Search Azure terms

Security verified Zero Trust Zero Trust is a security strategy that assumes breach, verifies every access request explicitly, and uses least privilege to reduce blast radius. In Azure, it is implemented through identity, device, network, data, application, monitoring, governance, and threat-detection controls across environments. Security architecture fundamentals 5 commands Aliases: Zero Trust architecture, Never trust always verify, Assume breach, Verify explicitly Quick peek Open full term page

Security field-manual-complete Least privilege Least privilege means granting identities only the permissions required to perform their tasks, and no broader access than necessary. Microsoft Learn guidance applies this principle across Azure RBAC, data-plane permissions, privileged access, managed identities, and operational reviews to reduce attack surface and limit blast radius. Security architecture fundamentals 2 commands Aliases: No aliases yet Quick peek Open full term page

Networking premium Network Security Group Network Security Group means an Azure rule set that filters inbound and outbound network traffic for subnets or network interfaces. You see it when teams restrict application ports, isolate workloads, permit administration, block unwanted traffic, or document network segmentation. Think of it as a prioritized traffic filter near the workload, not complete application security. It matters because the setting changes how teams design, secure, operate, and troubleshoot the workload. Before changing it in production, know the owner, dependency, evidence, expected result, and rollback path. Network security fundamentals 5 commands Aliases: NSG Quick peek Open full term page

Networking premium Application security group An application security group lets you group virtual machine network interfaces so network security group rules can target application roles instead of explicit IP addresses. Network security fundamentals 2 commands Aliases: ASG, application security group Quick peek Open full term page

Analytics field-manual-complete Lakehouse architecture Lakehouse architecture combines data lake scale with warehouse-style querying, governance, and analytics patterns. On Azure, it commonly uses Delta Lake, OneLake or ADLS storage, Spark, SQL experiences, BI tools, and layered data design such as bronze, silver, and gold at enterprise scale. Azure Databricks intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Identity field-manual-complete Security group A security group is a named set of identities that receive access together. Identity operations fundamentals 4 commands Aliases: Microsoft Entra security group, Entra security group, access group Quick peek Open full term page

Security field-manual-complete Security recommendation A security recommendation is a prioritized instruction from Microsoft Defender for Cloud that says, in effect, this resource has a security problem worth reviewing. Cloud security posture fundamentals 4 commands Aliases: Defender for Cloud recommendation, cloud security recommendation, security assessment Quick peek Open full term page

Analytics premium field-manual Medallion architecture Medallion architecture is a lakehouse data design that organizes data into bronze, silver, and gold layers as quality improves. Teams use it when data teams need a shared pattern for raw ingestion, cleaned data, curated analytics, and trusted consumption. In plain English, it gives operators a named control for clear data quality stages, ownership boundaries, and reusable analytics products instead of leaving the decision hidden in a portal setting, script, or deployment file. Treat it as production-ready only when the owner, dependencies, permission boundary, monitoring signal, and rollback evidence are clear. Lakehouse architecture intermediate 4 commands Aliases: Medallion architecture, bronze silver gold architecture, medallion lakehouse, bronze silver gold layers, lakehouse medallion pattern, bronze-silver-gold, bronze-silver-gold pattern, Azure Databricks, Microsoft Fabric, and lakehouse platforms, Lakehouse architecture Quick peek Open full term page

Networking premium Front Door profile Front Door profile is the top-level Azure Front Door Standard or Premium resource that groups edge endpoints, routes, origins, domains, rule sets, security associations, and delivery settings. Teams use it to manage a global application entry point without treating each endpoint, route, or origin as a separate product. In daily Azure work, it shows up when engineers review edge architecture, add a new website, tune routing, attach custom domains, configure WAF, or troubleshoot global traffic. It is not the same thing as a single endpoint, DNS name, backend app, CDN cache rule, or web application firewall policy. Application delivery and API edge intermediate 5 commands Aliases: Azure Front Door profile, AFD profile, Front Door Standard/Premium profile Quick peek Open full term page

Analytics learning-path-anchor Synapse SQL on-demand Synapse SQL on-demand is the serverless SQL pool model in Azure Synapse Analytics. It lets teams run T-SQL queries over data in the lake without provisioning dedicated warehouse capacity, storing only metadata objects while using external data sources, views, functions, and security objects. Synapse Analytics fundamentals 6 commands Aliases: SQL on-demand, Synapse serverless SQL, serverless SQL in Synapse, built-in serverless SQL pool Quick peek Open full term page

Analytics learning-path-anchor Synapse Studio Synapse Studio is the browser-based workspace experience for Azure Synapse Analytics. It exposes hubs for data, development, integration, monitoring, and management, letting users author notebooks and SQL scripts, build pipelines, configure connections, review access, and work with Git-backed or live artifacts. Synapse Analytics fundamentals 6 commands Aliases: Azure Synapse Studio, Synapse web workspace, Synapse workspace UI, Synapse authoring experience Quick peek Open full term page

Analytics learning-path-anchor Synapse workspace firewall A Synapse workspace firewall is the IP allowlist around a Synapse workspace when it accepts public network traffic. It decides which client IPv4 ranges can attempt to connect before identity permissions are evaluated. It does not grant access by itself; a user or service still needs the right Azure, Synapse, or SQL permissions. It... Synapse Analytics intermediate 6 commands Aliases: Synapse IP firewall rule, workspace firewall rule, Synapse workspace IP allowlist, Synapse public endpoint firewall Quick peek Open full term page

Compute premium Availability zone Availability zone is a physically separate zone inside an Azure region with independent datacenter infrastructure such as power, cooling, and networking. In Azure, teams encounter it when architects choose whether a workload should pin resources to one zone or spread service instances across multiple zones. The useful question is what behavior it proves, who owns Availability fundamentals 4 commands Aliases: Azure availability zone, zone, zone-redundant deployment, zonal deployment Quick peek Open full term page

Monitoring and Observability premium Diagnostic setting A diagnostic setting is an Azure Monitor configuration that routes platform logs and metrics from a resource to supported destinations such as Log Analytics, Event Hubs, or Storage. Diagnostics fundamentals 4 commands Aliases: Azure Monitor diagnostic setting, resource diagnostic setting, platform log routing, diagnostic settings Quick peek Open full term page

Monitoring and Observability premium Diagnostic settings for storage Diagnostic settings for storage route Azure Storage platform logs and metrics, including service-specific operations where supported, to destinations such as Log Analytics, Event Hubs, or Storage for investigation and compliance. Data operations intermediate 4 commands Aliases: storage diagnostic settings, Azure Storage diagnostic settings, Storage account diagnostic settings, storage platform log routing Quick peek Open full term page

Identity premium Directory role A directory role grants permissions to manage Microsoft Entra tenant resources such as users, groups, applications, devices, roles, and security settings. Privileged access intermediate 4 commands Aliases: Microsoft Entra role, administrator role, Entra directory role, tenant administrator role Quick peek Open full term page

Storage premium Disable Shared Key authorization Disable Shared Key authorization is a storage account setting that prevents requests from being authorized with account keys and pushes supported access toward Microsoft Entra authorization. Storage security intermediate 4 commands Aliases: disallow Shared Key, AllowSharedKeyAccess false, prevent Shared Key access, disable storage account key access Quick peek Open full term page

Databases learning-path-anchor Cosmos DB continuous backup Azure Cosmos DB continuous backup is the backup mode that supports point-in-time restore for supported Cosmos DB resources within a configured retention tier. Azure Cosmos DB fundamentals 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases learning-path-anchor Table A table is the basic place where structured data lives in a database. Each row is one record, and each column describes one attribute, such as customer ID, order date, amount, or status. In Azure, tables show up in Azure SQL Database, SQL Managed Instance, Synapse dedicated SQL pools, Fabric warehouses, PostgreSQL, MySQL, and... Database intermediate 4 commands Aliases: database table, SQL table, relational table, data table Quick peek Open full term page

Databases learning-path-anchor Cosmos DB dedicated gateway Azure Cosmos DB dedicated gateway is provisioned server-side compute that fronts an account and enables the integrated cache for supported NoSQL workloads. Azure Cosmos DB fundamentals 3 commands Aliases: No aliases yet Quick peek Open full term page

Databases learning-path-anchor Cosmos DB emulator The Azure Cosmos DB emulator provides a local environment that emulates Azure Cosmos DB for development and testing without requiring a cloud account. Azure Cosmos DB fundamentals 3 commands Aliases: No aliases yet Quick peek Open full term page

Analytics command-rich Synapse workspace A Synapse workspace is the main container where a team builds and operates Azure Synapse Analytics. It gives the team one named place for SQL pools, Spark pools, pipelines, notebooks, linked services, access rules, monitoring, and the connection to the default data lake. The workspace is not just a folder in the portal; it... Analytics platform fundamentals 9 commands Aliases: Azure Synapse workspace, Synapse Analytics workspace, workspace in Azure Synapse, Synapse analytics boundary Quick peek Open full term page

Management and Governance verified Operational excellence recommendation An operational excellence recommendation is an Azure Advisor finding that points to better process efficiency, resource manageability, or deployment practice. It appears on the Advisor Operational Excellence tab and helps teams improve day-to-day operations, governance, and production readiness before small platform issues become recurring incidents. Azure Advisor fundamentals 7 commands Aliases: Azure Advisor operational excellence recommendation, Advisor operational excellence, operational excellence advice, Azure operational hygiene recommendation Quick peek Open full term page

Management and Governance verified Resource dependency A resource dependency tells Azure Resource Manager which resource must exist before another resource can be deployed, updated, or configured during an ARM or Bicep deployment. ARM deployments fundamentals 5 commands Aliases: ARM dependency, Bicep dependency, dependsOn, implicit dependency, deployment dependency Quick peek Open full term page

Networking field-manual-complete Virtual network An Azure private network boundary for subnets, routing, filtering, peering, and private connectivity. Azure Virtual Network beginner 5 commands Aliases: Azure VNet, VNet, virtual network in Azure, private Azure network, virtual network Quick peek Open full term page

AI and Machine Learning template-specs-upgraded Retrieval augmented generation Microsoft Learn describes retrieval augmented generation as an AI pattern where a user query retrieves relevant grounding content, often from Azure AI Search or Foundry indexes, before a model generates an answer. The goal is more accurate, cited, and current responses from private or changing data. Grounded generation fundamentals 5 commands Aliases: RAG, retrieval augmented generation, grounded generation, Azure AI Search RAG, agentic RAG Quick peek Open full term page

Databases command-rich Cosmos DB for Apache Cassandra Azure Cosmos DB for Apache Cassandra is a managed NoSQL database service that supports Cassandra workloads using CQL, drivers, and compatible tooling. Data platform intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases command-rich Cosmos DB for Apache Gremlin Azure Cosmos DB for Apache Gremlin is a managed graph database service for storing, querying, and traversing graph data with the Gremlin language. Data platform intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases command-rich Cosmos DB for PostgreSQL Azure Cosmos DB for PostgreSQL is a managed PostgreSQL service with Citus distributed tables, currently on a retirement path and not recommended for new projects. Data platform intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

Databases command-rich Cosmos DB for Table Azure Cosmos DB for Table is a managed NoSQL key-value and table API compatible with Azure Table storage SDKs and tools. Data platform intermediate 4 commands Aliases: No aliases yet Quick peek Open full term page

AI and Machine Learning premium Azure OpenAI resource An Azure OpenAI resource is the Azure control-plane boundary that hosts deployments, endpoints, access, networking, and billing context. Azure OpenAI fundamentals 12 commands Aliases: No aliases yet Quick peek Open full term page

Security complete Defender for Cloud Microsoft Defender for Cloud is a cloud-native application protection platform that provides security posture management, recommendations, regulatory insights, and workload protection across Azure, multicloud, and DevOps environments. Cloud security posture beginner 4 commands Aliases: Microsoft Defender for Cloud, Azure Defender for Cloud, MDC Quick peek Open full term page

AI and Machine Learning premium Azure OpenAI Service Azure OpenAI Service provides managed access to OpenAI model capabilities through Azure endpoints and enterprise controls. Generative AI fundamentals 11 commands Aliases: Azure OpenAI Quick peek Open full term page

Management and Governance premium Azure Policy Azure Policy is a governance service for creating, assigning, and managing rules that evaluate Azure resources. Azure Policy fundamentals 7 commands Aliases: Policy Quick peek Open full term page

Management and Governance premium Azure subscription An Azure subscription is a management, billing, and scale unit for Azure resources. Azure scope fundamentals 7 commands Aliases: subscription Quick peek Open full term page

Analytics premium Synapse SQL Synapse SQL is the T-SQL analytics capability in Azure Synapse Analytics. It includes dedicated SQL pools for provisioned warehousing and serverless SQL pools for on-demand lake queries, letting teams analyze structured and semi-structured data through familiar SQL endpoints inside a Synapse workspace. Synapse Analytics intermediate 7 commands Aliases: Synapse SQL engine, Azure Synapse SQL, Synapse serverless and dedicated SQL, SQL analytics in Synapse Quick peek Open full term page

Analytics premium Synapse workspace package A Synapse workspace package is a library file stored at the workspace level so Spark workloads can use custom code or pinned dependencies. Instead of downloading a library manually in every notebook, the team uploads a wheel, JAR, or R package archive and attaches it to Spark pools that need it. This is helpful... Synapse Analytics fundamentals 7 commands Aliases: Synapse workspace library, Synapse Spark workspace package, workspace package file, Synapse custom Spark package Quick peek Open full term page

Containers premium Azure Kubernetes Service Azure Kubernetes Service is Azure’s managed Kubernetes service for deploying, scaling, and operating containerized applications while Azure manages much of the cluster control plane. Managed Kubernetes advanced 6 commands Aliases: AKS, managed Kubernetes Quick peek Open full term page

Databases premium Azure Managed Redis Azure Managed Redis is a Microsoft-managed in-memory data store based on Redis Enterprise, used for low-latency caching, session storage, messaging, and semantic cache scenarios. Managed cache intermediate 6 commands Aliases: Managed Redis, Redis Enterprise on Azure, Azure Redis Enterprise Quick peek Open full term page

Analytics premium Azure Synapse Analytics Azure Synapse Analytics is Microsoft’s integrated analytics service for enterprise data warehousing, big data, data integration, and exploratory analytics. Synapse Analytics intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Integration premium Capacity unit A capacity measure used by Event Hubs Dedicated clusters. Messaging and eventing intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Databases premium Cosmos DB logical partition Cosmos DB logical partition means the group of items in a container that share the same partition key value. It is the practical label operators use when they decide how application data should be modeled, queried, protected, and monitored in Azure Cosmos DB. In plain English, it explains where developers, platform engineers, and support teams meet: the application wants fast data access, while the platform controls scale, cost, security, and recovery. A good glossary entry helps the team know which setting to inspect, which owner to involve, and which symptoms prove the design works. Azure Cosmos DB intermediate 6 commands Aliases: Azure Cosmos DB logical partition, cosmos db logical partition Quick peek Open full term page

Analytics premium Data Factory Azure’s managed data integration service for creating pipelines that move, transform, schedule, and orchestrate data across cloud, SaaS, and hybrid stores. Data integration and orchestration Intermediate 6 commands Aliases: Data Factory, Data Factory, data factory Quick peek Open full term page

Storage premium Data Lake analytics workload A production analytics workload that stores, transforms, governs, and serves large data sets from a data lake using Azure services such as ADLS Gen2, Data Factory, Databricks, Synapse, or Fabric. Data Lake Storage Intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Storage premium Data Lake bronze layer The raw ingestion layer in a lakehouse or medallion architecture where source data first lands with minimal transformation and strong traceability. Data Lake Storage Gen2 Intermediate 6 commands Aliases: No aliases yet Quick peek Open full term page

Analytics premium Databricks cluster policy A Databricks governance object that limits which cluster settings users can choose, helping control cost, security, runtime consistency, and workload standards. Azure Databricks intermediate 6 commands Aliases: Databricks compute policy, cluster policy, compute policy Quick peek Open full term page

Networking premium DDoS Protection Azure DDoS Protection is a network-layer protection service that helps defend Azure public IP resources against distributed denial-of-service attacks using always-on traffic monitoring, adaptive mitigation, telemetry, and response capabilities. Network security intermediate 6 commands Aliases: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, distributed denial of service protection Quick peek Open full term page

Analytics premium Expression language Expression language is the Azure Data Factory and Azure Synapse syntax used to build dynamic values, parameters, conditions, and function calls inside pipeline definitions. Teams use it to make pipeline paths, dates, conditions, parameters, linked-service values, and activity settings change at runtime instead of being hard-coded. It is not general programming code, a SQL dialect, a security boundary, or a guarantee that dynamic values are valid for every dataset and trigger context. In production, confirm expression syntax, parameter names, variable scope, activity output references, trigger metadata, evaluated values, published JSON, debug runs, run IDs, and downstream paths or queries before. Data Factory intermediate 6 commands Aliases: ADF expression language, Data Factory expression language, pipeline expression language, dynamic content Quick peek Open full term page

Networking premium ExpressRoute ExpressRoute lets organizations extend on-premises networks into Microsoft cloud services over private connectivity provided through a connectivity provider. Teams use it to connect datacenters, branches, or colocation environments to Azure with predictable private paths for workloads that need stronger latency, bandwidth, and routing control than public internet connections. It is not a VPN tunnel, a private endpoint, an internet performance guarantee, or proof that every connected application is secure, redundant, or correctly routed. In production, confirm circuit state, provider state, peering configuration, BGP routes, gateway SKU, connected virtual networks, bandwidth, metrics, DNS path, firewall path, and provider escalation details before. Hybrid connectivity intermediate 6 commands Aliases: Azure ExpressRoute, ExpressRoute circuit, private Microsoft cloud connectivity Quick peek Open full term page

Containers premium External ingress External ingress in Azure Container Apps allows traffic from outside the Container Apps environment to reach a container app endpoint. Teams use it to publish a container app to callers outside the environment, including users, APIs, webhooks, partners, or front-end gateways that need a reachable HTTPS or TCP endpoint. It is not internal-only ingress, a custom domain certificate, a network security guarantee, or proof that authentication, authorization, rate limits, and backend health are configured correctly. Azure Container Apps intermediate 6 commands Aliases: external Container Apps ingress, public ingress, internet-facing ingress Quick peek Open full term page