicep explicit dependency Quick peek Open full term page