Search Azure terms

Web premium App Service VNet integration Microsoft Learn describes App Service virtual network integration as the feature that lets an App Service app access resources in or through an Azure virtual network. It affects outbound traffic from the app; inbound private access uses other controls, such as private endpoints and access restrictions. App Service Networking intermediate 5 commands Aliases: App Service virtual network integration, regional VNet integration, Web App VNet integration Quick peek Open full term page

Networking premium Internet egress Internet egress controls how workloads reach public endpoints for updates, APIs, package feeds, SaaS services, telemetry, and other internet-reachable dependencies. Teams see it in virtual networks, nat gateways. It is not inbound internet traffic, private endpoint traffic, ExpressRoute private peering, internal ingress, or Azure service-to-service traffic over private routes; confusing them can create data exfiltration paths, blocked updates. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Outbound connectivity Intermediate 5 commands Aliases: outbound internet traffic, egress to internet, public egress, internet-bound traffic Quick peek Open full term page

Networking premium NAT Gateway NAT Gateway means a managed Azure networking service that provides outbound internet connectivity for private resources in associated subnets. You see it when teams let virtual machines, containers, or private application workloads reach updates, APIs, package feeds, or external services. Think of it as an outbound source address and SNAT boundary, not a firewall for all network traffic. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Outbound connectivity fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Load Balancer Azure Load Balancer distributes TCP and UDP traffic across backend virtual machines, virtual machine scale sets, or IP configurations. It uses frontend IPs, backend pools, health probes, and rules to provide low-latency Layer 4 traffic distribution for public or internal workloads. Load balancing fundamentals 4 commands Aliases: Azure Load Balancer, Standard Load Balancer, internal load balancer, public load balancer, layer 4 load balancer Quick peek Open full term page

Analytics field-manual-complete Synapse managed virtual network A Synapse managed virtual network is the Azure-managed network boundary associated with a Synapse workspace. It isolates workspace data integration and Spark resources, enables managed private endpoints, and can restrict outbound connectivity to approved targets when data exfiltration protection is enabled at workspace creation. Synapse Analytics intermediate 5 commands Aliases: Azure Synapse managed virtual network, Synapse managed VNet, managed workspace virtual network, Synapse workspace managed VNet Quick peek Open full term page

Networking premium Outbound rule An outbound rule is a Standard Azure Load Balancer configuration that controls outbound SNAT for backend pool instances. It defines which frontend IP configurations are used, which backend pool receives outbound access, protocol behavior, allocated SNAT ports, idle timeout, and optional TCP reset handling. Application delivery and API edge intermediate 4 commands Aliases: Load Balancer outbound rule, outbound NAT rule, SNAT rule, Standard Load Balancer egress rule Quick peek Open full term page

Networking premium Hybrid Connection A Hybrid Connection lets an Azure App Service app reach a specific TCP host and port in another network through Azure Relay. Azure App Service and Azure Relay fundamentals 5 commands Aliases: Hybrid Connection, hybrid connection Quick peek Open full term page

Containers learning-path-anchor System node pool A system node pool is the AKS worker pool that keeps the cluster itself functioning. It hosts core Kubernetes and AKS add-on pods such as DNS, networking agents, metrics, and connectivity components. You can technically run application pods there, but experienced teams avoid that because noisy workloads can starve the services that make the... Azure Kubernetes Service intermediate 4 commands Aliases: AKS system pool, system mode node pool, AKS platform node pool, kube-system node pool Quick peek Open full term page

Databases premium Azure SQL logical server An Azure SQL logical server is a logical administrative construct for Azure SQL Database and related SQL resources. Microsoft Learn describes it as the central point for managing a collection of databases, including logins, firewall rules, auditing, threat detection policies, and failover groups. Azure SQL Database fundamentals 16 commands Aliases: No aliases yet Quick peek Open full term page

Networking template-specs-upgraded Route table Microsoft Learn explains that Azure creates default routes for each virtual network subnet, and custom routes can be placed in route tables associated with subnets. A route table contains routes with address prefixes and next hop types that influence outbound traffic selection. Routing fundamentals 7 commands Aliases: UDR table, Azure route table, custom route table, subnet route table, user-defined route table Quick peek Open full term page

Networking complete SNAT / ephemeral ports Microsoft Learn explains that outbound connections use ephemeral ports so destinations can maintain distinct traffic flows. When those ports are used for source network address translation, they are SNAT ports, and exhaustion can cause intermittent outbound connection failures in services such as App Service. Networking intermediate 6 commands Aliases: SNAT ports, ephemeral ports, source NAT ports, outbound connection ports Quick peek Open full term page

Networking top-250-pre130-priority-upgraded Inbound NAT rule Inbound NAT rule is an Azure Load Balancer rule that maps a frontend IP address and port to a backend virtual machine or scale-set instance port for inbound connectivity in Azure. Application delivery and API edge intermediate 5 commands Aliases: Inbound NAT rule, inbound nat rule, inbound-nat-rule Quick peek Open full term page

Analytics premium Synapse SQL Synapse SQL is the T-SQL analytics capability in Azure Synapse Analytics. It includes dedicated SQL pools for provisioned warehousing and serverless SQL pools for on-demand lake queries, letting teams analyze structured and semi-structured data through familiar SQL endpoints inside a Synapse workspace. Synapse Analytics intermediate 7 commands Aliases: Synapse SQL engine, Azure Synapse SQL, Synapse serverless and dedicated SQL, SQL analytics in Synapse Quick peek Open full term page

Web premium App Service private endpoint An App Service private endpoint uses Azure Private Link to give an app a private IP address in a virtual network for inbound client access. App Service Networking intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium ExpressRoute ExpressRoute lets organizations extend on-premises networks into Microsoft cloud services over private connectivity provided through a connectivity provider. Teams use it to connect datacenters, branches, or colocation environments to Azure with predictable private paths for workloads that need stronger latency, bandwidth, and routing control than public internet connections. It is not a VPN tunnel, a private endpoint, an internet performance guarantee, or proof that every connected application is secure, redundant, or correctly routed. In production, confirm circuit state, provider state, peering configuration, BGP routes, gateway SKU, connected virtual networks, bandwidth, metrics, DNS path, firewall path, and provider escalation details before. Hybrid connectivity intermediate 6 commands Aliases: Azure ExpressRoute, ExpressRoute circuit, private Microsoft cloud connectivity Quick peek Open full term page

Databases premium PostgreSQL flexible server The managed Azure PostgreSQL server resource that owns compute, storage, backups, networking, high availability, parameters, and databases. PostgreSQL flexible server fundamentals 6 commands Aliases: PostgreSQL flexible server, postgresql flexible server, Azure Database for PostgreSQL flexible server, managed PostgreSQL, backup retention, high availability, private access Quick peek Open full term page

Storage premium Service endpoint for Storage A service endpoint for Storage enables the Microsoft.Storage endpoint on a virtual network subnet and pairs it with storage account network rules. It lets workloads in that subnet reach Azure Storage over the Microsoft backbone while the account firewall allows only approved virtual network sources. Storage platform intermediate 6 commands Aliases: Azure Storage VNet rule, Microsoft.Storage service endpoint, Service endpoint for Storage, Storage service endpoint, service endpoint for storage, service-endpoint-for-storage Quick peek Open full term page

Containers premium AKS private cluster Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation. AKS networking advanced 5 commands Aliases: Azure Kubernetes Service private cluster, aks private cluster Quick peek Open full term page

Web premium App Service connection string A named connection string stored in App Service configuration and exposed to application code for supported database or service connectivity. It helps learners understand where the concept appears in Azure operations and what to verify before changing it. App Service intermediate 5 commands Aliases: app service connection string, connection string Quick peek Open full term page

Web premium App Service Hybrid Connections App Service Hybrid Connections let an App Service app make outbound TCP connections to a specific host and port in another network through Azure Relay. App Service networking intermediate 5 commands Aliases: Azure App Service Hybrid Connections, app service hybrid connections Quick peek Open full term page

AI and Machine Learning premium Azure Machine Learning Azure Machine Learning is a cloud service for managing the machine learning lifecycle, including workspaces, data, training jobs, model deployment, monitoring, and MLOps. Machine learning operations advanced 5 commands Aliases: Azure ML, AML, Machine Learning workspace Quick peek Open full term page

Analytics premium Azure-SSIS integration runtime Azure-SSIS integration runtime is Azure Data Factory or Azure Synapse compute that lets organizations deploy, run, and manage SQL Server Integration Services packages in Azure. Data Factory intermediate 5 commands Aliases: Azure SSIS integration runtime, Azure-SSIS IR Quick peek Open full term page

Containers premium Connected registry an Azure Container Registry capability that keeps container images available in remote, edge, or intermittently connected environments by syncing with a parent registry Azure Container Registry intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Analytics premium Databricks workspace Private Link Databricks workspace Private Link is the Azure Private Link configuration that provides private connectivity paths to Azure Databricks workspace resources and related Databricks services without exposing traffic to the public internet. Azure Databricks advanced 5 commands Aliases: Azure Databricks Private Link, Databricks private endpoint, workspace private endpoint, front-end Private Link Quick peek Open full term page

Analytics premium Databricks workspace VNet injection Databricks workspace VNet injection is the deployment model that places Azure Databricks compute resources into customer-managed virtual network subnets so network security, routing, and private connectivity controls can be applied. Databricks advanced 5 commands Aliases: VNet-injected Databricks workspace, customer-managed VNet workspace, Databricks VNet injection, workspace in customer VNet Quick peek Open full term page

Integration premium Event Hubs private endpoint An Event Hubs private endpoint is a Private Link network interface that lets clients reach an Event Hubs namespace through a private IP address in a virtual network. Teams use it to keep Event Hubs traffic on private network paths and restrict namespace access from public internet routes. It is not an outbound connection from Event Hubs into your subnet, a substitute for authentication, or a guarantee that every Azure service can still reach the namespace. Event Hubs intermediate 5 commands Aliases: Private Link for Event Hubs, Event Hubs Private Link, private endpoint connection Quick peek Open full term page

Integration premium Integration service environment Integration service environment controls how older Logic Apps workloads used a dedicated isolated runtime and VNet connectivity, and how teams identify remaining dependencies during migration. Teams see it in legacy logic apps ise resources, vnet integration. It is not Logic Apps Standard, App Service Environment, integration account, private endpoint, or a normal Consumption Logic App workflow; confusing them can create unsupported legacy integrations, missed retirement planning. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Logic Apps Advanced 5 commands Aliases: Logic Apps ISE, ISE, Integration Service Environment, dedicated Logic Apps environment Quick peek Open full term page

Networking premium Network Security Group Network Security Group means an Azure rule set that filters inbound and outbound network traffic for subnets or network interfaces. You see it when teams restrict application ports, isolate workloads, permit administration, block unwanted traffic, or document network segmentation. Think of it as a prioritized traffic filter near the workload, not complete application security. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Network security fundamentals 5 commands Aliases: NSG Quick peek Open full term page

Management and Governance premium Platform landing zone A platform landing zone is the shared Azure foundation that hosts common services for workload landing zones. It commonly includes connectivity, identity integration, management groups, policy, security monitoring, private DNS, logging, and automation so application teams can build on consistent enterprise guardrails. Governance operations fundamentals 5 commands Aliases: Azure platform landing zone, shared platform landing zone, enterprise-scale platform landing zone Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Networking premium Service tag A service tag is a Microsoft-managed label that represents a changing set of IP address prefixes for an Azure service or network category. Administrators use service tags in NSG, firewall, and route rules so rules can reference the service name instead of manually maintained IP ranges. Network security fundamentals 5 commands Aliases: Service tag, service-tag, service tag, Service-tag Quick peek Open full term page

AI and Machine Learning premium Azure AI services account An Azure resource that provides endpoints, keys, identity, networking, billing, and monitoring for one or more Azure AI service capabilities. Azure AI services fundamentals 4 commands Aliases: AI services account, Azure AI multi-service resource, Foundry resource, Microsoft.CognitiveServices account Quick peek Open full term page

Hybrid and Multicloud premium Azure Arc A hybrid and multicloud management platform that extends Azure governance, security, operations, and services to resources running outside Azure. Hybrid management fundamentals 4 commands Aliases: Arc, Arc-enabled infrastructure, Azure Arc hybrid management Quick peek Open full term page

Networking premium Azure Bastion A fully managed Azure service that provides secure RDP and SSH access to virtual machines without exposing VM public IP addresses. Remote access fundamentals 4 commands Aliases: Azure Bastion host, Bastion, RDP SSH over Bastion, managed jump box Quick peek Open full term page

Storage premium Azure Files private endpoint Azure Files private endpoint connects Azure file share traffic to a storage account through a private IP address in a virtual network. It helps network, security, and storage teams keep SMB or NFS access on private network paths without exposing file access directly over public endpoints. You see it when regulated workloads need private access, branch users connect through VPN, or applications must mount shares without public storage exposure. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Private connectivity intermediate 4 commands Aliases: Private endpoint for Azure Files, Azure Files Private Link Quick peek Open full term page

Web premium Bandwidth in/out Bandwidth in/out refers to measured inbound and outbound network traffic or throughput for Azure resources, often reviewed through metrics, diagnostics, and billing data. App Service metric intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Security premium Data exfiltration control A set of Azure controls that restrict, inspect, or approve where sensitive data can leave a workload, workspace, network, or tenant boundary. Network and data protection Intermediate 4 commands Aliases: egress control, data exfiltration protection, approved outbound data boundary Quick peek Open full term page

Networking premium Firewall rule A firewall rule is a gatekeeping setting that decides which network sources can reach a protected Azure service. For Azure SQL, it often means allowing one public IP range to connect to a logical server or a specific database. For storage, MySQL, Cosmos DB, and other services, similar network rules limit where requests can come from. A firewall rule is not user authorization; it only answers whether the network path is allowed. Users or applications still need valid identity, credentials, and permissions after traffic gets through. Network security intermediate 4 commands Aliases: Azure firewall rule, IP firewall rule, server firewall rule, network access rule Quick peek Open full term page

Databases premium Geo-replication Geo-replication is a database disaster recovery pattern where data from a primary database is replicated to one or more secondary databases in other regions. Teams use it to keep a recoverable copy of important data, support read-locality scenarios, and prepare for manual or application-driven failover during a regional outage. In daily Azure work, it shows up when engineers configure Azure SQL active geo-replication, review failover plans, test secondary connectivity, compare it with failover groups, or investigate replication lag. High availability intermediate 4 commands Aliases: active geo-replication, database geo-replication, regional database replication Quick peek Open full term page

Networking premium Load balancer rule Microsoft Learn describes a load-balancing rule as the configuration that maps a frontend IP address and port to backend pool addresses and ports. The rule defines how incoming traffic is distributed and which health probe validates backend availability. Operators should review it with the connected Azure resource settings. Application delivery and API edge intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases premium MySQL private access MySQL private access means a MySQL Flexible Server networking model that keeps database connectivity inside a virtual network instead of exposing a public endpoint. You see it when teams host sensitive workloads, enforce network isolation, connect applications through private subnets, or meet compliance expectations. Think of it as private network reachability for the database, not permission to read the data. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases premium MySQL public access MySQL public access means a MySQL Flexible Server networking model that allows connectivity through a public endpoint controlled by firewall rules. You see it when teams support vendor connections, migration tools, development access, or temporary operations when private connectivity is not available. Think of it as public reachability with strict rules, not open database access. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Network Watcher Network Watcher means an Azure diagnostics service that helps inspect, monitor, and troubleshoot network behavior across supported Azure resources. You see it when teams test connectivity, capture packets, review flow logs, inspect topology, or prove whether a problem is network-related. Think of it as a network evidence toolkit, not a replacement for application logs or security analytics. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Diagnostics fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium NFS file share Migrate Linux applications that expect NFS paths without standing up and patching a self-managed file server.; Provide AKS pods, batch jobs, or HPC workers with a shared managed file system reachable through private netw Azure Files intermediate 4 commands Aliases: Azure Files NFS share, NFS Azure file share, NFSv4.1 file share, NFS file share, nfs file share Quick peek Open full term page

Integration premium Service Bus private endpoint A Service Bus private endpoint is an Azure Private Link network interface that maps a virtual network to a Service Bus Premium namespace. It lets approved clients reach the namespace over private connectivity, reducing public exposure when DNS, network rules, and application routing are configured correctly. Service Bus advanced 4 commands Aliases: Azure Service Bus private endpoint, Service Bus Private Link, Private endpoint for Service Bus Quick peek Open full term page

Networking premium CIDR block A CIDR block expresses an IP address range with an address and prefix length, such as 10.0.0.0/16, for virtual network address space, subnets, and routes. IP addressing fundamentals 3 commands Aliases: CIDR Quick peek Open full term page

Analytics field-manual-complete Synapse private endpoint A Synapse private endpoint is an Azure Private Link network interface that lets clients reach a Synapse workspace over a private IP address instead of the public internet. It is used with workspace development, SQL, and private-link patterns to reduce exposure and control network access. Synapse Analytics advanced 8 commands Aliases: Azure Synapse private endpoint, Synapse workspace private endpoint, Private Link for Synapse, private endpoint for Synapse workspace Quick peek Open full term page

Databases verified VNet injection for SQL MI VNet injection for SQL MI means deploying Azure SQL Managed Instance inside a dedicated Azure virtual network subnet that is delegated to Microsoft.Sql/managedInstances, with required network rules so the managed instance has private connectivity and service management access. Azure SQL Managed Instance intermediate 6 commands Aliases: SQL MI VNet injection, SQL Managed Instance subnet integration, SQL MI delegated subnet, managed instance VNet placement Quick peek Open full term page

Networking verified VPN Gateway VPN Gateway is an Azure virtual network gateway that creates encrypted VPN tunnels between an Azure virtual network and on-premises networks, remote clients, or other VNets, using configurations such as site-to-site, point-to-site, and VNet-to-VNet connections. for hybrid networks. Hybrid connectivity fundamentals 6 commands Aliases: Azure VPN Gateway, virtual network gateway for VPN, site-to-site VPN gateway, point-to-site VPN gateway Quick peek Open full term page

Databases field-manual-complete Azure SQL private endpoint A database capability or setting in Azure SQL Database that helps teams store, query, scale, secure, and recover application data with clearer ownership, safety, and operational context. Azure SQL Database intermediate 5 commands Aliases: Azure SQL private endpoint, azure-sql-private-endpoint, azure-sql-database, azure-sql-logical-server, private-endpoint, private-dns-zone, vnet-peering, managed-identity, app-service-vnet-integration, azure-sql-firewall-rule, service-endpoint Quick peek Open full term page