Search Azure terms

Networking premium Network Security Group Network Security Group means an Azure rule set that filters inbound and outbound network traffic for subnets or network interfaces. You see it when teams restrict application ports, isolate workloads, permit administration, block unwanted traffic, or document network segmentation. Think of it as a prioritized traffic filter near the workload, not complete application security. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Network security fundamentals 5 commands Aliases: NSG Quick peek Open full term page

Compute premium Accelerated networking for VM Accelerated networking is a VM network performance feature. When the VM size and OS support it, Azure can send packets through a faster path that reduces CPU work, latency, and jitter. It is most useful for network-intensive workloads. Virtual Machines intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Network Watcher Network Watcher means an Azure diagnostics service that helps inspect, monitor, and troubleshoot network behavior across supported Azure resources. You see it when teams test connectivity, capture packets, review flow logs, inspect topology, or prove whether a problem is network-related. Think of it as a network evidence toolkit, not a replacement for application logs or security analytics. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Diagnostics fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Application security group An application security group lets you group virtual machine network interfaces so network security group rules can target application roles instead of explicit IP addresses. Network security fundamentals 2 commands Aliases: ASG, application security group Quick peek Open full term page

Analytics field-manual-complete Synapse managed virtual network A Synapse managed virtual network is the Azure-managed network boundary associated with a Synapse workspace. It isolates workspace data integration and Spark resources, enables managed private endpoints, and can restrict outbound connectivity to approved targets when data exfiltration protection is enabled at workspace creation. Synapse Analytics intermediate 5 commands Aliases: Azure Synapse managed virtual network, Synapse managed VNet, managed workspace virtual network, Synapse workspace managed VNet Quick peek Open full term page

Networking field-manual-complete Virtual network An Azure private network boundary for subnets, routing, filtering, peering, and private connectivity. Azure Virtual Network beginner 5 commands Aliases: Azure VNet, VNet, virtual network in Azure, private Azure network, virtual network Quick peek Open full term page

Identity field-manual-complete Security group A security group is a named set of identities that receive access together. Identity operations fundamentals 4 commands Aliases: Microsoft Entra security group, Entra security group, access group Quick peek Open full term page

Analytics learning-path-anchor Synapse workspace firewall A Synapse workspace firewall is the IP allowlist around a Synapse workspace when it accepts public network traffic. It decides which client IPv4 ranges can attempt to connect before identity permissions are evaluated. It does not grant access by itself; a user or service still needs the right Azure, Synapse, or SQL permissions. It... Synapse Analytics intermediate 6 commands Aliases: Synapse IP firewall rule, workspace firewall rule, Synapse workspace IP allowlist, Synapse public endpoint firewall Quick peek Open full term page

Networking premium DDoS Protection Azure DDoS Protection is a network-layer protection service that helps defend Azure public IP resources against distributed denial-of-service attacks using always-on traffic monitoring, adaptive mitigation, telemetry, and response capabilities. Network security intermediate 6 commands Aliases: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, distributed denial of service protection Quick peek Open full term page

Networking premium ExpressRoute ExpressRoute lets organizations extend on-premises networks into Microsoft cloud services over private connectivity provided through a connectivity provider. Teams use it to connect datacenters, branches, or colocation environments to Azure with predictable private paths for workloads that need stronger latency, bandwidth, and routing control than public internet connections. It is not a VPN tunnel, a private endpoint, an internet performance guarantee, or proof that every connected application is secure, redundant, or correctly routed. In production, confirm circuit state, provider state, peering configuration, BGP routes, gateway SKU, connected virtual networks, bandwidth, metrics, DNS path, firewall path, and provider escalation details before. Hybrid connectivity intermediate 6 commands Aliases: Azure ExpressRoute, ExpressRoute circuit, private Microsoft cloud connectivity Quick peek Open full term page

Containers premium External ingress External ingress in Azure Container Apps allows traffic from outside the Container Apps environment to reach a container app endpoint. Teams use it to publish a container app to callers outside the environment, including users, APIs, webhooks, partners, or front-end gateways that need a reachable HTTPS or TCP endpoint. It is not internal-only ingress, a custom domain certificate, a network security guarantee, or proof that authentication, authorization, rate limits, and backend health are configured correctly. Azure Container Apps intermediate 6 commands Aliases: external Container Apps ingress, public ingress, internet-facing ingress Quick peek Open full term page

Storage premium Service endpoint for Storage A service endpoint for Storage enables the Microsoft.Storage endpoint on a virtual network subnet and pairs it with storage account network rules. It lets workloads in that subnet reach Azure Storage over the Microsoft backbone while the account firewall allows only approved virtual network sources. Storage platform intermediate 6 commands Aliases: Azure Storage VNet rule, Microsoft.Storage service endpoint, Service endpoint for Storage, Storage service endpoint, service endpoint for storage, service-endpoint-for-storage Quick peek Open full term page

Analytics premium Databricks workspace Private Link Databricks workspace Private Link is the Azure Private Link configuration that provides private connectivity paths to Azure Databricks workspace resources and related Databricks services without exposing traffic to the public internet. Azure Databricks advanced 5 commands Aliases: Azure Databricks Private Link, Databricks private endpoint, workspace private endpoint, front-end Private Link Quick peek Open full term page

Analytics premium Databricks workspace VNet injection Databricks workspace VNet injection is the deployment model that places Azure Databricks compute resources into customer-managed virtual network subnets so network security, routing, and private connectivity controls can be applied. Databricks advanced 5 commands Aliases: VNet-injected Databricks workspace, customer-managed VNet workspace, Databricks VNet injection, workspace in customer VNet Quick peek Open full term page

Integration premium Event Hubs private endpoint An Event Hubs private endpoint is a Private Link network interface that lets clients reach an Event Hubs namespace through a private IP address in a virtual network. Teams use it to keep Event Hubs traffic on private network paths and restrict namespace access from public internet routes. It is not an outbound connection from Event Hubs into your subnet, a substitute for authentication, or a guarantee that every Azure service can still reach the namespace. Event Hubs intermediate 5 commands Aliases: Private Link for Event Hubs, Event Hubs Private Link, private endpoint connection Quick peek Open full term page

Integration premium Integration service environment Integration service environment controls how older Logic Apps workloads used a dedicated isolated runtime and VNet connectivity, and how teams identify remaining dependencies during migration. Teams see it in legacy logic apps ise resources, vnet integration. It is not Logic Apps Standard, App Service Environment, integration account, private endpoint, or a normal Consumption Logic App workflow; confusing them can create unsupported legacy integrations, missed retirement planning. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Logic Apps Advanced 5 commands Aliases: Logic Apps ISE, ISE, Integration Service Environment, dedicated Logic Apps environment Quick peek Open full term page

Networking premium Internet egress Internet egress controls how workloads reach public endpoints for updates, APIs, package feeds, SaaS services, telemetry, and other internet-reachable dependencies. Teams see it in virtual networks, nat gateways. It is not inbound internet traffic, private endpoint traffic, ExpressRoute private peering, internal ingress, or Azure service-to-service traffic over private routes; confusing them can create data exfiltration paths, blocked updates. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Outbound connectivity Intermediate 5 commands Aliases: outbound internet traffic, egress to internet, public egress, internet-bound traffic Quick peek Open full term page

Security premium Just-in-time VM access Just-in-time VM access is the Microsoft Defender for Cloud control that locks down VM management ports and opens approved inbound access only for a limited time. Defender for Cloud intermediate 5 commands Aliases: JIT VM access, Defender for Cloud JIT, just in time access, JIT network access policy Quick peek Open full term page

Containers premium Kubenet Kubenet is an AKS network plugin where nodes receive virtual network IP addresses and pods receive IP addresses from a separate pod CIDR, with routing handled through user-defined routes. AKS networking Intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Networking premium Service tag A service tag is a Microsoft-managed label that represents a changing set of IP address prefixes for an Azure service or network category. Administrators use service tags in NSG, firewall, and route rules so rules can reference the service name instead of manually maintained IP ranges. Network security fundamentals 5 commands Aliases: Service tag, service-tag, service tag, Service-tag Quick peek Open full term page

Storage premium Azure Files private endpoint Azure Files private endpoint connects Azure file share traffic to a storage account through a private IP address in a virtual network. It helps network, security, and storage teams keep SMB or NFS access on private network paths without exposing file access directly over public endpoints. You see it when regulated workloads need private access, branch users connect through VPN, or applications must mount shares without public storage exposure. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Private connectivity intermediate 4 commands Aliases: Private endpoint for Azure Files, Azure Files Private Link Quick peek Open full term page

Networking premium Azure Firewall Azure Firewall is a managed, stateful network firewall service for filtering traffic to and from Azure virtual network resources. It helps network security and platform teams centralize traffic control, logging, and threat protection across workloads without deploying self-managed firewall appliances for every landing zone. You see it when hub-spoke networks need egress control, applications require segmentation, regulated workloads need inspection, or teams need consistent firewall policy logging. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Network security intermediate 4 commands Aliases: Azure network firewall Quick peek Open full term page

Databases premium Cosmos DB firewall Azure Cosmos DB firewall controls inbound access to a Cosmos DB account by allowing selected IP addresses, IP ranges, Azure services, or virtual network paths. Azure Cosmos DB intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium DNS zone A DNS zone is an Azure DNS container for record sets that answer names under a domain. Public zones publish internet-resolvable records after registrar delegation, while private zones resolve only for linked virtual networks and support private endpoint and internal naming patterns. DNS fundamentals 4 commands Aliases: Azure DNS zone, DNS zone, public DNS zone, private DNS zone, hosted zone Quick peek Open full term page

Networking premium Firewall rule A firewall rule is a gatekeeping setting that decides which network sources can reach a protected Azure service. For Azure SQL, it often means allowing one public IP range to connect to a logical server or a specific database. For storage, MySQL, Cosmos DB, and other services, similar network rules limit where requests can come from. A firewall rule is not user authorization; it only answers whether the network path is allowed. Users or applications still need valid identity, credentials, and permissions after traffic gets through. Network security intermediate 4 commands Aliases: Azure firewall rule, IP firewall rule, server firewall rule, network access rule Quick peek Open full term page

Networking premium Load Balancer Azure Load Balancer distributes TCP and UDP traffic across backend virtual machines, virtual machine scale sets, or IP configurations. It uses frontend IPs, backend pools, health probes, and rules to provide low-latency Layer 4 traffic distribution for public or internal workloads. Load balancing fundamentals 4 commands Aliases: Azure Load Balancer, Standard Load Balancer, internal load balancer, public load balancer, layer 4 load balancer Quick peek Open full term page

Networking premium Load balancer health probe Microsoft Learn describes an Azure Load Balancer health probe as the check that determines whether backend pool instances are healthy enough to receive new traffic. Probe configuration includes protocol, port, interval, and threshold choices that influence traffic distribution. Operators should review it with the connected Azure resource settings. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium NFS 3.0 for Blob Storage NFS 3.0 for Blob Storage means an Azure Blob Storage protocol option that lets Linux clients mount blob containers through NFS version 3. You see it when teams connect analytics jobs, HPC workloads, migration tools, or Linux applications that expect mounted file paths. Think of it as a storage protocol choice with account, namespace, and network requirements. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Blob Storage advanced 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Outbound rule An outbound rule is a Standard Azure Load Balancer configuration that controls outbound SNAT for backend pool instances. It defines which frontend IP configurations are used, which backend pool receives outbound access, protocol behavior, allocated SNAT ports, idle timeout, and optional TCP reset handling. Application delivery and API edge intermediate 4 commands Aliases: Load Balancer outbound rule, outbound NAT rule, SNAT rule, Standard Load Balancer egress rule Quick peek Open full term page

Integration premium Service Bus private endpoint A Service Bus private endpoint is an Azure Private Link network interface that maps a virtual network to a Service Bus Premium namespace. It lets approved clients reach the namespace over private connectivity, reducing public exposure when DNS, network rules, and application routing are configured correctly. Service Bus advanced 4 commands Aliases: Azure Service Bus private endpoint, Service Bus Private Link, Private endpoint for Service Bus Quick peek Open full term page

Networking premium CIDR block A CIDR block expresses an IP address range with an address and prefix length, such as 10.0.0.0/16, for virtual network address space, subnets, and routes. IP addressing fundamentals 3 commands Aliases: CIDR Quick peek Open full term page

Analytics field-manual-complete Synapse private endpoint A Synapse private endpoint is an Azure Private Link network interface that lets clients reach a Synapse workspace over a private IP address instead of the public internet. It is used with workspace development, SQL, and private-link patterns to reduce exposure and control network access. Synapse Analytics advanced 8 commands Aliases: Azure Synapse private endpoint, Synapse workspace private endpoint, Private Link for Synapse, private endpoint for Synapse workspace Quick peek Open full term page

Networking template-specs-upgraded Route table Microsoft Learn explains that Azure creates default routes for each virtual network subnet, and custom routes can be placed in route tables associated with subnets. A route table contains routes with address prefixes and next hop types that influence outbound traffic selection. Routing fundamentals 7 commands Aliases: UDR table, Azure route table, custom route table, subnet route table, user-defined route table Quick peek Open full term page

Databases field-manual-complete PostgreSQL private access PostgreSQL private access means the flexible server is reached through private networking instead of an internet-facing endpoint. The server sits in a delegated subnet in a virtual network, and clients resolve its name through Private DNS. Apps in the same virtual network, peered networks, VPN, or ExpressRoute can connect if routing and security rules allow it. For a learner, the key idea is simple: choose private access when the database should behave like an internal service, not a public database with firewall openings. PostgreSQL flexible server intermediate 5 commands Aliases: PostgreSQL private networking, PostgreSQL VNet integration, Private access for PostgreSQL flexible server, PostgreSQL delegated subnet access Quick peek Open full term page

Databases field-manual-complete PostgreSQL public access PostgreSQL public access means the flexible server has a public DNS name that can be reached over the internet, but only IP ranges you allow get a chance to connect. It is not anonymous access; users still need valid PostgreSQL credentials and encrypted connections. This option is useful when clients cannot use a virtual network, VPN, or ExpressRoute path. The important lesson is that public access is a controlled doorway, not a private network. The doorway needs tight firewall rules, ownership, and regular review. PostgreSQL flexible server fundamentals 5 commands Aliases: PostgreSQL public endpoint, PostgreSQL allowed IP addresses, PostgreSQL firewall access, Public access for PostgreSQL flexible server Quick peek Open full term page

Containers verified Registry private endpoint A registry private endpoint lets workloads reach Azure Container Registry through private network addressing instead of the public registry endpoint. Your registry remains a managed Azure service, but clients such as AKS nodes, self-hosted build agents, virtual machines, or container platforms connect Azure Container Registry intermediate 5 commands Aliases: ACR private endpoint, Azure Container Registry Private Link, private registry endpoint, container registry private endpoint Quick peek Open full term page

Storage field-manual-complete Storage account trusted services Storage account trusted services are Azure service exceptions that can pass a storage firewall when selected network access is restricted. They help specific Microsoft services reach storage for approved scenarios, but they do not replace authentication, authorization, logging, private access review, or least-privilege design. Storage network security fundamentals 5 commands Aliases: trusted Microsoft services for storage, AzureServices bypass, storage trusted services exception Quick peek Open full term page

Storage field-manual-complete Storage firewall A storage firewall is the Azure Storage network security configuration that restricts data-plane access to selected virtual networks, IP ranges, resource instances, private paths, or trusted service exceptions. It controls network reachability to storage services, while identity and authorization still decide whether an allowed request can access data. Network security fundamentals 5 commands Aliases: storage account firewall, Azure Storage firewall, storage network rules, storage network security Quick peek Open full term page

Networking field-manual-complete Subnet A subnet is a smaller address range inside an Azure virtual network. It is where many network-connected resources actually land, such as virtual machines, private endpoints, container nodes, and delegated platform services. Subnets let teams separate workloads, apply network security groups, attach route tables, reserve IP space, and control private connectivity. A good subnet plan gives every workload enough addresses and the right network controls. A bad plan creates overlapping ranges, blocked traffic, exhausted IPs, or painful migrations later. Virtual networking fundamentals 5 commands Aliases: Azure subnet, VNet subnet, virtual network subnet, subnet address prefix Quick peek Open full term page

Databases field-manual-complete Transparent data encryption Transparent data encryption helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics by encrypting data, backups, and transaction logs at rest. Encryption and decryption happen in real time without requiring application changes, with service-managed or customer-managed key options. Azure SQL intermediate 5 commands Aliases: TDE, SQL transparent data encryption, Azure SQL TDE, database encryption at rest, TDE protector Quick peek Open full term page

Compute field-manual-complete Virtual machine An Azure compute resource that runs a full guest operating system for workloads needing server-level control. Azure Virtual Machines beginner 5 commands Aliases: Azure VM, VM, cloud virtual server, IaaS virtual machine, virtual machine Quick peek Open full term page

Compute verified VM serial console VM serial console is Azure's text-based recovery channel for a virtual machine or scale set instance. It connects to the VM serial port through Azure management access, so operators can troubleshoot boot, login, firewall, and network failures even when RDP or SSH is unavailable. Virtual Machines intermediate 5 commands Aliases: VM serial console, vm serial console Quick peek Open full term page

Networking top-250-pre130-priority-upgraded Inbound NAT rule Inbound NAT rule is an Azure Load Balancer rule that maps a frontend IP address and port to a backend virtual machine or scale-set instance port for inbound connectivity in Azure. Application delivery and API edge intermediate 5 commands Aliases: Inbound NAT rule, inbound nat rule, inbound-nat-rule Quick peek Open full term page

Databases complete SQL managed instance distributed transaction Microsoft Learn describes DTC for Azure SQL Managed Instance as support for distributed transactions in mixed environments, including managed instances, SQL Server, other relational databases, custom applications, and transaction participants that can establish network connectivity to Azure and coordinate transaction outcomes safely. SQL Managed Instance intermediate 5 commands Aliases: SQL MI distributed transaction, managed instance DTC, Azure SQL MI DTC, distributed transaction coordinator Quick peek Open full term page

Databases complete SQL Managed Instance public endpoint Microsoft Learn explains that Azure SQL Managed Instance can provide user connectivity through a public endpoint, but the configuration must be secured with network controls, port 3342 access rules, strong authentication, and careful operational review before production use. Always. Carefully. under explicit governance. SQL Managed Instance intermediate 5 commands Aliases: SQL MI public endpoint, Azure SQL MI public data endpoint, managed instance public data endpoint Quick peek Open full term page

Databases complete SQL managed instance subnet Microsoft Learn describes a SQL Managed Instance subnet as a dedicated subnet in an Azure virtual network that must meet SQL Managed Instance network requirements before deployment. Its address range, network configuration, routing, and available IP capacity determine where managed instances can be placed and expanded. SQL Managed Instance intermediate 5 commands Aliases: Azure SQL Managed Instance subnet, SQL MI subnet, managed instance dedicated subnet Quick peek Open full term page

Databases field-manual-complete Cosmos DB private endpoint A Cosmos DB private endpoint uses Azure Private Link to expose a Cosmos DB account through private IP addresses in a virtual network. Microsoft Learn explains that this lets teams restrict access to private paths and reduce public exposure for database clients and administrative connections. Azure Cosmos DB intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete NSG flow logs NSG flow logs are records of traffic decisions made by Azure network security groups. They show whether flows were allowed or denied, which rule was involved, and where the traffic was headed. In 2026 they are a legacy operational signal: existing logs still matter for investigations, but new NSG flow logs can no longer be created. A learner should understand them as historical evidence and a migration concern, not as the preferred design for new network logging. Diagnostics fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases strict-validated MySQL firewall rule MySQL firewall rule means a MySQL Flexible Server network rule that allows selected public IP ranges to reach the server endpoint. You see it when teams permit temporary admin access, vendor connections, migration tools, or controlled public network access to a database. Think of it as a reachability rule, not database authentication or authorization. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. MySQL Flexible Server networking intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page