Microsoft Azure Administrator — knowledge map
The 260 core concepts of Microsoft Azure Administrator and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (260)
Virtual network (VNet)
A private network in Azure; divided by subnets and connected to other VNets via peering.
Performance metrics (IOPS/throughput/bandwidth/latency)
Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.
Region (Azure)
A geographic grouping of one or more datacenters; chosen by latency, data sovereignty, feature availability, and cost.
Blob storage
Storage for unstructured data (objects) such as images, video, and backups.
ExpressRoute
A dedicated private connection that does not use the internet; high reliability, consistent low latency, high bandwidth.
Microsoft Entra ID
Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.
Prerequisites: Conditional Access
Subnet
A smaller network range carved out of a virtual network address space; groups resources by purpose or public/private and serves as a unit for routing and access control.
Azure SQL authentication/access control and data protection
Authentication: Microsoft Entra (recommended—centralized, MFA/Conditional Access, passwordless via managed identity) and SQL auth. Distinguish logins (server) from users (DB); contained users are preferred in SQL Database. Authorize via fixed/custom roles and GRANT/DENY/REVOKE (DENY wins) for least privilege. Narrow rows with row-level security (RLS) and columns with column-level permissions. Data protection: dynamic data masking (limits display; UNMASK reveals real values) and auditing (log operations to Log Analytics/Storage). Encryption is TDE/Always Encrypted (separate entries).
Prerequisites: Conditional Access、Always Encrypted、Custom roles (Azure / Entra roles)、Contained database user
Subscription (Azure)
The billing/usage boundary and a logical container for resources; often split by department or environment.
Azure App Service
PaaS to host web apps and APIs quickly, with no OS management and easy scaling.
Routing (system routes, service chaining, forced tunneling)
Azure path control. System routes are auto-provided by Azure for intra-VNet, peering, gateways, and default internet. UDRs (user-defined routes) override them, defining destination prefix → next hop (virtual appliance/gateway/internet/none). Service chaining sets the UDR next hop to an NVA (firewall) to force traffic through it (IP forwarding required on the NVA; for redundancy front it with an internal Load Balancer). Forced tunneling forces outbound internet via on-prem with a UDR. Gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway. Route selection: longest-prefix match, then UDR > BGP > system.
Prerequisites: ExpressRoute、Virtual network (VNet)、Network Watcher tools (IP flow verify, Connection Monitor, next hop)、Azure Load Balancer
Azure Virtual WAN
A large-scale networking service centralizing many sites, VNets, and remote users via a managed hub on the Microsoft backbone. It aggregates VPN, ExpressRoute, and VNet connections; the hub transits, so spokes reach each other without the non-transitivity problem. SKUs: Basic (S2S VPN only) and Standard (full: ExpressRoute/P2S/hub-to-hub/Secured Hub). A Secured Virtual Hub embeds Azure Firewall and uses Firewall Manager to centrally apply policy across hubs. Use hand-built hub-and-spoke for small scale, Virtual WAN for large/global.
Prerequisites: ExpressRoute、Virtual network (VNet)、Azure Firewall、Site-to-site VPN (S2S)
Related: Virtual hub (Virtual WAN)
Availability zone
A physically separated datacenter within a region (independent power/cooling/network); zone redundancy gives high availability.
Prerequisites: Region (Azure)
Related: Zone redundancy (Azure SQL)
Network Watcher tools (IP flow verify, Connection Monitor, next hop)
Network Watcher diagnostic tools for visibility and isolation. IP flow verify instantly decides whether a specific source/destination/port is allowed/denied by NSGs (with the matched rule name). Connection Monitor continuously monitors reachability, latency, and packet loss between endpoints. Next hop shows a packet’s actual next hop to isolate UDR mistakes. NSG/VNet flow logs record allowed/denied traffic to Storage, visualized via Traffic Analytics. Also packet capture, connection troubleshoot, and topology. Pick the tool for “is the NSG blocking, or a routing issue?”
Prerequisites: Virtual network (VNet)、Connection Monitor、Packet capture (Network Watcher)、Virtual network flow logs
Monitoring and optimization (Query Store, DMVs, automatic tuning)
Measure first to find bottlenecks. Query Store keeps query history, plans, and wait stats for regression detection and plan forcing. DMVs expose live internal state (wait stats, blocking) via SQL. In the execution plan, watch scan vs seek, key lookups, and non-SARGable predicates; improve with indexes (create missing, drop unused, rebuild fragmented) and updated statistics. Azure SQL automatic tuning (auto-apply recommended indexes, FORCE LAST GOOD PLAN) and intelligent query processing help.
Prerequisites: Index、Automatic tuning (plan forcing)、Session blocking、Dynamic management views (DMVs)
Azure Key Vault
Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.
Private endpoint
A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.
Prerequisites: Virtual network (VNet)
Conditional Access
Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).
Azure API Management (APIM)
An API gateway exposing multiple backend APIs through one front door. Policies (XML; inbound/backend/outbound/on-error) apply auth (validate-jwt), rate limiting, transformation, caching, and CORS. Offer to consumers via products and subscriptions (keys), document in the developer portal, authenticate to backends with a managed identity, and store secrets in named values (Key Vault).
Prerequisites: Azure Front Door、Managed identity、Rate limiting
Related: Named values (APIM)、API Management policies、Developer portal (APIM)、Products and subscriptions (APIM)
Messaging/eventing (Service Bus, Event Grid, Event Hubs)
Loose-coupling options. Service Bus = enterprise messaging (queues/topics; ordering/transactions/dedup/dead-letter). Storage Queue = simple, cheap high-volume queue. Event Grid = reactive pub/sub of discrete events (e.g., "blob created"). Event Hubs = high-volume streaming/telemetry ingestion (high throughput, partitions). Message = command; event = notification.
Prerequisites: Blob storage、Azure Event Grid、Azure Event Hubs、Loose coupling (decoupling)
Azure Private Link / Private Link Service
A platform that brings connectivity to PaaS or your own service onto a private IP inside the VNet. Private Link connects to PaaS (Storage/SQL) via a private endpoint (a NIC with a private IP) without the public path. The PaaS public FQDN CNAMEs to a privatelink zone, and the private DNS zone’s A record resolves it to the private IP (forgetting to link → resolves to public IP, a common mistake). Each sub-resource (blob/file, etc.) needs its own endpoint and zone. On-prem resolution uses a DNS Private Resolver plus conditional forwarders. Private Link Service offers your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link. Unlike service endpoints, it assigns a real private IP and is reachable from on-prem.
Prerequisites: Blob storage、Virtual network (VNet)、Azure DNS Private Resolver、Private DNS zone
Related: Private Link and DNS integration
Azure SQL Database
A fully managed relational PaaS; Azure handles patching, backups, availability. Best for new cloud apps.
Prerequisites: Managed services (management boundary)
Index
A structure that speeds searching on columns; faster reads but added write-time cost.
Data protection and HA/DR (backup/restore, HA/DR, PITR, LTR, geo, failover groups)
Azure SQL takes automated backups (full/differential/log). PITR restores to any point within retention (default 7 days, max 35). LTR retains weekly/monthly/yearly up to 10 years. Geo-restore restores to another region from GRS geo-redundant backups (asynchronous, larger RPO). HA is zone redundancy (in-region, across AZs); DR is active geo-replication (readable secondary in another region) and failover groups (auto-fail-over a group of DBs via listeners without changing the connection string). VM uses Always On availability groups. Design by RPO/RTO; synchronous gives RPO≈0, asynchronous covers distance.
Prerequisites: Region (Azure)、Active geo-replication、Always On availability groups、Failover groups
Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)
Settings that determine Azure SQL performance/availability/cost. Tiers: General Purpose (balanced, remote storage), Business Critical (local SSD, built-in replicas, low latency, read scale-out), Hyperscale (up to ~100TB, page servers separate storage, fast backup/restore). Purchasing: vCore (flexible, Azure Hybrid Benefit, reserved discounts—recommended) vs DTU (simple metric). Compute is provisioned or serverless (auto pause/resume for intermittent loads). Share capacity across many DBs with an elastic pool. Read scale-out is on BC/Hyperscale.
Prerequisites: Business Critical tier、Elastic pool、General Purpose tier、Hyperscale tier and page servers
Related: Purchasing models (vCore / DTU)
Zone redundancy (Azure SQL)
An HA configuration spreading replicas across availability zones within a region to tolerate datacenter failure. Available on many service tiers.
Prerequisites: Region (Azure)
Related: Availability zone
Azure Front Door
A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.
Managed identity
An identity letting apps access Azure resources securely without managing secrets; a service principal auto-managed by Azure.
Application Gateway
A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.
Prerequisites: Region (Azure)
Redundancy (LRS/ZRS/GRS/GZRS)
Resilience set by number/scope of copies: LRS<ZRS<GRS<GZRS; GRS/GZRS replicate to another region.
Prerequisites: Region (Azure)、Fault tolerance
Storage access (access keys/SAS)
Ways to access Azure Storage: access keys (full account access, rotate them), SAS (shared access signature; delegated access scoped by target/operation/expiry—user delegation SAS is safest), and Entra ID + RBAC (key-free, recommended). Restrict to a VNet with private endpoints/firewall.
Prerequisites: Microsoft Entra ID、Role-based access control (RBAC)、Virtual network (VNet)、Private endpoint
Azure Load Balancer
A fast regional L4 (TCP/UDP) load balancer; configure public/internal, health probes, and backend pools.
Prerequisites: Region (Azure)
Azure storage account
A container bundling Blob, File, Table, and Queue storage services.
Prerequisites: Blob storage、Queue storage
Contained database user
A user whose authentication (password or Microsoft Entra ID) is bound to the database itself rather than depending on a server-level login. The standard pattern in Azure SQL Database, it avoids having to recreate server logins when a secondary is promoted in a failover group.
Prerequisites: Microsoft Entra ID、Azure SQL Database、Failover groups、SQL login
Related: Database user
Task automation (SQL Server Agent, Elastic Jobs)
Routine-ops automation depends on the deployment. SQL Server Agent is the job scheduler on VM/Managed Instance (jobs, steps, schedules, operator notifications). Azure SQL Database lacks SQL Agent, so use Elastic Jobs (job agent + job DB; run T-SQL in parallel across DBs via target groups). Azure Automation runbooks (PowerShell/Python, Hybrid Workers) automate cross-cloud/on-prem ops. Schedule statistics updates, index rebuilds, DBCC CHECKDB, and backup verification, and notify on failure.
Prerequisites: Azure SQL Database、Index、Azure Automation (runbooks)、Elastic Jobs
Permissions (GRANT/DENY/REVOKE, least privilege)
Grant permissions per securable via fixed/custom database roles and GRANT/DENY/REVOKE. DENY takes precedence; apply least privilege to all securables.
ExpressRoute gateway
A virtual network gateway connecting an ExpressRoute circuit to a VNet; the SKU sets bandwidth and performance.
Prerequisites: ExpressRoute、Virtual network (VNet)、Performance metrics (IOPS/throughput/bandwidth/latency)
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Private DNS zone
A DNS zone valid only inside VNets; link it to a VNet to resolve internal or privatelink names to private IPs—key to operating private endpoints.
Prerequisites: Virtual network (VNet)、Private endpoint
User-defined route (UDR)
A manual route overriding system routes: define destination prefix → next hop (virtual appliance/gateway/internet/none) and associate the route table with a subnet.
Prerequisites: Network Watcher tools (IP flow verify, Connection Monitor, next hop)、Subnet、System routes
Related: Azure NAT Gateway、Private endpoint
ACR (Azure Container Registry)
A private registry to store/manage container images; ACR Tasks builds in the cloud, and authentication uses a managed identity.
Prerequisites: Container image、Managed identity
Related: Azure Container Apps
Microsoft Defender for Cloud
Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.
Management group
The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.
Prerequisites: Subscription (Azure)
Azure Monitor
The monitoring foundation collecting metrics and logs; feeds Log Analytics (KQL), Application Insights (app monitoring), and alerts.
VPN Gateway
Connects on-premises over an encrypted tunnel across the internet.
Storage account kinds and performance
General-purpose v2 (GPv2) is the standard handling Blob/File/Queue/Table. Performance is Standard (HDD) or Premium (SSD, low latency); Premium splits into BlockBlob/FileShare/Page kinds.
Prerequisites: Blob storage、Azure storage account、Performance metrics (IOPS/throughput/bandwidth/latency)
Always Encrypted
Encrypts sensitive Azure SQL columns (e.g., credit card numbers) on the client so the server never sees plaintext. Keys (the column master key) live on the client or in Key Vault. Since the server can’t see plaintext, queries are generally limited (e.g., equality); range operations require Secure Enclaves. Unlike TDE (at rest only), it protects data in use—even from DBAs.
Prerequisites: Encryption at rest、Azure Key Vault
Related: Customer-managed keys (CMK) / Platform-managed keys (PMK)
Customer-managed keys (CMK) / Platform-managed keys (PMK)
Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.
Prerequisites: Encryption at rest、Azure Key Vault
Related: Always Encrypted
Transparent Data Encryption (TDE)
Encrypts an Azure SQL database at rest (files and backups) and is on by default. It needs no app changes (transparent) and decrypts on the server during processing, so DBAs and the server can handle plaintext. The protector can switch from the default service-managed key to a CMK (BYOK). TDE protects data at rest; TLS protects in transit.
Prerequisites: BYOK and infrastructure encryption、Customer-managed keys (CMK) / Platform-managed keys (PMK)、Azure SQL Database、Encryption at rest
Web Application Firewall (Azure WAF)
Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.
Prerequisites: Application Gateway、Region (Azure)、Azure Front Door、Rate limiting
Load balancing (Load Balancer / Application Gateway / Traffic Manager)
Azure services distributing traffic to backends. Azure Load Balancer = L4 (TCP/UDP), regional, fast (internal/public, health probes, backend pools). Application Gateway = L7 (HTTP), regional, URL path-based routing, SSL termination, WAF. Front Door = L7, global (edge delivery, WAF/CDN, reverse proxy). Traffic Manager = DNS-based global routing (real traffic goes straight to the backend). Decide by L4 vs L7 and regional vs global.
Prerequisites: Application Gateway、Region (Azure)、Azure Load Balancer、Azure Front Door
Azure Backup
A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.
Prerequisites: Managed services (management boundary)
Related: Azure Site Recovery (ASR)
Diagnostic settings
Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.
Prerequisites: Subscription (Azure)、Azure storage account、Log Analytics workspace
Azure Site Recovery (ASR)
A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.
Prerequisites: Region (Azure)
Related: Azure Backup
Azure Cosmos DB
A globally distributed, low-latency, auto-scaling managed NoSQL DB supporting multiple APIs (NoSQL/MongoDB/Cassandra/Gremlin/Table).
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Microsoft Entra authentication for Azure SQL
The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.
Prerequisites: Conditional Access、Microsoft Entra ID、Managed identity
Related: SQL authentication
ExpressRoute FastPath
An option that, on supported SKUs, bypasses the virtual network gateway in the ExpressRoute data path for lower latency and higher throughput (normally the path traverses the gateway). Certain configurations (e.g., via UDRs or load balancers) are excluded from FastPath support.
Prerequisites: ExpressRoute、Virtual network (VNet)、ExpressRoute gateway、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: ExpressRoute Direct
Azure NAT Gateway
Outbound-only NAT for a subnet; provides stable egress and avoids SNAT port exhaustion (does not provide inbound).
Prerequisites: Outbound rules and SNAT (Load Balancer)、Subnet
Related: Private endpoint、User-defined route (UDR)
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Prerequisites: Virtual network (VNet)、Subnet
Point-to-site VPN (P2S)
Connects individual client devices to an Azure VNet; choose a tunnel type and authentication (certificate, RADIUS, Microsoft Entra ID) and distribute a VPN client configuration.
Prerequisites: Microsoft Entra ID、Virtual network (VNet)、VPN Gateway
Site-to-site VPN (S2S)
Connects an on-prem site to an Azure VNet over a persistent IPsec tunnel; configure a VPN gateway and an on-prem local network gateway.
Prerequisites: Virtual network (VNet)、VPN Gateway
SQL login
A server-level security principal in SQL Server/Azure SQL, responsible for authentication (whether one can connect to the server); database access is only granted once mapped to a user. Comes in two flavors: Microsoft Entra logins and SQL-authenticated logins.
Prerequisites: SQL authentication
VPN gateway SKU and redundancy
The SKU determining a VPN gateway’s performance/bandwidth/tunnel count; for availability use active/active or zone-redundant configurations.
Prerequisites: Redundancy (LRS/ZRS/GRS/GZRS)、VPN Gateway、Zone redundancy (Azure SQL)、Performance metrics (IOPS/throughput/bandwidth/latency)
ARM template
The foundational JSON format for declaratively describing Azure resource configuration as IaC. Deploying the same template repeatedly converges to the same state (idempotent), with parameter files swapping per-environment values. Deployments are incremental (default) or complete mode—complete mode deletes resources not present in the template, a common gotcha.
Prerequisites: JSON
Access tiers (Hot/Cool/Cold/Archive)
Blob tiers optimizing storage cost by access frequency; lower tiers cost less to store but are slower/costlier to retrieve.
Prerequisites: Blob storage
Azure Arc
Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).
Prerequisites: Role-based access control (RBAC)、Tags (Azure)
Azure Functions
The flagship serverless (FaaS): event-driven function execution billed only for what runs.
Network security group (NSG)
Applies allow/deny rules by source/destination/port at the subnet or NIC level.
Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、Subnet
Azure Policy
Defines/enforces rules (allowed regions, required tags, etc.) that resources must meet and evaluates compliance.
Prerequisites: Region (Azure)、Tags (Azure)
Role-based access control (RBAC)
Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.
Region pair
A pair of distant regions within the same geography—used for broad-disaster redundancy, sequential updates, and as the GRS replication target. Note newer regions (since 2024) may have no pair, in which case availability zones (zone redundancy) are used instead.
Prerequisites: Availability zone、Redundancy (LRS/ZRS/GRS/GZRS)、Region (Azure)、Zone redundancy (Azure SQL)
Azure Virtual Machines (VM)
IaaS virtual machines; the most flexible compute where you manage the OS and above.
Virtual machine scale sets (VMSS)
A set of identical VMs that autoscales with load (the performance axis; availability is via sets/zones).
Prerequisites: Azure Virtual Machines (VM)、Availability set (fault/update domains)
Availability set (fault/update domains)
Spreads VMs within one datacenter across fault domains (power/network/rack) and update domains (planned-maintenance units) to avoid simultaneous impact from unplanned failures and planned maintenance. Use availability zones for datacenter-level failures.
Prerequisites: Availability zone
BCDR design (backup/disaster recovery)
Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.
Prerequisites: Region (Azure)、Azure Backup、Azure Site Recovery (ASR)、Zone redundancy (Azure SQL)
Azure Bastion
A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.
Prerequisites: Azure portal and Marketplace
Related: Just-In-Time (JIT) VM access
Azure Firewall
A managed, stateful network firewall for centralized traffic control.
Log Replay Service (LRS)
For SQL Managed Instance migrations, continuously restores/applies backups from Blob to enable an online migration with a manual cutover.
Prerequisites: Blob storage、Online vs offline migration、SQL Managed Instance
Database migration (assess, DMS, online/offline)
Moving from on-prem to Azure SQL. First assess (Data Migration Assistant / Azure Migrate for compatibility, target, SKU sizing), then execute (Azure Database Migration Service or the Azure SQL Migration extension; Log Replay Service for MI). Choose offline (bulk copy, downtime) or online (continuous sync with a final cutover, minimal downtime). After migrating, adjust the compatibility level and check regressions via Query Store. Pick the target by need for instance features, OS control, and tolerable downtime.
Prerequisites: Azure Database Migration Service (DMS)、Log Replay Service (LRS)、Online vs offline migration、Query Store
Query Store
Retains query text, execution plans, and runtime statistics as history. It underpins regression detection and plan forcing.
Prerequisites: Automatic tuning (plan forcing)、Execution plan
Read scale-out
On Business Critical / Hyperscale, routes read workloads to read-only secondary replicas to offload the primary. Used via ApplicationIntent=ReadOnly in the connection string.
Prerequisites: Resource lock、Hyperscale tier and page servers
Related: Business Critical tier
Encryption at rest
Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.
B2B collaboration (Microsoft Entra External ID)
Invites users from external organizations (e.g., partners) as guests, letting them collaborate using their own existing identity. Now unified under Microsoft Entra External ID, invitations and permissions are governed via Conditional Access and cross-tenant access settings. An invited guest is registered as a guest user object within the inviting organization's own tenant and authenticates with their external organization's credentials—no separate tenant is created for the guest.
Prerequisites: Conditional Access
Related: B2C (Azure AD B2C)
Azure Event Grid
Reactive pub/sub delivering discrete events (e.g., "blob created"); subscribe via event subscriptions and react in near real time.
Prerequisites: Blob storage、Subscription (Azure)
Azure Event Hubs
High-throughput ingestion of large streaming/telemetry; processed in parallel via partitions and consumer groups.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Forced tunneling and gateway transit
Forced tunneling routes outbound internet via on-prem with a UDR; gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway.
Prerequisites: ExpressRoute、ExpressRoute gateway
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Related: TLS
Log Analytics workspace
A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.
Prerequisites: Azure Monitor、Microsoft Sentinel
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、HTTPS
Related: UDP
Service chaining (via NVA)
Sets the UDR next hop to an NVA (network virtual appliance/firewall) to force traffic through it; enable IP forwarding on the NVA and front it with an internal Load Balancer for redundancy.
Prerequisites: Azure Load Balancer
Service endpoint
Routes subnet-to-PaaS traffic over the Azure backbone and lets the PaaS firewall allow that subnet; assigns no private IP (not reachable from on-prem). Service endpoint policies can restrict destinations.
Prerequisites: Subnet
SQL Managed Instance
A PaaS with near-full SQL Server compatibility; good for migrating existing SQL Server (lift-and-shift).
System routes
Default routes Azure auto-provides for intra-VNet, peering, gateways, and default internet; can be overridden by UDRs.
Prerequisites: Virtual network (VNet)
VNet peering
Connects two VNets over the Microsoft backbone with low latency; non-transitive by default (A-B-C does not give A↔C), so hub transit needs UDRs or gateway transit.
Prerequisites: Virtual network (VNet)、Forced tunneling and gateway transit、Performance metrics (IOPS/throughput/bandwidth/latency)
Azure App Configuration
A service to centrally manage app settings and feature flags; centralizes config, references Key Vault for secrets, and enables progressive rollout via flags.
Prerequisites: App Service configuration (settings, TLS, connections)、Azure Key Vault
Related: Feature flags
App Service configuration (settings, TLS, connections)
Configure app settings/connection strings (injected as env vars), custom-domain TLS/certs, and service connections; secrets can use Key Vault references.
Prerequisites: Azure App Service、Azure Key Vault
Application Insights
An APM service for apps; collects requests, dependencies, exceptions, metrics, logs, and traces to analyze performance and failures. Part of Azure Monitor.
Prerequisites: Azure Monitor
Azure Advisor
Recommends improvements for your resources across cost, security, reliability, performance, and operations.
Resource lock
A safety net preventing deletion or change (CanNotDelete / ReadOnly), stopping mistakes even by authorized users.
Azure File Sync
A service that syncs on-prem Windows file servers with Azure Files. Cloud tiering moves infrequently accessed files to the cloud to save local capacity.
Prerequisites: Azure Files (File storage)
Hybrid identity (Entra Connect)
Syncs on-prem Active Directory with Entra ID for hybrid identity. Choose authentication among password hash sync, pass-through authentication, and federation (AD FS).
Prerequisites: Microsoft Entra ID
VM extensions and custom script
Mechanisms to add configuration/automation to a VM. The Custom Script Extension runs scripts at boot, and DSC and the Azure Monitor Agent are also deployed as extensions.
Prerequisites: Azure Monitor
Azure Data Lake Storage Gen2
A data lake for large-scale analytics that adds a hierarchical namespace on top of Blob storage. With directory structure and POSIX-like ACLs, it serves as the storage layer for Synapse/Databricks analytics.
Prerequisites: Blob storage、Azure Databricks、Azure Synapse Analytics
Hub-spoke network topology
A design that centralizes shared services (firewall, gateway, DNS) in a hub VNet with spoke VNets connected by peering; can also be realized in a managed way via Virtual WAN.
Prerequisites: Virtual network (VNet)、Azure Virtual WAN
Azure landing zone (CAF)
A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.
Prerequisites: Management group、Hub-spoke network topology
Related: Azure landing zone
Azure Logic Apps
A service that integrates workflows with no-code/low-code using many connectors. It links SaaS, on-prem, and Azure services via triggers/actions to automate business processes and connect systems.
Azure Pipelines
A CI/CD pipeline service defined as code (YAML). Composed of stages → jobs → steps, triggered by push/PR/schedule, and reused via templates. Runs on Microsoft-hosted or self-hosted agents.
Prerequisites: YAML
Just-In-Time (JIT) VM access
A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.
Prerequisites: Microsoft Defender for Cloud
Related: Azure Bastion
BGP and route propagation
The standard protocol for dynamically exchanging routes between on-prem and the Azure gateway. Peers are identified by ASN; the Azure gateway’s default ASN is 65515 and on-prem sets its own. Enabling BGP on a VPN auto-learns on-prem subnet changes, removing UDR edits. ExpressRoute always exchanges routes via BGP (private/Microsoft peering). Reflecting learned routes into the VNet is route propagation; disabling it on a route table lets UDRs reliably win. With multiple routes to the same destination, ExpressRoute is preferred over VPN (basis for backup-VPN designs). Precedence: longest-prefix match, then UDR > BGP > system.
Prerequisites: ExpressRoute、Virtual network (VNet)、Subnet
Azure landing zone
A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.
Prerequisites: Management group、Subscription (Azure)
Related: Azure landing zone (CAF)
Azure portal and Marketplace
The Azure portal is a web console to manage resources via GUI. Azure Marketplace lets you buy and deploy Microsoft/third-party solutions. A mobile app also monitors/operates resources.
AzCopy
A command-line tool for fast bulk copy/upload/download to and from Blob storage/file shares. Supports parallel transfer and resumable checkpoints, better suited to scripting/automation than the GUI Storage Explorer. Authenticates via Microsoft Entra ID or a SAS token.
Prerequisites: Blob storage、Microsoft Entra ID
Related: Azure Storage Explorer
Azure Database for MySQL
A managed relational service for the open-source MySQL engine. The current offering is the Flexible Server, supporting same-zone placement for latency optimization and flexible compute/storage scaling; Azure handles patching, backups, and failover.
Prerequisites: Availability zone、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Azure Database for PostgreSQL
Azure DNS (public zones)
Hosts a domain’s public DNS records in Azure, providing internet name resolution.
Azure Files (File storage)
SMB/NFS file shares mountable from multiple machines simultaneously.
Azure Container Apps
A serverless platform to run containers/microservices without managing Kubernetes; KEDA-based event-driven scaling (scale to zero) and Dapr integration.
Prerequisites: Microservices
Related: ACR (Azure Container Registry)
Azure DNS Private Resolver
A managed service brokering DNS resolution between on-prem and Azure; conditional forwarders route specific domains to the right DNS.
Prerequisites: Azure DNS (public zones)、Managed services (management boundary)
Always On availability groups
On SQL Server on VM / Managed Instance, replicates a set of databases across replicas (sync/async) to provide HA/DR.
Prerequisites: SQL Managed Instance、SQL Server on VM
Automatic tuning (plan forcing)
Azure SQL automatically creates recommended indexes and applies FORCE LAST GOOD PLAN (forcing the last known good plan) on regressions.
Prerequisites: Index
Azure Automation (runbooks)
A service automating cross-cloud/on-prem operations via PowerShell/Python runbooks. Hybrid Workers enable on-prem execution.
Session blocking
When one session waits on locks held by another. Identify long blocks and deadlock signs via DMVs and resolve via queries, indexes, or isolation levels.
Prerequisites: Index
Business Critical tier
An Azure SQL service tier delivering low latency and high availability via local SSD and built-in Always On replicas. It includes a secondary for read scale-out.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Read scale-out
Azure Database Migration Service (DMS)
A managed service to migrate databases to Azure SQL. It works with the Azure SQL Migration extension to run online/offline migrations.
Prerequisites: Online vs offline migration、Managed services (management boundary)
Dynamic management views (DMVs)
Views that expose live internal server/database state (waits, blocking, index usage, etc.) queryable via SQL.
Prerequisites: Index、Session blocking
Elastic pool
Shares compute resources (eDTUs/vCores) across multiple Azure SQL Databases, optimizing cost for many DBs with offset usage peaks.
Prerequisites: Azure SQL Database、Purchasing models (vCore / DTU)
Execution plan
A diagram of how a query executes. Inspect scan vs seek, key lookups, and non-SARGable predicates to decide index or rewrite improvements.
Prerequisites: Index
General Purpose tier
The balanced Azure SQL service tier. It separates compute from remote storage, suiting general-purpose workloads that balance cost and performance.
Online vs offline migration
Offline is a bulk copy with downtime; online continuously syncs changes with a final cutover for minimal downtime. Choose by tolerable downtime.
SQL authentication
Traditional authentication where the username/password are managed within SQL. A fallback when Entra auth is unavailable, requiring strong passwords and least privilege.
B2C (Azure AD B2C)
CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.
Prerequisites: Microsoft Entra ID、SQL login
Microsoft Entra ID Protection
Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.
Prerequisites: Conditional Access、Microsoft Entra ID
ExpressRoute Direct
An ExpressRoute form that connects directly to Microsoft's edge routers over dedicated 10 Gbps or 100 Gbps port pairs, without going through a connectivity provider. Multiple ExpressRoute circuits can be carved out of one physical connection, suited to workloads needing very high bandwidth and low latency.
Prerequisites: ExpressRoute、Performance metrics (IOPS/throughput/bandwidth/latency)
Related: ExpressRoute FastPath
Azure Functions hosting plans
Choosing billing/performance for the runtime: Flex Consumption (current default—fast scale, VNet, always-ready instances), the older Consumption (auto-scale, cold starts), Premium (pre-warmed, VNet), and Dedicated (App Service plan).
Prerequisites: Azure App Service、Azure Functions、Virtual network (VNet)
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Key Vault objects (keys/secrets/certificates, dev)
Securely fetching and using secrets, keys, and certificates from code; avoid hard-coding (e.g., connection strings)—use Key Vault references or managed identity.
Prerequisites: Azure Key Vault、Managed identity
Outbound rules and SNAT (Load Balancer)
Translates (SNATs) the source address of outbound traffic from backend-pool VMs to the Load Balancer's frontend IP, enabling outbound connectivity for VMs without a public IP. Outbound rules control port allocation—watch for SNAT port exhaustion under heavy outbound load.
Related: Inbound NAT rule、Load-balancing rule
Messages vs events
A message is a command the sender expects to be handled (Service Bus/Queue); an event is a notification of something that happened (Event Grid/Event Hubs)—a key selection axis.
Prerequisites: Azure Event Grid、Azure Event Hubs、Azure Service Bus
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
Prerequisites: Virtual network (VNet)、Broadcast、Unicast
Packet capture (Network Watcher)
A Network Watcher feature that captures a VM’s traffic for analysis; used to isolate app-layer issues invisible to NSG checks.
Rate limiting
Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.
Queue storage
A message queue to decouple components and smooth processing spikes.
Prerequisites: Loose coupling (decoupling)
Fault tolerance
Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).
Prerequisites: VPN gateway SKU and redundancy
Defender for Servers
Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.
Prerequisites: Azure Arc、Just-In-Time (JIT) VM access
Secured Virtual Hub
A virtual hub with Azure Firewall embedded, centrally applying policy across hubs via Firewall Manager to inspect traffic centrally.
Prerequisites: Azure Firewall、Virtual hub (Virtual WAN)
Azure Service Bus
An enterprise message broker supporting ordering, transactions, dedup, and dead-lettering; used for reliable command delivery.
Database user
A database-level security principal in SQL Server (and Azure SQL), mapped to a login, whose role memberships and GRANT/DENY/REVOKE determine authorization to objects. DENY is a T-SQL-specific permission state unique to SQL Server—PostgreSQL and MySQL have no equivalent. Contrasted with a contained user, which is created without a login.
Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、SQL login
Related: Contained database user
Azure Traffic Manager
DNS-based global traffic distribution; routing methods (priority/weighted/performance/geographic) decide which IP is returned (real traffic goes straight to the backend).
Virtual hub (Virtual WAN)
The managed hub at the core of Virtual WAN; hosts VPN/ExpressRoute/P2S gateways and connections, transiting spokes via hub routing.
Prerequisites: ExpressRoute
Related: Azure Virtual WAN
WAF policy and detection/prevention modes
A Web Application Firewall config associated with Application Gateway or Front Door; choose detection mode (log only) or prevention mode (block), using OWASP rule sets to stop common attacks.
Prerequisites: Application Gateway、Web Application Firewall (Azure WAF)、Azure Front Door
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
Anycast
A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Unicast
Developer portal (APIM)
An auto-generated portal for API consumers offering documentation, try-it, and subscription sign-up.
Prerequisites: Subscription (Azure)
Related: Azure API Management (APIM)
Named values (APIM)
Centralizes constants/secrets used in policies; secrets are referenced securely via Key Vault integration.
Prerequisites: Azure Key Vault
Related: Azure API Management (APIM)
API Management policies
XML rules controlling API behavior (inbound/backend/outbound/on-error); apply auth (validate-jwt), rate limiting, transformation, caching, and CORS.
Prerequisites: Rate limiting
Related: Azure API Management (APIM)
Products and subscriptions (APIM)
Bundles APIs as "products" that consumers use via subscriptions (keys); manages exposure and terms per product.
Prerequisites: Subscription (Azure)
Related: Azure API Management (APIM)
Diagnostics and logging (App Service)
Collecting app/web-server/detailed-error logs and viewing the live log stream; integrates with App Insights for monitoring.
Prerequisites: Azure App Service
Scale set autoscaling
Automatically scales a virtual machine scale set’s instance count by metrics (e.g., CPU) or schedule, with scale-in/out rules and min/max bounds.
Prerequisites: Azure Virtual Machines (VM)、Virtual machine scale sets (VMSS)
YAML pipelines and templates
Defines pipelines as code (YAML) with stages, jobs, and steps. Templates reuse common logic, and multi-stage pipelines combine CI and CD to multiple environments in one definition.
Prerequisites: Azure Pipelines、YAML
App Service Environment (ASE)
A dedicated, isolated App Service environment integrated into a virtual network, used for sensitive workloads needing network isolation and high scale.
Prerequisites: Azure App Service、Virtual network (VNet)
BYOK and infrastructure encryption
BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.
Prerequisites: Customer-managed keys (CMK) / Platform-managed keys (PMK)
Key rotation and backup
Periodically auto-rotates Key Vault keys/secrets/certificates to reduce leak risk, and uses backup/restore to guard against accidental deletion or failure.
Prerequisites: Azure Key Vault、Key Vault objects (keys/secrets/certificates, dev)
Workflow automation (Defender for Cloud)
Triggers Logic Apps on security alerts or recommendations to automate responses like notifications, ticketing, and remediation.
Prerequisites: Microsoft Defender for Cloud、Azure Logic Apps
Azure CDN
Caches static content at edge for low-latency delivery. The Microsoft standard profile is current; legacy Verizon/Edgio profiles are being retired. New workloads are recommended to use Azure Front Door (with integrated CDN). Updates apply via purge.
Prerequisites: Azure Front Door、Performance metrics (IOPS/throughput/bandwidth/latency)
Azure Database for PostgreSQL
A managed relational service for the open-source PostgreSQL engine. The current offering is the Flexible Server, supporting availability-zone placement, burstable SKUs, and fine-grained maintenance windows; Azure handles patching, backups, and failover.
Prerequisites: Availability zone
Related: Azure Database for MySQL
Azure Storage Explorer
A standalone GUI app (Windows/macOS/Linux) to browse, upload, and manage Blob storage, file shares, queues, and tables. Suited to inspecting small amounts of data, manual operations, and quick permission tweaks; use AzCopy for high-speed bulk transfer.
Prerequisites: Blob storage
Related: AzCopy
Bicep
A DSL offering more concise syntax than ARM template JSON. Running az bicep build compiles it into an equivalent ARM template JSON, which is what actually gets deployed. Modules and loop syntax improve readability and reuse.
Prerequisites: ARM template、JSON
Blob access tiers
Cost-optimization tiers by access frequency: hot (frequent), cool (infrequent), cold, and archive (rarely accessed, slow to rehydrate).
Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage
Blob lifecycle management
Policies that auto-move blobs across access tiers (hot→cool→archive) or delete them after N days; optimizes storage cost.
Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage
Connection Monitor
A Network Watcher feature that continuously monitors reachability, latency, and packet loss between endpoints, detecting route changes and failures.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Container image
An immutable package of an app and its dependencies; built from a Dockerfile, pushed to a registry (ACR), and run by services.
Cross-region Load Balancer
Bundles regional Load Balancers behind one global IP for geo-redundancy and low-latency routing.
Prerequisites: Region (Azure)、Performance metrics (IOPS/throughput/bandwidth/latency)
Active geo-replication
A DR feature asynchronously creating a readable secondary in another region. It supports manual failover and up to four secondaries.
Prerequisites: Region (Azure)
Elastic Jobs
Automation for Azure SQL Database. Uses a job agent and job DB to run T-SQL in parallel across DBs via target groups.
Prerequisites: Azure SQL Database
Failover groups
A DR feature connecting a group of DBs via listeners and failing them over automatically without changing the connection string.
Geo-restore
A DR option restoring from GRS geo-redundant backups to another region. Because the copy is asynchronous, RPO is larger.
Prerequisites: Region (Azure)
Hyperscale tier and page servers
An Azure SQL service tier scaling to ~100TB. Page servers separate storage to enable snapshot-based fast backup/restore and rapid scaling.
Intelligent query processing (IQP)
A set of features that improve query performance without rewrites (adaptive joins, memory-grant feedback, batch mode, etc.), enabled via compatibility level.
Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)
Long-term retention (LTR)
Retains weekly/monthly/yearly backups for up to 10 years, meeting compliance requirements.
Purchasing models (vCore / DTU)
vCore is a flexible model where you size CPU, memory, and storage separately, with Azure Hybrid Benefit and reserved discounts (recommended). DTU is a simple blended metric of compute and storage.
Related: Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)
Encryption in transit
Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.
Prerequisites: Encryption at rest
ExpressRoute peering (private/Microsoft)
ExpressRoute peering types: private peering reaches VNets; Microsoft peering reaches public Microsoft 365/PaaS over the private circuit. Always exchanged via BGP.
Prerequisites: ExpressRoute、Virtual network (VNet)
Eventual consistency
A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Strong consistency
Azure Functions triggers
What starts a function—HTTP (request), timer (schedule), Blob/Queue/Event (data ops), webhooks; one trigger per function.
Prerequisites: Blob storage、Azure Functions
Horizontal scaling (scale out)
Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.
Prerequisites: Fault tolerance
Inbound NAT rule
A Load Balancer rule that forwards traffic on a specific frontend port to a specific port on one VM in the backend pool—pinpoint forwarding, unlike a load-balancing rule's distribution across many backends. Commonly used to expose RDP/SSH to individual VMs.
Prerequisites: Load-balancing rule
Load-balancing rule
A rule that distributes inbound traffic received on a Load Balancer frontend IP/port across a backend pool, based on health-probe results. The default is 5-tuple hash distribution, with session persistence (source-IP affinity) configurable.
Loose coupling (decoupling)
A design that separates components via queues (SQS), notifications (SNS), or events (EventBridge) instead of direct calls—so failures/load on one side don’t cascade, and parts scale and deploy independently while buffering spikes.
Broadcast
A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.
Prerequisites: Virtual network (VNet)
Default route (0.0.0.0/0)
The catch-all route in a route table for destinations that match no more-specific route. In public subnets it points to an IGW; in private subnets to a NAT gateway—deciding the egress path.
Prerequisites: Azure NAT Gateway、Subnet
Ephemeral port
A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.
Prerequisites: Port number
Private Link and DNS integration
Points the PaaS public FQDN via CNAME to a privatelink zone and resolves it to the private IP through the private DNS zone’s A record; forgetting this resolves to the public IP—a common incident.
Prerequisites: Private DNS zone
Blast radius
The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.
Prerequisites: Region (Azure)
Azure Route Server
A managed service that exchanges routes via BGP between an NVA and Azure, reflecting NVA routes into the VNet without manual UDR updates.
Prerequisites: Virtual network (VNet)、Managed services (management boundary)
Azure Virtual Network Manager
Groups many VNets as network groups and centrally applies connectivity and security admin rules. Security admin rules are higher-priority rules evaluated before NSGs, enforcing org-wide guardrails teams cannot override.
Prerequisites: Virtual network (VNet)
Related: Azure Virtual Network Manager
Topics and subscriptions (Service Bus)
Pub/sub that fans one message to multiple receivers; each subscription can filter which messages it receives.
Prerequisites: Subscription (Azure)、Azure Service Bus
Strong consistency
A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Eventual consistency
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Prerequisites: CIDR notation、Subnet
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)
Related: HTTPS
UDP
A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Port number
Unicast
The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.
Related: Anycast
Vertical scaling (scale up)
Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.
Prerequisites: Horizontal scaling (scale out)、Single point of failure (SPOF)
Virtual network flow logs
Logs allowed/denied traffic to Storage (successor to NSG flow logs); visualized via Traffic Analytics to analyze traffic patterns and anomalies.
Prerequisites: Virtual network (VNet)
Azure Virtual Network Manager
Centrally manages connectivity (mesh/hub-and-spoke) and security rules across many VNets, applying config to network groups at once.
Prerequisites: Virtual network (VNet)
Related: Azure Virtual Network Manager
Distributed tracing and Application Map
Tracks a request across services via correlation IDs and visualizes dependencies/latency on the Application Map.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
App Service autoscaling
Adjusts instance count to follow load. Choose rule-based Autoscale (scale on metrics like CPU/memory or schedules) or platform-managed automatic scaling. Balances cost and performance.
Prerequisites: Azure App Service
Deploying to App Service
Ways to deploy code or containers to App Service (ZIP deploy, container deploy, CI/CD); combine with slots for zero downtime.
Prerequisites: Azure App Service
Sidecar pattern
Running an auxiliary container (log shipping, proxy, security) alongside the main container in the same task/Pod—adding cross-cutting concerns without changing the app. A service mesh (Envoy proxy) is a prime example.
Prerequisites: Log shipping
Azure Service Health
Notifies you of Azure-side incidents, planned maintenance, and health (distinct from Advisor, which advises on your resources).
Prerequisites: Azure Advisor
Blob protection (soft delete, versioning, object replication)
Blob/container soft delete recovers from accidental deletion, versioning keeps history, and object replication asynchronously copies to another account.
Prerequisites: Blob storage
NSG evaluation and effective rules
An NSG can apply to both subnet and NIC, evaluating from lowest priority number and allowing/denying on the first match. Effective security rules show the actual applied result.
Prerequisites: Subnet
Environments and approvals/gates (Azure Pipelines)
Environments representing deploy targets (Dev/Test/Staging/Prod) and checks that control deployment to them. Combine approvals (human sign-off), gates (automated checks like monitoring queries), branch control, business hours, and required templates to protect production resources.
Prerequisites: Azure Pipelines
Feature flags
A mechanism that decouples deployment (placing code in prod) from feature enablement (release). Managed via Azure App Configuration Feature Manager, etc., enabling staged rollout, A/B testing, and instant disable (kill-switch) without redeploy.
Related: Azure App Configuration
Security testing (SAST/DAST/SCA)
Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).
Prerequisites: Container image
Variable groups and Key Vault integration
Variable groups bundle settings shared across pipelines, with secrets retrieved securely via Azure Key Vault integration; secure files handle certificates, etc.
Prerequisites: Azure Key Vault
AKS security
Secures Kubernetes workloads via AKS network isolation (private clusters, network policies), Entra-integrated authentication/authorization, and monitoring with Defender for Containers.
Prerequisites: Defender for Containers
Custom roles (Azure / Entra roles)
When built-in roles lack granularity, define custom roles that allow only the needed actions. Azure resource roles and Microsoft Entra roles are managed as separate systems.
Defender for Cloud DevOps security
Connects GitHub, Azure DevOps, and GitLab to Defender for Cloud to detect misconfigurations, exposed secrets, and vulnerabilities in code and pipelines.
Prerequisites: Microsoft Defender for Cloud
Defender Vulnerability Management
Continuously detects known vulnerabilities (CVEs) on VMs and containers, with prioritization and remediation guidance, built into Defender for Servers/Containers.
Prerequisites: Defender for Servers
Encryption over ExpressRoute
Ways to encrypt traffic over the private ExpressRoute circuit: MACsec on the link itself, or an IPsec VPN layered over ExpressRoute.
Prerequisites: ExpressRoute
Microsoft Cloud Security Benchmark (MCSB)
Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.
Prerequisites: Microsoft Defender for Cloud
Regulatory compliance (standards / custom)
Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.
Prerequisites: Microsoft Defender for Cloud
Blob versioning
A Blob storage protection that automatically keeps prior versions on each overwrite/delete to enable recovery from mistakes, used with soft delete and immutable storage.
Prerequisites: Blob storage
Azure support plans
Choose among Basic (free, billing/subscription), Developer (trial), Standard (production), and Professional Direct (business-critical), differing in response time and architecture guidance.
Prerequisites: Subscription (Azure)
Azure Databricks
An Apache Spark-optimized platform for big-data processing and ML; strong for data science.
Azure Firewall rules
Azure Firewall’s three rule types: DNAT rules translate/forward inbound, network rules control L3-L4 by IP/port/protocol, and application rules control L7 by FQDN.
Prerequisites: Azure Firewall
Azure Pricing Calculator
A web tool that estimates the monthly cost of a planned Azure configuration. Enter region, SKU, usage hours, and data transfer to get a per-service cost estimate, useful for comparing designs or drafting proposals; actual billing can differ due to FX rates and real usage.
Prerequisites: Region (Azure)
Azure Synapse Analytics
A platform unifying large-scale data warehousing and integrated analytics (SQL, Spark, pipelines). Its capabilities are being integrated into the next-generation Microsoft Fabric, which is recommended for new workloads.
Bidirectional Forwarding Detection (BFD)
A protocol that quickly detects failures between adjacent routers; on ExpressRoute it speeds BGP convergence and failover.
Prerequisites: ExpressRoute
Blob properties and metadata
Setting/getting a blob’s system properties (e.g., Content-Type) and user-defined key/value metadata.
Prerequisites: Blob storage
Blob operations with the SDK
Development operations to create/upload/download/list containers and blobs via BlobServiceClient/ContainerClient/BlobClient.
Prerequisites: Blob storage
Connection tracking
How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.
Prerequisites: Ephemeral port
Change feed (Cosmos DB)
A persistent log of creates/updates in order; used for event processing, materialized views, and syncing to other stores (deletes not included by default).
Prerequisites: Azure Cosmos DB
Consistency levels (Cosmos DB)
Five levels trading read consistency against performance/availability: strong → bounded staleness → session (default) → consistent prefix → eventual.
Prerequisites: Azure Cosmos DB
Partition key (Cosmos DB)
The property that distributes data into logical partitions; pick a high-cardinality, evenly distributed value to avoid hot partitions and use RU/s efficiently.
Prerequisites: Azure Cosmos DB
Cosmos DB operations with the SDK
Development operations to create/read/query/update databases/containers/items via CosmosClient; request cost is measured in RUs.
Prerequisites: Azure Cosmos DB
Deployment slots
In App Service, deploy to a separate environment (e.g., staging) and swap after warm-up for zero-downtime releases, with easy rollback.
Prerequisites: Azure App Service
Azure Arc-enabled SQL
Connects on-prem or other-cloud SQL Server to Azure via Azure Arc to centrally manage inventory, assessment, updates, and services like Defender/Purview.
Prerequisites: Azure Arc
Dynamic data masking
Masks sensitive data in query results without changing the stored data. Users with the UNMASK permission see the real values.
Index and statistics maintenance
Reorganizing/rebuilding fragmented indexes and updating statistics on a schedule to keep performance. Typically scheduled via automation (jobs).
Prerequisites: Index
Integrity checks (DBCC CHECKDB)
A command that checks a database for logical and physical corruption. Run regularly to detect corruption early and, with backups, ensure data integrity.
Intelligent Insights
An Azure SQL feature that automatically detects performance problems and emits root causes and recommendations as diagnostic logs.
Prerequisites: Diagnostics and logging (App Service)
Log shipping
A simple, mature DR method that periodically copies and restores transaction-log backups to a standby server.
Managed Instance database copy and move
Native operations to copy (replicate) or move (transfer) a database between SQL Managed Instances, used for instance reorganization or environment separation.
Prerequisites: SQL Managed Instance
Row-level security (RLS)
Restricts which rows each user can see using a security predicate (function). Used for tenant isolation and scoping access by responsibility.
Serverless compute (Azure SQL)
An Azure SQL compute tier that auto-scales by usage and auto-pauses when idle to stop per-second billing. It suits intermittent workloads.
SQL auditing (server/database)
Records database events to Log Analytics, Storage, or Event Hubs. Server audit applies to all DBs; database audit applies individually.
Prerequisites: Azure Event Hubs
Azure SQL Database in Microsoft Fabric
Azure SQL Database integrated inside Microsoft Fabric, tightly tied to OneLake mirroring and Fabric’s analytics experience.
Prerequisites: Azure SQL Database
Always Encrypted with VBS enclaves
Always Encrypted using virtualization-based security (VBS) enclaves, enabling server-side operations like range comparisons and pattern matching on still-encrypted data.
Prerequisites: Always Encrypted
Wait statistics
Metrics showing what sessions wait on (I/O, locks, CPU, etc.). They are the starting point for classifying bottlenecks.
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: Blast radius
Local network gateway
An Azure object representing the "on-prem side" of an S2S VPN; registers the on-prem public IP and address space (or BGP settings).
Prerequisites: Site-to-site VPN (S2S)
Microservices
An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.
NSG security rules
NSG inbound/outbound rules evaluated by priority; allow/deny by source/destination (IP, ASG, service tag), port, and protocol, with default rules evaluated last.
Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)
Security group (environment)
Uses a Microsoft Entra ID group to restrict which users can access an environment, scoping membership per environment.
Prerequisites: Microsoft Entra ID
Single point of failure (SPOF)
A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.
Defender for Containers
A Defender plan that detects container misconfigurations and runtime risks (suspicious processes, known exploits). Complements image vulnerability scanning and trusted-image allowance in ACR.
Microsoft Sentinel
A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.
SQL Server on VM
Running SQL Server on IaaS; you manage down to the OS with full control but higher operational effort.
Subnet delegation
Grants a specific PaaS service management rights over a subnet so it can auto-apply needed network config (e.g., NIC injection).
Prerequisites: Subnet