Search Azure terms

Databases premium MySQL private access MySQL private access means a MySQL Flexible Server networking model that keeps database connectivity inside a virtual network instead of exposing a public endpoint. You see it when teams host sensitive workloads, enforce network isolation, connect applications through private subnets, or meet compliance expectations. Think of it as private network reachability for the database, not permission to read the data. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases field-manual-complete PostgreSQL private access PostgreSQL private access means the flexible server is reached through private networking instead of an internet-facing endpoint. The server sits in a delegated subnet in a virtual network, and clients resolve its name through Private DNS. Apps in the same virtual network, peered networks, VPN, or ExpressRoute can connect if routing and security rules allow it. For a learner, the key idea is simple: choose private access when the database should behave like an internal service, not a public database with firewall openings. PostgreSQL flexible server intermediate 5 commands Aliases: PostgreSQL private networking, PostgreSQL VNet integration, Private access for PostgreSQL flexible server, PostgreSQL delegated subnet access Quick peek Open full term page

Storage premium Azure Files private endpoint Azure Files private endpoint connects Azure file share traffic to a storage account through a private IP address in a virtual network. It helps network, security, and storage teams keep SMB or NFS access on private network paths without exposing file access directly over public endpoints. You see it when regulated workloads need private access, branch users connect through VPN, or applications must mount shares without public storage exposure. It still needs ownership, network design, monitoring, and recovery planning. Operators need repeatable evidence for deployment, protection, troubleshooting, and reviews, not screenshots or tribal knowledge. Private connectivity intermediate 4 commands Aliases: Private endpoint for Azure Files, Azure Files Private Link Quick peek Open full term page

Databases premium MySQL public access MySQL public access means a MySQL Flexible Server networking model that allows connectivity through a public endpoint controlled by firewall rules. You see it when teams support vendor connections, migration tools, development access, or temporary operations when private connectivity is not available. Think of it as public reachability with strict rules, not open database access. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases field-manual-complete PostgreSQL public access PostgreSQL public access means the flexible server has a public DNS name that can be reached over the internet, but only IP ranges you allow get a chance to connect. It is not anonymous access; users still need valid PostgreSQL credentials and encrypted connections. This option is useful when clients cannot use a virtual network, VPN, or ExpressRoute path. The important lesson is that public access is a controlled doorway, not a private network. The doorway needs tight firewall rules, ownership, and regular review. PostgreSQL flexible server fundamentals 5 commands Aliases: PostgreSQL public endpoint, PostgreSQL allowed IP addresses, PostgreSQL firewall access, Public access for PostgreSQL flexible server Quick peek Open full term page

AI and Machine Learning field-manual-complete Private endpoint for Azure OpenAI A private endpoint for Azure OpenAI is the private network doorway to an Azure OpenAI resource. Your application still calls the Azure OpenAI endpoint and authenticates normally, but from approved networks the name can resolve to a private IP instead of a public address. It is commonly used for enterprise chat, RAG, summarization, and agent workloads that handle sensitive prompts or documents. It protects the network path, not the prompt content by itself, so identity, logging, safety, and data controls still matter. Azure OpenAI advanced 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete Private Link Private Link is Azure’s way to reach supported services through private network connections instead of sending traffic to their public endpoints. Private access fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Security field-manual-complete Private Link for data services Private Link for data services means your applications connect to databases, storage, and analytics services through private endpoints instead of public endpoints. Data operations intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Databases premium Flexible server A flexible server is the Azure Database deployment model for managed PostgreSQL or MySQL servers with configurable compute, storage, availability, maintenance, backup, and networking options. Teams use it to host managed relational databases with more control over maintenance windows, compute tiers, backup retention, high availability, private networking, stop-start behavior, and performance settings. It is not a self-managed VM database, a single-server compatibility promise, a free unlimited database tier, or proof that schema design, indexes, failover, and application connection pooling are correct. Azure managed databases intermediate 6 commands Aliases: Azure Database flexible server, PostgreSQL flexible server, MySQL flexible server, managed flexible database server Quick peek Open full term page

Databases premium PostgreSQL flexible server The managed Azure PostgreSQL server resource that owns compute, storage, backups, networking, high availability, parameters, and databases. PostgreSQL flexible server fundamentals 6 commands Aliases: PostgreSQL flexible server, postgresql flexible server, Azure Database for PostgreSQL flexible server, managed PostgreSQL, backup retention, high availability, private access Quick peek Open full term page

Containers premium AKS ingress controller Microsoft Learn explains AKS ingress through Kubernetes ingress resources and controllers that route HTTP or HTTPS traffic to services in a cluster. AKS application routing options can configure ingress controllers, DNS integration, TLS handling, and related networking components for production applications. AKS networking intermediate 5 commands Aliases: AKS ingress, Ingress controller for AKS, Kubernetes ingress controller Quick peek Open full term page

Web premium App Service Environment Microsoft Learn describes App Service Environment as a single-tenant App Service deployment that runs in a customer virtual network. It hosts App Service plans and apps with stronger network isolation, dedicated compute boundaries, and high-scale hosting compared with the public multitenant App Service model. App Service isolation intermediate 5 commands Aliases: ASE, Azure App Service Environment, app service environment Quick peek Open full term page

Web premium App Service VNet integration Microsoft Learn describes App Service virtual network integration as the feature that lets an App Service app access resources in or through an Azure virtual network. It affects outbound traffic from the app; inbound private access uses other controls, such as private endpoints and access restrictions. App Service Networking intermediate 5 commands Aliases: App Service virtual network integration, regional VNet integration, Web App VNet integration Quick peek Open full term page

Analytics premium Databricks workspace VNet injection Databricks workspace VNet injection is the deployment model that places Azure Databricks compute resources into customer-managed virtual network subnets so network security, routing, and private connectivity controls can be applied. Databricks advanced 5 commands Aliases: VNet-injected Databricks workspace, customer-managed VNet workspace, Databricks VNet injection, workspace in customer VNet Quick peek Open full term page

Databases premium PostgreSQL PostgreSQL is an open-source relational database engine. In Azure, Azure Database for PostgreSQL provides a managed Flexible Server service with compute, storage, backup, security, networking, monitoring, and high-availability capabilities for application and analytical workloads. across development, production, and migration scenarios. Database advanced 5 commands Aliases: Azure Database for PostgreSQL, Azure PostgreSQL, PostgreSQL flexible server, managed PostgreSQL Quick peek Open full term page

Databases premium PostgreSQL connection pooling PostgreSQL connection pooling reuses database connections instead of opening a new server process for every request. Azure Database for PostgreSQL supports pooling strategies including built-in PgBouncer on supported flexible server tiers to reduce idle and short-lived connection overhead. across applications. PostgreSQL flexible server fundamentals 5 commands Aliases: Azure PostgreSQL PgBouncer, PgBouncer, PostgreSQL pooling, database connection pooling Quick peek Open full term page

Databases premium PostgreSQL firewall rule A public-network access rule that permits a specific IPv4 range to reach an Azure Database for PostgreSQL flexible server. PostgreSQL flexible server intermediate 5 commands Aliases: PostgreSQL firewall rule, postgresql firewall rule, Azure PostgreSQL firewall, public access, IPv4 allowlist, source IP, start IP address Quick peek Open full term page

Networking premium Service endpoint A service endpoint is a subnet-level Azure Virtual Network capability that provides direct connectivity to supported Azure services over the Microsoft backbone. It extends the subnet identity to the service so the service can allow traffic from selected virtual networks without requiring a public IP address on the client workload. Private access fundamentals 5 commands Aliases: Service endpoint, VNet service endpoint, service endpoint, service-endpoint, subnet service endpoint, virtual network service endpoint Quick peek Open full term page

Analytics premium Data Factory managed virtual network A Microsoft-managed network boundary used by Azure Integration Runtime to isolate data integration traffic and connect through managed private endpoints. Data integration and orchestration Intermediate 4 commands Aliases: Data Factory managed virtual network, ADF managed virtual network, data factory managed virtual network Quick peek Open full term page

Databases premium MySQL server MySQL server means the Azure Database for MySQL Flexible Server resource that hosts databases and controls compute, storage, networking, backups, and maintenance. You see it when teams operate MySQL applications, manage database access, scale resources, configure networking, or recover data. Think of it as the managed server boundary around one or more MySQL databases. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Azure Database for MySQL intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases field-manual-complete MySQL flexible server MySQL flexible server is Azure Database for MySQL Flexible Server, a managed MySQL service with configurable compute, storage, backups, networking, high availability, maintenance, and server parameters. Microsoft Learn positions it as a production-ready database platform that reduces infrastructure work while preserving operational control. MySQL flexible server fundamentals 8 commands Aliases: No aliases yet Quick peek Open full term page

AI and Machine Learning field-manual-complete Translator service The Translator service is the Azure AI service resource and API surface that provides Translator capabilities to applications. It supplies endpoints, keys or token-based authentication, regional configuration, usage limits, and management settings for text translation, document translation, custom translation, monitoring, and secure integration. Azure AI services fundamentals 6 commands Aliases: Azure AI Translator service, Text Translation service, Translator resource, translation service resource, Cognitive Services Translator Quick peek Open full term page

Databases field-manual-complete PostgreSQL point-in-time restore PostgreSQL point-in-time restore means bringing a flexible server back to what it looked like at a specific earlier time, but Azure does this by creating a new server. It is used after accidental deletes, bad deployments, data corruption, or to clone production for validation. The restore must be inside the server’s backup retention period. It is not a single-table undo button and it does not overwrite production. After the new server exists, teams compare data, redirect applications, export recovered rows, or keep it for testing. PostgreSQL flexible server fundamentals 5 commands Aliases: PostgreSQL PITR, PostgreSQL restore point, flexible server point-in-time restore Quick peek Open full term page

Databases field-manual-complete PostgreSQL read replica A PostgreSQL read replica is a second flexible server that follows a primary PostgreSQL server and accepts read-only traffic. Writes still go to the primary. The replica is useful when reporting, analytics, search indexing, or distant users are putting too much read pressure on the main database. Because replication is asynchronous, the replica can lag behind current writes. That lag matters. Learners should remember that a read replica is for read scale, regional reach, and recovery options, not for splitting ordinary writes across two active databases. PostgreSQL flexible server fundamentals 5 commands Aliases: PostgreSQL replica, PostgreSQL read-only replica, Azure PostgreSQL read replica, Read replica for PostgreSQL flexible server Quick peek Open full term page

Databases field-manual-complete PostgreSQL same-zone HA PostgreSQL same-zone HA means Azure keeps a standby flexible server replica in the same availability zone as the primary server. If the primary server has a node or server-level failure while the zone remains healthy, Azure can fail over to the standby. It is high availability, but not full zone redundancy. The standby is not a read replica for reporting. Think of it as a local safety partner for the primary database when cross-zone placement is unavailable, too costly, or not the right latency tradeoff. PostgreSQL flexible server fundamentals 5 commands Aliases: PostgreSQL zonal HA, Same-zone high availability, Zonal high availability for PostgreSQL, PostgreSQL HA standby in same zone Quick peek Open full term page

Databases field-manual-complete PostgreSQL server firewall A PostgreSQL server firewall is the public-network gate in front of an Azure Database for PostgreSQL flexible server. If public access is enabled, clients can attempt to connect only when their source IP address falls inside an allowed firewall rule. The rule does not grant database access, create a user, or bypass passwords. It simply lets the traffic reach the server endpoint. If the server uses private access instead, the... Data platform intermediate 5 commands Aliases: No aliases yet Quick peek Open full term page

Storage field-manual-complete Storage account trusted services Storage account trusted services are Azure service exceptions that can pass a storage firewall when selected network access is restricted. They help specific Microsoft services reach storage for approved scenarios, but they do not replace authentication, authorization, logging, private access review, or least-privilege design. Storage network security fundamentals 5 commands Aliases: trusted Microsoft services for storage, AzureServices bypass, storage trusted services exception Quick peek Open full term page

AI and Machine Learning field-manual-ready ML online endpoint An ML online endpoint is a stable HTTPS scoring endpoint that routes real-time inference requests to one or more deployments. Azure Machine Learning intermediate 4 commands Aliases: Azure ML online endpoint, managed online endpoint, real-time inference endpoint Quick peek Open full term page

Databases strict-validated MySQL firewall rule MySQL firewall rule means a MySQL Flexible Server network rule that allows selected public IP ranges to reach the server endpoint. You see it when teams permit temporary admin access, vendor connections, migration tools, or controlled public network access to a database. Think of it as a reachability rule, not database authentication or authorization. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. MySQL Flexible Server networking intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Web premium App Service private endpoint An App Service private endpoint uses Azure Private Link to give an app a private IP address in a virtual network for inbound client access. App Service Networking intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Management and Governance premium Bicep private registry A Bicep private registry is an Azure Container Registry used to publish and share organization-owned Bicep modules. Bicep fundamentals 6 commands Aliases: No aliases yet Quick peek Open full term page

Analytics premium Databricks access connector A first-party Azure resource that gives Azure Databricks a managed identity for Unity Catalog storage credentials and other governed service access. Azure Databricks intermediate 6 commands Aliases: Access Connector for Azure Databricks, Azure Databricks access connector, Databricks managed identity connector Quick peek Open full term page

Containers premium AKS private cluster Microsoft Learn describes a private AKS cluster as an Azure Kubernetes Service cluster whose API server uses internal IP addresses and Private Link-based connectivity. The design keeps control-plane traffic between the API server and node pools on private networking, with DNS configuration required for administrators and automation. AKS networking advanced 5 commands Aliases: Azure Kubernetes Service private cluster, aks private cluster Quick peek Open full term page

Integration premium Event Hubs private endpoint An Event Hubs private endpoint is a Private Link network interface that lets clients reach an Event Hubs namespace through a private IP address in a virtual network. Teams use it to keep Event Hubs traffic on private network paths and restrict namespace access from public internet routes. It is not an outbound connection from Event Hubs into your subnet, a substitute for authentication, or a guarantee that every Azure service can still reach the namespace. Event Hubs intermediate 5 commands Aliases: Private Link for Event Hubs, Event Hubs Private Link, private endpoint connection Quick peek Open full term page

Security premium Just-in-time VM access Just-in-time VM access is the Microsoft Defender for Cloud control that locks down VM management ports and opens approved inbound access only for a limited time. Defender for Cloud intermediate 5 commands Aliases: JIT VM access, Defender for Cloud JIT, just in time access, JIT network access policy Quick peek Open full term page

Security premium Key Vault access policy Key Vault access policy controls which identities can read, write, list, delete, recover, sign, unwrap, or manage Key Vault objects when the vault uses policy-based access. Teams see it in key vault access policies blade, secret permissions. It is not Azure RBAC for Key Vault, a network firewall rule, a secret value, a certificate policy, or an application setting; confusing them can create overprivileged identities, broken secret retrieval. Use the term when reviewing access, monitoring, cost, recovery, or performance. It keeps architects, operators, security reviewers, and support teams focused on the same setting, resource, or behavior. Secrets and keys Intermediate 5 commands Aliases: access policy, vault access policy, Key Vault policy permissions, data-plane access policy Quick peek Open full term page

Storage premium Trusted Microsoft services access Trusted Microsoft services access is an Azure Storage firewall exception that allows selected Azure services to reach a restricted storage account when their service traffic cannot be represented by virtual network or IP rules. The services still authenticate and must be allowed for supported operations. Azure Storage intermediate 5 commands Aliases: trusted Azure services access, AzureServices bypass, allow trusted Microsoft services, storage trusted services access Quick peek Open full term page

Analytics premium Data Factory private endpoint A Private Link connection that exposes Data Factory or related data movement targets through a private IP address instead of a public network path. Data integration and orchestration Intermediate 4 commands Aliases: Data Factory private endpoint, ADF private endpoint, data factory private endpoint Quick peek Open full term page

Integration premium Service Bus private endpoint A Service Bus private endpoint is an Azure Private Link network interface that maps a virtual network to a Service Bus Premium namespace. It lets approved clients reach the namespace over private connectivity, reducing public exposure when DNS, network rules, and application routing are configured correctly. Service Bus advanced 4 commands Aliases: Azure Service Bus private endpoint, Service Bus Private Link, Private endpoint for Service Bus Quick peek Open full term page

Storage premium Blob public access Blob public access is optional anonymous read access for blobs or containers when the storage account and container configuration allow it. Blob Storage fundamentals 3 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Blob public access level Blob public access level is the container setting that controls whether anonymous clients can read no data, blobs only, or both container listings and blobs. Blob Storage fundamentals 3 commands Aliases: Blob public access level, public access level, blob public access level Quick peek Open full term page

Storage premium Container access level the Blob Storage container setting that decides whether anonymous clients can read no data, individual blobs, or container listings and blobs Storage platform intermediate 3 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Container public access level the Blob Storage container setting that decides whether anonymous reads are private, blob-only, or container-level Blob Storage access intermediate 3 commands Aliases: No aliases yet Quick peek Open full term page

Analytics field-manual-complete Synapse private endpoint A Synapse private endpoint is an Azure Private Link network interface that lets clients reach a Synapse workspace over a private IP address instead of the public internet. It is used with workspace development, SQL, and private-link patterns to reduce exposure and control network access. Synapse Analytics advanced 8 commands Aliases: Azure Synapse private endpoint, Synapse workspace private endpoint, Private Link for Synapse, private endpoint for Synapse workspace Quick peek Open full term page

Analytics field-manual-complete Kusto private endpoint A Kusto private endpoint connects clients on an Azure virtual network to an Azure Data Explorer cluster through Azure Private Link, using private IP addressing so query and ingestion traffic can avoid public internet exposure and follow private DNS and approval controls. Azure Data Explorer advanced 6 commands Aliases: No aliases yet Quick peek Open full term page

Web field-manual-complete App Service access restriction App Service access restriction is the rule list that decides which inbound clients are allowed to reach a web app before the request reaches your code. App Service networking intermediate 5 commands Aliases: access restriction, app service access restriction Quick peek Open full term page

AI and Machine Learning field-manual-complete Azure OpenAI private endpoint An Azure OpenAI private endpoint gives your model-calling applications a private network path to an Azure OpenAI resource. Instead of reaching the resource over its public endpoint, approved clients in a virtual network resolve the service name to a private IP address. This is useful for sensitive prompts, internal copilots, and retrieval systems that must stay inside controlled network boundaries. It still requires identity, DNS, and application configuration to be correct. Test callers before lockdown. Azure OpenAI intermediate 5 commands Aliases: OpenAI private endpoint, Azure OpenAI Private Link, private model endpoint, private endpoint for Azure OpenAI Quick peek Open full term page

Databases field-manual-complete Azure SQL private endpoint A database capability or setting in Azure SQL Database that helps teams store, query, scale, secure, and recover application data with clearer ownership, safety, and operational context. Azure SQL Database intermediate 5 commands Aliases: Azure SQL private endpoint, azure-sql-private-endpoint, azure-sql-database, azure-sql-logical-server, private-endpoint, private-dns-zone, vnet-peering, managed-identity, app-service-vnet-integration, azure-sql-firewall-rule, service-endpoint Quick peek Open full term page

Networking field-manual-complete Private DNS zone A private DNS zone is the private address book Azure uses when a virtual network needs internal name resolution. Instead of sending a service name to public DNS and getting a public address, linked virtual networks can resolve records inside the private zone. Private endpoints depend on this heavily because the application usually keeps calling the normal service hostname, while DNS quietly returns the private endpoint IP. When this is wrong, everything looks like a network outage even though the endpoint exists. DNS fundamentals 5 commands Aliases: No aliases yet Quick peek Open full term page

Networking field-manual-complete Private Endpoint A private endpoint gives an Azure service a private IP address inside your virtual network. Instead of your app reaching a storage account, database, vault, or AI service through a public endpoint, traffic goes to a private network interface tied to that service. The service still exists as a managed Azure resource; the endpoint is the private doorway to it. DNS, firewall rules, approval state, and public network access settings decide whether the design is actually private and usable. Networking advanced 5 commands Aliases: private link endpoint Quick peek Open full term page