Microsoft Azure DevOps Engineer Expert — knowledge map

The 301 core concepts of Microsoft Azure DevOps Engineer Expert and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.

Concepts (301)

• Virtual network (VNet)

  A private network in Azure; divided by subnets and connected to other VNets via peering.

• Performance metrics (IOPS/throughput/bandwidth/latency)

  Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.

• Region (Azure)

  A geographic grouping of one or more datacenters; chosen by latency, data sovereignty, feature availability, and cost.

• Blob storage

  Storage for unstructured data (objects) such as images, video, and backups.

• Authentication (AuthN)

  Verifying "who you are" (identity); performed before authorization.

  Related: Authorization (AuthZ)

• Azure SQL authentication/access control and data protection

  Authentication: Microsoft Entra (recommended—centralized, MFA/Conditional Access, passwordless via managed identity) and SQL auth. Distinguish logins (server) from users (DB); contained users are preferred in SQL Database. Authorize via fixed/custom roles and GRANT/DENY/REVOKE (DENY wins) for least privilege. Narrow rows with row-level security (RLS) and columns with column-level permissions. Data protection: dynamic data masking (limits display; UNMASK reveals real values) and auditing (log operations to Log Analytics/Storage). Encryption is TDE/Always Encrypted (separate entries).

  Prerequisites: Authentication methods (MFA / passwordless)、Authentication (AuthN)、Always Encrypted、Custom roles (Azure / Entra roles)

• Azure Key Vault

  Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.

• ExpressRoute

  A dedicated private connection that does not use the internet; high reliability, consistent low latency, high bandwidth.

• Subscription (Azure)

  The billing/usage boundary and a logical container for resources; often split by department or environment.

• GitHub

  A service that hosts Git repositories in the cloud and adds collaboration features like Pull Requests, Issues, review, and Actions.

  Prerequisites: Pull Request (PR)、Repository

  Related: GitHub Actions

• GitHub Actions

  A workflow platform for automating CI/CD; defined as YAML in .github/workflows and run on runners.

  Prerequisites: YAML

  Related: Runner、GitHub

• Microsoft Entra ID

  Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.

  Prerequisites: Access management (RBAC / least privilege / JIT)

• Azure App Service

  PaaS to host web apps and APIs quickly, with no OS management and easy scaling.

• Routing (system routes, service chaining, forced tunneling)

  Azure path control. System routes are auto-provided by Azure for intra-VNet, peering, gateways, and default internet. UDRs (user-defined routes) override them, defining destination prefix → next hop (virtual appliance/gateway/internet/none). Service chaining sets the UDR next hop to an NVA (firewall) to force traffic through it (IP forwarding required on the NVA; for redundancy front it with an internal Load Balancer). Forced tunneling forces outbound internet via on-prem with a UDR. Gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway. Route selection: longest-prefix match, then UDR > BGP > system.

  Prerequisites: ExpressRoute、Virtual network (VNet)、Network Watcher tools (IP flow verify, Connection Monitor, next hop)、Azure Load Balancer

• Authorization (AuthZ)

  Deciding "what you can do" once authenticated (permissions); performed after authentication.

  Related: Authentication (AuthN)

• Service connection

  An authorization configuration allowing Azure Pipelines to access external resources (an Azure subscription, container registry, Kubernetes cluster, etc.). Created per project, a pipeline just references the service connection name to authenticate to the target; approvals and checks control which pipelines may use it.

  Prerequisites: Authorization (AuthZ)、Subscription (Azure)、Environments and approvals/gates (Azure Pipelines)、Azure Pipelines

• Monitoring and optimization (Query Store, DMVs, automatic tuning)

  Measure first to find bottlenecks. Query Store keeps query history, plans, and wait stats for regression detection and plan forcing. DMVs expose live internal state (wait stats, blocking) via SQL. In the execution plan, watch scan vs seek, key lookups, and non-SARGable predicates; improve with indexes (create missing, drop unused, rebuild fragmented) and updated statistics. Azure SQL automatic tuning (auto-apply recommended indexes, FORCE LAST GOOD PLAN) and intelligent query processing help.

  Prerequisites: Index、Automatic tuning (plan forcing)、Session blocking、Dynamic management views (DMVs)

• Microsoft Defender for Cloud

  Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.

• Azure API Management (APIM)

  An API gateway exposing multiple backend APIs through one front door. Policies (XML; inbound/backend/outbound/on-error) apply auth (validate-jwt), rate limiting, transformation, caching, and CORS. Offer to consumers via products and subscriptions (keys), document in the developer portal, authenticate to backends with a managed identity, and store secrets in named values (Key Vault).

  Prerequisites: Azure Front Door、Rate limiting

  Related: Named values (APIM)、API Management policies、Developer portal (APIM)、Products and subscriptions (APIM)

• Messaging/eventing (Service Bus, Event Grid, Event Hubs)

  Loose-coupling options. Service Bus = enterprise messaging (queues/topics; ordering/transactions/dedup/dead-letter). Storage Queue = simple, cheap high-volume queue. Event Grid = reactive pub/sub of discrete events (e.g., "blob created"). Event Hubs = high-volume streaming/telemetry ingestion (high throughput, partitions). Message = command; event = notification.

  Prerequisites: Blob storage、Azure Event Grid、Azure Event Hubs、Loose coupling (decoupling)

• Azure Private Link / Private Link Service

  A platform that brings connectivity to PaaS or your own service onto a private IP inside the VNet. Private Link connects to PaaS (Storage/SQL) via a private endpoint (a NIC with a private IP) without the public path. The PaaS public FQDN CNAMEs to a privatelink zone, and the private DNS zone’s A record resolves it to the private IP (forgetting to link → resolves to public IP, a common mistake). Each sub-resource (blob/file, etc.) needs its own endpoint and zone. On-prem resolution uses a DNS Private Resolver plus conditional forwarders. Private Link Service offers your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link. Unlike service endpoints, it assigns a real private IP and is reachable from on-prem.

  Prerequisites: Blob storage、Virtual network (VNet)、Azure DNS Private Resolver、Private DNS zone

  Related: Private Link and DNS integration

• Azure Virtual WAN

  A large-scale networking service centralizing many sites, VNets, and remote users via a managed hub on the Microsoft backbone. It aggregates VPN, ExpressRoute, and VNet connections; the hub transits, so spokes reach each other without the non-transitivity problem. SKUs: Basic (S2S VPN only) and Standard (full: ExpressRoute/P2S/hub-to-hub/Secured Hub). A Secured Virtual Hub embeds Azure Firewall and uses Firewall Manager to centrally apply policy across hubs. Use hand-built hub-and-spoke for small scale, Virtual WAN for large/global.

  Prerequisites: ExpressRoute、Virtual network (VNet)、Azure Firewall、Site-to-site VPN (S2S)

  Related: Virtual hub (Virtual WAN)

• Azure SQL Database

  A fully managed relational PaaS; Azure handles patching, backups, availability. Best for new cloud apps.

  Prerequisites: Managed services (management boundary)

• Branch

  A movable reference for a parallel line of development; branch a feature off main to work.

• Commit

  A snapshot of changes at a point in time, identified by a unique hash (SHA) computed from its content.

• Contained database user

  A user whose authentication (password or Microsoft Entra ID) is bound to the database itself rather than depending on a server-level login. The standard pattern in Azure SQL Database, it avoids having to recreate server logins when a secondary is promoted in a failover group.

  Prerequisites: Authentication (AuthN)、Microsoft Entra ID、Azure SQL Database、Failover groups

  Related: Database user

• Index

  A structure that speeds searching on columns; faster reads but added write-time cost.

• Permissions (GRANT/DENY/REVOKE, least privilege)

  Grant permissions per securable via fixed/custom database roles and GRANT/DENY/REVOKE. DENY takes precedence; apply least privilege to all securables.

• Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

  Settings that determine Azure SQL performance/availability/cost. Tiers: General Purpose (balanced, remote storage), Business Critical (local SSD, built-in replicas, low latency, read scale-out), Hyperscale (up to ~100TB, page servers separate storage, fast backup/restore). Purchasing: vCore (flexible, Azure Hybrid Benefit, reserved discounts—recommended) vs DTU (simple metric). Compute is provisioned or serverless (auto pause/resume for intermittent loads). Share capacity across many DBs with an elastic pool. Read scale-out is on BC/Hyperscale.

  Prerequisites: Business Critical tier、Elastic pool、General Purpose tier、Hyperscale tier and page servers

  Related: Purchasing models (vCore / DTU)

• Managed identity

  An identity letting apps access Azure resources securely without managing secrets; a service principal auto-managed by Azure.

• merge

  Integrating while preserving both histories with a merge commit; history shows what happened.

  Prerequisites: Commit

• YAML

  A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.

  Prerequisites: IaC tools (Terraform / Helm)、JSON

• Availability zone

  A physically separated datacenter within a region (independent power/cooling/network); zone redundancy gives high availability.

  Prerequisites: Region (Azure)

  Related: Zone redundancy (Azure SQL)

• Azure Monitor

  The monitoring foundation collecting metrics and logs; feeds Log Analytics (KQL), Application Insights (app monitoring), and alerts.

• Storage access (access keys/SAS)

  Ways to access Azure Storage: access keys (full account access, rotate them), SAS (shared access signature; delegated access scoped by target/operation/expiry—user delegation SAS is safest), and Entra ID + RBAC (key-free, recommended). Restrict to a VNet with private endpoints/firewall.

  Prerequisites: Microsoft Entra ID、Role-based access control (RBAC)、Virtual network (VNet)、Private endpoint

• Azure Pipelines

  A CI/CD pipeline service defined as code (YAML). Composed of stages → jobs → steps, triggered by push/PR/schedule, and reused via templates. Runs on Microsoft-hosted or self-hosted agents.

  Prerequisites: YAML

• Network Watcher tools (IP flow verify, Connection Monitor, next hop)

  Network Watcher diagnostic tools for visibility and isolation. IP flow verify instantly decides whether a specific source/destination/port is allowed/denied by NSGs (with the matched rule name). Connection Monitor continuously monitors reachability, latency, and packet loss between endpoints. Next hop shows a packet’s actual next hop to isolate UDR mistakes. NSG/VNet flow logs record allowed/denied traffic to Storage, visualized via Traffic Analytics. Also packet capture, connection troubleshoot, and topology. Pick the tool for “is the NSG blocking, or a routing issue?”

  Prerequisites: Virtual network (VNet)、Connection Monitor、Packet capture (Network Watcher)、Virtual network flow logs

• Task automation (SQL Server Agent, Elastic Jobs)

  Routine-ops automation depends on the deployment. SQL Server Agent is the job scheduler on VM/Managed Instance (jobs, steps, schedules, operator notifications). Azure SQL Database lacks SQL Agent, so use Elastic Jobs (job agent + job DB; run T-SQL in parallel across DBs via target groups). Azure Automation runbooks (PowerShell/Python, Hybrid Workers) automate cross-cloud/on-prem ops. Schedule statistics updates, index rebuilds, DBCC CHECKDB, and backup verification, and notify on failure.

  Prerequisites: Azure SQL Database、Index、Azure Automation (runbooks)、Elastic Jobs

• Data protection and HA/DR (backup/restore, HA/DR, PITR, LTR, geo, failover groups)

  Azure SQL takes automated backups (full/differential/log). PITR restores to any point within retention (default 7 days, max 35). LTR retains weekly/monthly/yearly up to 10 years. Geo-restore restores to another region from GRS geo-redundant backups (asynchronous, larger RPO). HA is zone redundancy (in-region, across AZs); DR is active geo-replication (readable secondary in another region) and failover groups (auto-fail-over a group of DBs via listeners without changing the connection string). VM uses Always On availability groups. Design by RPO/RTO; synchronous gives RPO≈0, asynchronous covers distance.

  Prerequisites: Region (Azure)、Active geo-replication、Failover groups、Geo-restore

• Microsoft Entra authentication for Azure SQL

  The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.

  Prerequisites: Authentication methods (MFA / passwordless)、Authentication (AuthN)、Microsoft Entra ID、Managed identity

  Related: SQL authentication

• Zone redundancy (Azure SQL)

  An HA configuration spreading replicas across availability zones within a region to tolerate datacenter failure. Available on many service tiers.

  Prerequisites: Region (Azure)

  Related: Availability zone

• ExpressRoute gateway

  A virtual network gateway connecting an ExpressRoute circuit to a VNet; the SKU sets bandwidth and performance.

  Prerequisites: ExpressRoute、Virtual network (VNet)、Performance metrics (IOPS/throughput/bandwidth/latency)

• Azure Event Hubs

  High-throughput ingestion of large streaming/telemetry; processed in parallel via partitions and consumer groups.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

• GitHub Flow

  A lightweight pattern: branch → commit → PR → review → merge → deploy; keep main always deployable.

  Prerequisites: Branch、Commit、GitHub、merge

• Private endpoint

  A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.

  Prerequisites: Virtual network (VNet)

  Related: Azure NAT Gateway、User-defined route (UDR)

• Repository

  The container holding a project files and its full history/metadata; physically the hidden .git folder.

• SQL login

  A server-level security principal in SQL Server/Azure SQL, responsible for authentication (whether one can connect to the server); database access is only granted once mapped to a user. Comes in two flavors: Microsoft Entra logins and SQL-authenticated logins.

  Prerequisites: SQL authentication

• Management group

  The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.

  Prerequisites: Subscription (Azure)

• Role-based access control (RBAC)

  Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.

  Prerequisites: Authorization (AuthZ)

• Environments and approvals/gates (Azure Pipelines)

  Environments representing deploy targets (Dev/Test/Staging/Prod) and checks that control deployment to them. Combine approvals (human sign-off), gates (automated checks like monitoring queries), branch control, business hours, and required templates to protect production resources.

  Prerequisites: Azure Pipelines、Branch

• Always Encrypted

  Encrypts sensitive Azure SQL columns (e.g., credit card numbers) on the client so the server never sees plaintext. Keys (the column master key) live on the client or in Key Vault. Since the server can’t see plaintext, queries are generally limited (e.g., equality); range operations require Secure Enclaves. Unlike TDE (at rest only), it protects data in use—even from DBAs.

  Prerequisites: Encryption at rest、Azure Key Vault

  Related: Customer-managed keys (CMK) / Platform-managed keys (PMK)

• Customer-managed keys (CMK) / Platform-managed keys (PMK)

  Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.

  Prerequisites: Encryption at rest、Azure Key Vault

  Related: Always Encrypted

• Transparent Data Encryption (TDE)

  Encrypts an Azure SQL database at rest (files and backups) and is on by default. It needs no app changes (transparent) and decrypts on the server during processing, so DBAs and the server can handle plaintext. The protector can switch from the default service-managed key to a CMK (BYOK). TDE protects data at rest; TLS protects in transit.

  Prerequisites: BYOK and infrastructure encryption、Customer-managed keys (CMK) / Platform-managed keys (PMK)、Azure SQL Database、Encryption at rest

• Web Application Firewall (Azure WAF)

  Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.

  Prerequisites: Application Gateway、Region (Azure)、Azure Front Door、Rate limiting

• Load balancing (Load Balancer / Application Gateway / Traffic Manager)

  Azure services distributing traffic to backends. Azure Load Balancer = L4 (TCP/UDP), regional, fast (internal/public, health probes, backend pools). Application Gateway = L7 (HTTP), regional, URL path-based routing, SSL termination, WAF. Front Door = L7, global (edge delivery, WAF/CDN, reverse proxy). Traffic Manager = DNS-based global routing (real traffic goes straight to the backend). Decide by L4 vs L7 and regional vs global.

  Prerequisites: Application Gateway、Region (Azure)、Azure Load Balancer、Azure Front Door

• Diagnostic settings

  Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.

  Prerequisites: Subscription (Azure)、Azure storage account、Log Analytics workspace

• Bicep

  A DSL offering more concise syntax than ARM template JSON. Running az bicep build compiles it into an equivalent ARM template JSON, which is what actually gets deployed. Modules and loop syntax improve readability and reuse.

  Prerequisites: ARM template、JSON

• Azure Cosmos DB

  A globally distributed, low-latency, auto-scaling managed NoSQL DB supporting multiple APIs (NoSQL/MongoDB/Cassandra/Gremlin/Table).

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

• ExpressRoute FastPath

  An option that, on supported SKUs, bypasses the virtual network gateway in the ExpressRoute data path for lower latency and higher throughput (normally the path traverses the gateway). Certain configurations (e.g., via UDRs or load balancers) are excluded from FastPath support.

  Prerequisites: ExpressRoute、Virtual network (VNet)、ExpressRoute gateway、Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: ExpressRoute Direct

• Azure Front Door

  A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.

• Log Analytics workspace

  A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.

  Prerequisites: Azure Monitor、Microsoft Sentinel

• Managed services (management boundary)

  A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.

• Pull Request (PR)

  A proposal to merge a work branch (compare) into the default branch (base), merged after review and checks.

  Prerequisites: Branch、merge

• Blast radius

  The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.

  Prerequisites: Region (Azure)

• User-defined route (UDR)

  A manual route overriding system routes: define destination prefix → next hop (virtual appliance/gateway/internet/none) and associate the route table with a subnet.

  Prerequisites: Network Watcher tools (IP flow verify, Connection Monitor, next hop)、System routes

  Related: Azure NAT Gateway、Private endpoint

• Version control system (VCS)

  A system that records the history of file changes, enabling revert, tracing who/why, and collaboration.

• VPN gateway SKU and redundancy

  The SKU determining a VPN gateway’s performance/bandwidth/tunnel count; for availability use active/active or zone-redundant configurations.

  Prerequisites: Redundancy (LRS/ZRS/GRS/GZRS)、VPN Gateway、Zone redundancy (Azure SQL)、Performance metrics (IOPS/throughput/bandwidth/latency)

• Authentication methods (MFA / passwordless)

  Means of verifying identity. Methods stronger than passwords alone, such as multifactor authentication (MFA) and passwordless (FIDO2 security keys, Authenticator, Windows Hello).

  Prerequisites: Authentication (AuthN)

• ACR (Azure Container Registry)

  A private registry to store/manage container images; ACR Tasks builds in the cloud, and authentication uses a managed identity.

  Prerequisites: Authentication (AuthN)、Container image、Managed identity

  Related: Azure Container Apps

• Azure App Configuration

  A service to centrally manage app settings and feature flags; centralizes config, references Key Vault for secrets, and enables progressive rollout via flags.

  Prerequisites: App Service configuration (settings, TLS, connections)、Azure Key Vault

  Related: Feature flags

• App Service configuration (settings, TLS, connections)

  Configure app settings/connection strings (injected as env vars), custom-domain TLS/certs, and service connections; secrets can use Key Vault references.

  Prerequisites: Azure App Service、Service connection、Azure Key Vault

• Application Gateway

  A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.

  Prerequisites: Region (Azure)

• ARM template

  The foundational JSON format for declaratively describing Azure resource configuration as IaC. Deploying the same template repeatedly converges to the same state (idempotent), with parameter files swapping per-environment values. Deployments are incremental (default) or complete mode—complete mode deletes resources not present in the template, a common gotcha.

  Prerequisites: JSON

• Azure Arc

  Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).

  Prerequisites: Role-based access control (RBAC)、Tags (Azure)

• Azure Functions

  The flagship serverless (FaaS): event-driven function execution billed only for what runs.

• Redundancy (LRS/ZRS/GRS/GZRS)

  Resilience set by number/scope of copies: LRS<ZRS<GRS<GZRS; GRS/GZRS replicate to another region.

  Prerequisites: Region (Azure)、Fault tolerance

• Region pair

  A pair of distant regions within the same geography—used for broad-disaster redundancy, sequential updates, and as the GRS replication target. Note newer regions (since 2024) may have no pair, in which case availability zones (zone redundancy) are used instead.

  Prerequisites: Availability zone、Redundancy (LRS/ZRS/GRS/GZRS)、Region (Azure)、Zone redundancy (Azure SQL)

• Tags (Azure)

  key=value labels on resources for cost reporting/organization and governance with Policy.

• BCDR design (backup/disaster recovery)

  Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.

  Prerequisites: Region (Azure)、Azure Backup、Azure Site Recovery (ASR)、Zone redundancy (Azure SQL)

• Azure Logic Apps

  A service that integrates workflows with no-code/low-code using many connectors. It links SaaS, on-prem, and Azure services via triggers/actions to automate business processes and connect systems.

  Prerequisites: GitHub Actions

• IaC tools (Terraform / Helm)

  Beyond Bicep/ARM, pipelines apply multi-cloud Terraform (declarative, state management) and Kubernetes Helm charts to codify infrastructure and app configuration.

  Prerequisites: Bicep

• Defender for Cloud DevOps security

  Connects GitHub, Azure DevOps, and GitLab to Defender for Cloud to detect misconfigurations, exposed secrets, and vulnerabilities in code and pipelines.

  Prerequisites: Microsoft Defender for Cloud、GitHub

• Key rotation and backup

  Periodically auto-rotates Key Vault keys/secrets/certificates to reduce leak risk, and uses backup/restore to guard against accidental deletion or failure.

  Prerequisites: Azure Key Vault、Key Vault objects (keys/secrets/certificates, dev)

• Azure Load Balancer

  A fast regional L4 (TCP/UDP) load balancer; configure public/internal, health probes, and backend pools.

  Prerequisites: Region (Azure)

• Azure storage account

  A container bundling Blob, File, Table, and Queue storage services.

  Prerequisites: Blob storage、Queue storage

• Log Replay Service (LRS)

  For SQL Managed Instance migrations, continuously restores/applies backups from Blob to enable an online migration with a manual cutover.

  Prerequisites: Blob storage、Online vs offline migration、SQL Managed Instance

• Query Store

  Retains query text, execution plans, and runtime statistics as history. It underpins regression detection and plan forcing.

  Prerequisites: Automatic tuning (plan forcing)、Execution plan

• Read scale-out

  On Business Critical / Hyperscale, routes read workloads to read-only secondary replicas to offload the primary. Used via ApplicationIntent=ReadOnly in the connection string.

  Prerequisites: Resource lock、Hyperscale tier and page servers

  Related: Business Critical tier

• SQL authentication

  Traditional authentication where the username/password are managed within SQL. A fallback when Entra auth is unavailable, requiring strong passwords and least privilege.

  Prerequisites: Authentication (AuthN)

  Related: Microsoft Entra authentication for Azure SQL

• Encryption at rest

  Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.

• Azure Event Grid

  Reactive pub/sub delivering discrete events (e.g., "blob created"); subscribe via event subscriptions and react in near real time.

  Prerequisites: Blob storage、Subscription (Azure)

• Forced tunneling and gateway transit

  Forced tunneling routes outbound internet via on-prem with a UDR; gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway.

  Prerequisites: ExpressRoute、ExpressRoute gateway

• JSON

  A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.

• Loose coupling (decoupling)

  A design that separates components via queues (SQS), notifications (SNS), or events (EventBridge) instead of direct calls—so failures/load on one side don’t cascade, and parts scale and deploy independently while buffering spikes.

• Azure NAT Gateway

  Outbound-only NAT for a subnet; provides stable egress and avoids SNAT port exhaustion (does not provide inbound).

  Prerequisites: Outbound rules and SNAT (Load Balancer)

  Related: Private endpoint、User-defined route (UDR)

• Point-to-site VPN (P2S)

  Connects individual client devices to an Azure VNet; choose a tunnel type and authentication (certificate, RADIUS, Microsoft Entra ID) and distribute a VPN client configuration.

  Prerequisites: Authentication (AuthN)、Microsoft Entra ID、Virtual network (VNet)、VPN Gateway

• Rate limiting

  Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.

• Port number

  A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.

  Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、HTTPS

  Related: UDP

• Private DNS zone

  A DNS zone valid only inside VNets; link it to a VNet to resolve internal or privatelink names to private IPs—key to operating private endpoints.

  Prerequisites: Virtual network (VNet)、Private endpoint

• rebase

  Replaying your commits onto the target branch tip to linearize history; careful when shared.

  Prerequisites: Branch、Commit

• Site-to-site VPN (S2S)

  Connects an on-prem site to an Azure VNet over a persistent IPsec tunnel; configure a VPN gateway and an on-prem local network gateway.

  Prerequisites: Virtual network (VNet)、VPN Gateway

• Database user

  A database-level security principal in SQL Server (and Azure SQL), mapped to a login, whose role memberships and GRANT/DENY/REVOKE determine authorization to objects. DENY is a T-SQL-specific permission state unique to SQL Server—PostgreSQL and MySQL have no equivalent. Contrasted with a contained user, which is created without a login.

  Prerequisites: Authorization (AuthZ)、Permissions (GRANT/DENY/REVOKE, least privilege)、SQL login

  Related: Contained database user

• Workload identity federation

  A general-purpose mechanism where a cloud provider validates an OIDC (or similar) token issued by an external identity provider via a configured trust relationship, then exchanges it for short-lived credentials—granting access without any long-lived secret or password. Azure DevOps service connections, GitHub Actions, GCP, and AWS's OIDC federation all implement equivalent versions of this pattern. In Azure specifically, the exchange yields a token for a role-assigned service principal or managed identity, which is mechanically different from AWS's 'assume role' terminology.

  Prerequisites: GitHub Actions、Service connection、GitHub、Managed identity

• Application Insights

  An APM service for apps; collects requests, dependencies, exceptions, metrics, logs, and traces to analyze performance and failures. Part of Azure Monitor.

  Prerequisites: Azure Monitor

• Access tiers (Hot/Cool/Cold/Archive)

  Blob tiers optimizing storage cost by access frequency; lower tiers cost less to store but are slower/costlier to retrieve.

  Prerequisites: Blob storage

• Azure Policy

  Defines/enforces rules (allowed regions, required tags, etc.) that resources must meet and evaluates compliance.

  Prerequisites: Region (Azure)、Tags (Azure)

• Virtual machine scale sets (VMSS)

  A set of identical VMs that autoscales with load (the performance axis; availability is via sets/zones).

  Prerequisites: Azure Virtual Machines (VM)、Availability set (fault/update domains)

• VPN Gateway

  Connects on-premises over an encrypted tunnel across the internet.

• Hybrid identity (Entra Connect)

  Syncs on-prem Active Directory with Entra ID for hybrid identity. Choose authentication among password hash sync, pass-through authentication, and federation (AD FS).

  Prerequisites: Authentication methods (MFA / passwordless)、Authentication (AuthN)、Microsoft Entra ID

• Storage account kinds and performance

  General-purpose v2 (GPv2) is the standard handling Blob/File/Queue/Table. Performance is Standard (HDD) or Premium (SSD, low latency); Premium splits into BlockBlob/FileShare/Page kinds.

  Prerequisites: Blob storage、Azure storage account、Performance metrics (IOPS/throughput/bandwidth/latency)

• Azure Data Lake Storage Gen2

  A data lake for large-scale analytics that adds a hierarchical namespace on top of Blob storage. With directory structure and POSIX-like ACLs, it serves as the storage layer for Synapse/Databricks analytics.

  Prerequisites: Blob storage、Azure Databricks、Azure Synapse Analytics

• Hub-spoke network topology

  A design that centralizes shared services (firewall, gateway, DNS) in a hub VNet with spoke VNets connected by peering; can also be realized in a managed way via Virtual WAN.

  Prerequisites: Virtual network (VNet)、Azure Virtual WAN

• Azure landing zone (CAF)

  A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.

  Prerequisites: Management group、Hub-spoke network topology

  Related: Azure landing zone

• Azure Artifacts

  A service centralizing dependency packages (npm/NuGet/Maven/Python) in feeds. It proxies and caches upstream sources (public repos), unifying internal and public packages behind one endpoint.

  Prerequisites: Repository

• Azure Boards

  An agile work-tracking service. Decompose work items as Epic → Feature → Story/PBI → Task, prioritize in a backlog, plan in sprints (iterations), and visualize state on a Kanban board with WIP limits. Link work items to commits/PRs/builds for traceability.

  Prerequisites: Commit

• Feature flags

  A mechanism that decouples deployment (placing code in prod) from feature enablement (release). Managed via Azure App Configuration Feature Manager, etc., enabling staged rollout, A/B testing, and instant disable (kill-switch) without redeploy.

  Related: Azure App Configuration

• Security testing (SAST/DAST/SCA)

  Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).

  Prerequisites: Container image

• Variable groups and Key Vault integration

  Variable groups bundle settings shared across pipelines, with secrets retrieved securely via Azure Key Vault integration; secure files handle certificates, etc.

  Prerequisites: Azure Key Vault

• AKS security

  Secures Kubernetes workloads via AKS network isolation (private clusters, network policies), Entra-integrated authentication/authorization, and monitoring with Defender for Containers.

  Prerequisites: Authentication (AuthN)、Authorization (AuthZ)、Defender for Containers

• Just-In-Time (JIT) VM access

  A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.

  Prerequisites: Microsoft Defender for Cloud

  Related: Azure Bastion

• Azure landing zone

  A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.

  Prerequisites: Management group、Subscription (Azure)

  Related: Azure landing zone (CAF)

• AzCopy

  A command-line tool for fast bulk copy/upload/download to and from Blob storage/file shares. Supports parallel transfer and resumable checkpoints, better suited to scripting/automation than the GUI Storage Explorer. Authenticates via Microsoft Entra ID or a SAS token.

  Prerequisites: Blob storage、Microsoft Entra ID

  Related: Azure Storage Explorer

• Azure Backup

  A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.

  Prerequisites: Managed services (management boundary)

  Related: Azure Site Recovery (ASR)

• Azure Database for MySQL

  A managed relational service for the open-source MySQL engine. The current offering is the Flexible Server, supporting same-zone placement for latency optimization and flexible compute/storage scaling; Azure handles patching, backups, and failover.

  Prerequisites: Availability zone、Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Azure Database for PostgreSQL

• Azure Firewall

  A managed, stateful network firewall for centralized traffic control.

• Azure Site Recovery (ASR)

  A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.

  Prerequisites: Region (Azure)

  Related: Azure Backup

• Merge conflict

  A conflict when the same spot is changed differently; resolve manually before completing the merge.

  Prerequisites: merge

• Container image

  An immutable package of an app and its dependencies; built from a Dockerfile, pushed to a registry (ACR), and run by services.

• Azure DNS Private Resolver

  A managed service brokering DNS resolution between on-prem and Azure; conditional forwarders route specific domains to the right DNS.

  Prerequisites: Azure DNS (public zones)、Managed services (management boundary)

• Automatic tuning (plan forcing)

  Azure SQL automatically creates recommended indexes and applies FORCE LAST GOOD PLAN (forcing the last known good plan) on regressions.

  Prerequisites: Index

• Azure Automation (runbooks)

  A service automating cross-cloud/on-prem operations via PowerShell/Python runbooks. Hybrid Workers enable on-prem execution.

• Session blocking

  When one session waits on locks held by another. Identify long blocks and deadlock signs via DMVs and resolve via queries, indexes, or isolation levels.

  Prerequisites: Index

• Business Critical tier

  An Azure SQL service tier delivering low latency and high availability via local SSD and built-in Always On replicas. It includes a secondary for read scale-out.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Read scale-out

• Dynamic management views (DMVs)

  Views that expose live internal server/database state (waits, blocking, index usage, etc.) queryable via SQL.

  Prerequisites: Index、Session blocking

• Elastic pool

  Shares compute resources (eDTUs/vCores) across multiple Azure SQL Databases, optimizing cost for many DBs with offset usage peaks.

  Prerequisites: Azure SQL Database、Purchasing models (vCore / DTU)

• Execution plan

  A diagram of how a query executes. Inspect scan vs seek, key lookups, and non-SARGable predicates to decide index or rewrite improvements.

  Prerequisites: Index

• Database migration (assess, DMS, online/offline)

  Moving from on-prem to Azure SQL. First assess (Data Migration Assistant / Azure Migrate for compatibility, target, SKU sizing), then execute (Azure Database Migration Service or the Azure SQL Migration extension; Log Replay Service for MI). Choose offline (bulk copy, downtime) or online (continuous sync with a final cutover, minimal downtime). After migrating, adjust the compatibility level and check regressions via Query Store. Pick the target by need for instance features, OS control, and tolerable downtime.

  Prerequisites: Log Replay Service (LRS)、Online vs offline migration、Query Store

• Deployment strategies (blue/green, canary)

  Ways to release a new version: all-at-once (downtime risk), rolling (batch updates), blue/green (switch to a new env, easy rollback), canary (ramp from a small slice). Choose by the speed-vs-safety trade-off.

• B2C (Azure AD B2C)

  CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.

  Prerequisites: Microsoft Entra ID、Access management (RBAC / least privilege / JIT)、SQL login

• ExpressRoute Direct

  An ExpressRoute form that connects directly to Microsoft's edge routers over dedicated 10 Gbps or 100 Gbps port pairs, without going through a connectivity provider. Multiple ExpressRoute circuits can be carved out of one physical connection, suited to workloads needing very high bandwidth and low latency.

  Prerequisites: ExpressRoute、Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: ExpressRoute FastPath

• Azure Functions hosting plans

  Choosing billing/performance for the runtime: Flex Consumption (current default—fast scale, VNet, always-ready instances), the older Consumption (auto-scale, cold starts), Premium (pre-warmed, VNet), and Dedicated (App Service plan).

  Prerequisites: Azure App Service、Azure Functions、Virtual network (VNet)

• Git

  The most popular distributed version control tool; each person keeps a full local copy of the history.

  Prerequisites: Version control system (VCS)

• GitHub Packages

  Hosts packages (npm, Maven, NuGet, RubyGems, and containers via GitHub Container Registry / GHCR) close to the repo; permissions integrate with GitHub auth and Actions can publish/consume them.

  Prerequisites: GitHub Actions、GitHub、Repository

• Infrastructure as Code (IaC)

  Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.

  Prerequisites: Version control system (VCS)

• Key Vault objects (keys/secrets/certificates, dev)

  Securely fetching and using secrets, keys, and certificates from code; avoid hard-coding (e.g., connection strings)—use Key Vault references or managed identity.

  Prerequisites: Azure Key Vault、Managed identity

• Outbound rules and SNAT (Load Balancer)

  Translates (SNATs) the source address of outbound traffic from backend-pool VMs to the Load Balancer's frontend IP, enabling outbound connectivity for VMs without a public IP. Outbound rules control port allocation—watch for SNAT port exhaustion under heavy outbound load.

  Related: Inbound NAT rule、Load-balancing rule

• Messages vs events

  A message is a command the sender expects to be handled (Service Bus/Queue); an event is a notification of something that happened (Event Grid/Event Hubs)—a key selection axis.

  Prerequisites: Azure Event Grid、Azure Event Hubs、Azure Service Bus

• Microservices

  An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.

• Multicast

  A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.

  Prerequisites: Virtual network (VNet)、Broadcast、Unicast

• Queue storage

  A message queue to decouple components and smooth processing spikes.

  Prerequisites: Loose coupling (decoupling)

• Fault tolerance

  Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).

  Prerequisites: VPN gateway SKU and redundancy

• Defender CSPM

  Cloud Security Posture Management. Surfaces config weaknesses as recommendations, visualizes connected risk via attack path analysis, and finds hard-coded secrets via secret scanning—proactive posture, a separate pillar from runtime threat detection (CWP).

  Prerequisites: Secret scanning

• Defender for Key Vault

  A threat-protection plan that detects anomalous access patterns to a Key Vault (unusual locations, bulk retrieval) at runtime. Distinct from Defender CSPM secret scanning, which proactively finds hard-coded secrets.

  Prerequisites: Azure Key Vault、Defender CSPM、Secret scanning

• Defender for Servers

  Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.

  Prerequisites: Azure Arc、Just-In-Time (JIT) VM access

• Access management (RBAC / least privilege / JIT)

  Role-based access control (RBAC) grants permissions by job function, applies least privilege, and PIM just-in-time (JIT) elevation enables privileges only when needed.

  Prerequisites: Role-based access control (RBAC)

• Secret scanning

  Detects API keys/tokens in commits/pushes; push protection blocks leaks up front.

  Prerequisites: Commit

• Secured Virtual Hub

  A virtual hub with Azure Firewall embedded, centrally applying policy across hubs via Firewall Manager to inspect traffic centrally.

  Prerequisites: Azure Firewall、Virtual hub (Virtual WAN)

• Microsoft Sentinel

  A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.

• Azure Service Bus

  An enterprise message broker supporting ordering, transactions, dedup, and dead-lettering; used for reliable command delivery.

• SLA (service level agreement)

  A contract defining guaranteed uptime; if missed, you may be eligible for service credits (partial refunds).

• SQL Managed Instance

  A PaaS with near-full SQL Server compatibility; good for migrating existing SQL Server (lift-and-shift).

• Error budget

  The allowable amount of failure (1 − SLO) derived from an SLO. Teams ship aggressive changes while budget remains and prioritize stabilization once it's exhausted—a shared language for release decisions. Blameless postmortems examine what consumed the budget and feed lessons back into prevention.

  Related: SLI (service level indicator)

• SLI (service level indicator)

  A measured metric used in Site Reliability Engineering (SRE) to quantify reliability—success rate, latency, availability, etc., tied directly to user experience. It's continuously measured and compared against an SLO target to judge whether reliability goals are met.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Error budget、SLO (service level objective)

• System routes

  Default routes Azure auto-provides for intra-VNet, peering, gateways, and default internet; can be overridden by UDRs.

  Prerequisites: Virtual network (VNet)

• TLS

  A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.

  Prerequisites: Authentication (AuthN)、Managed services (management boundary)

  Related: HTTPS

• Virtual hub (Virtual WAN)

  The managed hub at the core of Virtual WAN; hosts VPN/ExpressRoute/P2S gateways and connections, transiting spokes via hub routing.

  Prerequisites: ExpressRoute

  Related: Azure Virtual WAN

• VNet peering

  Connects two VNets over the Microsoft backbone with low latency; non-transitive by default (A-B-C does not give A↔C), so hub transit needs UDRs or gateway transit.

  Prerequisites: Virtual network (VNet)、Forced tunneling and gateway transit、Performance metrics (IOPS/throughput/bandwidth/latency)

• WAF policy and detection/prevention modes

  A Web Application Firewall config associated with Application Gateway or Front Door; choose detection mode (log only) or prevention mode (block), using OWASP rule sets to stop common attacks.

  Prerequisites: Application Gateway、Web Application Firewall (Azure WAF)、Azure Front Door

• Anycast

  A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Unicast

• Developer portal (APIM)

  An auto-generated portal for API consumers offering documentation, try-it, and subscription sign-up.

  Prerequisites: Subscription (Azure)

  Related: Azure API Management (APIM)

• Named values (APIM)

  Centralizes constants/secrets used in policies; secrets are referenced securely via Key Vault integration.

  Prerequisites: Azure Key Vault

  Related: Azure API Management (APIM)

• API Management policies

  XML rules controlling API behavior (inbound/backend/outbound/on-error); apply auth (validate-jwt), rate limiting, transformation, caching, and CORS.

  Prerequisites: Rate limiting

  Related: Azure API Management (APIM)

• Products and subscriptions (APIM)

  Bundles APIs as "products" that consumers use via subscriptions (keys); manages exposure and terms per product.

  Prerequisites: Subscription (Azure)

  Related: Azure API Management (APIM)

• Diagnostics and logging (App Service)

  Collecting app/web-server/detailed-error logs and viewing the live log stream; integrates with App Insights for monitoring.

  Prerequisites: Azure App Service

• Resource lock

  A safety net preventing deletion or change (CanNotDelete / ReadOnly), stopping mistakes even by authorized users.

• Azure Virtual Machines (VM)

  IaaS virtual machines; the most flexible compute where you manage the OS and above.

• Availability set (fault/update domains)

  Spreads VMs within one datacenter across fault domains (power/network/rack) and update domains (planned-maintenance units) to avoid simultaneous impact from unplanned failures and planned maintenance. Use availability zones for datacenter-level failures.

  Prerequisites: Availability zone

• Blob protection (soft delete, versioning, object replication)

  Blob/container soft delete recovers from accidental deletion, versioning keeps history, and object replication asynchronously copies to another account.

  Prerequisites: Blob storage、Version control system (VCS)

• Scale set autoscaling

  Automatically scales a virtual machine scale set’s instance count by metrics (e.g., CPU) or schedule, with scale-in/out rules and min/max bounds.

  Prerequisites: Azure Virtual Machines (VM)、Virtual machine scale sets (VMSS)

• YAML pipelines and templates

  Defines pipelines as code (YAML) with stages, jobs, and steps. Templates reuse common logic, and multi-stage pipelines combine CI and CD to multiple environments in one definition.

  Prerequisites: Azure Pipelines、YAML

• App Service Environment (ASE)

  A dedicated, isolated App Service environment integrated into a virtual network, used for sensitive workloads needing network isolation and high scale.

  Prerequisites: Azure App Service、Virtual network (VNet)

• Azure Bastion

  A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.

  Prerequisites: Azure portal and Marketplace

  Related: Just-In-Time (JIT) VM access

• BYOK and infrastructure encryption

  BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.

  Prerequisites: Customer-managed keys (CMK) / Platform-managed keys (PMK)

• Custom roles (Azure / Entra roles)

  When built-in roles lack granularity, define custom roles that allow only the needed actions. Azure resource roles and Microsoft Entra roles are managed as separate systems.

  Prerequisites: GitHub Actions

• Blob versioning

  A Blob storage protection that automatically keeps prior versions on each overwrite/delete to enable recovery from mistakes, used with soft delete and immutable storage.

  Prerequisites: Blob storage、Version control system (VCS)

• Workflow automation (Defender for Cloud)

  Triggers Logic Apps on security alerts or recommendations to automate responses like notifications, ticketing, and remediation.

  Prerequisites: Microsoft Defender for Cloud、Azure Logic Apps

• BGP and route propagation

  The standard protocol for dynamically exchanging routes between on-prem and the Azure gateway. Peers are identified by ASN; the Azure gateway’s default ASN is 65515 and on-prem sets its own. Enabling BGP on a VPN auto-learns on-prem subnet changes, removing UDR edits. ExpressRoute always exchanges routes via BGP (private/Microsoft peering). Reflecting learned routes into the VNet is route propagation; disabling it on a route table lets UDRs reliably win. With multiple routes to the same destination, ExpressRoute is preferred over VPN (basis for backup-VPN designs). Precedence: longest-prefix match, then UDR > BGP > system.

  Prerequisites: ExpressRoute、Virtual network (VNet)

• Azure CDN

  Caches static content at edge for low-latency delivery. The Microsoft standard profile is current; legacy Verizon/Edgio profiles are being retired. New workloads are recommended to use Azure Front Door (with integrated CDN). Updates apply via purge.

  Prerequisites: Azure Front Door、Performance metrics (IOPS/throughput/bandwidth/latency)

• Azure Database for PostgreSQL

  A managed relational service for the open-source PostgreSQL engine. The current offering is the Flexible Server, supporting availability-zone placement, burstable SKUs, and fine-grained maintenance windows; Azure handles patching, backups, and failover.

  Prerequisites: Availability zone

  Related: Azure Database for MySQL

• Azure Storage Explorer

  A standalone GUI app (Windows/macOS/Linux) to browse, upload, and manage Blob storage, file shares, queues, and tables. Suited to inspecting small amounts of data, manual operations, and quick permission tweaks; use AzCopy for high-speed bulk transfer.

  Prerequisites: Blob storage

  Related: AzCopy

• Blob access tiers

  Cost-optimization tiers by access frequency: hot (frequent), cool (infrequent), cold, and archive (rarely accessed, slow to rehydrate).

  Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

• Blob lifecycle management

  Policies that auto-move blobs across access tiers (hot→cool→archive) or delete them after N days; optimizes storage cost.

  Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

• Branch protection rule

  A setting that enforces required reviews/checks/conversation resolution and can block direct pushes before merge.

  Prerequisites: Branch、merge

• GitHub Codespaces

  On-demand cloud dev environments usable from a browser/editor; define the env as code with devcontainer.json.

  Prerequisites: GitHub、JSON

• Connection Monitor

  A Network Watcher feature that continuously monitors reachability, latency, and packet loss between endpoints, detecting route changes and failures.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

• Azure Container Apps

  A serverless platform to run containers/microservices without managing Kubernetes; KEDA-based event-driven scaling (scale to zero) and Dapr integration.

  Prerequisites: Microservices

  Related: ACR (Azure Container Registry)

• Cross-region Load Balancer

  Bundles regional Load Balancers behind one global IP for geo-redundancy and low-latency routing.

  Prerequisites: Region (Azure)、Performance metrics (IOPS/throughput/bandwidth/latency)

• Active geo-replication

  A DR feature asynchronously creating a readable secondary in another region. It supports manual failover and up to four secondaries.

  Prerequisites: Region (Azure)

• Elastic Jobs

  Automation for Azure SQL Database. Uses a job agent and job DB to run T-SQL in parallel across DBs via target groups.

  Prerequisites: Azure SQL Database

• Failover groups

  A DR feature connecting a group of DBs via listeners and failing them over automatically without changing the connection string.

• Geo-restore

  A DR option restoring from GRS geo-redundant backups to another region. Because the copy is asynchronous, RPO is larger.

  Prerequisites: Region (Azure)

• Hyperscale tier and page servers

  An Azure SQL service tier scaling to ~100TB. Page servers separate storage to enable snapshot-based fast backup/restore and rapid scaling.

• Intelligent query processing (IQP)

  A set of features that improve query performance without rewrites (adaptive joins, memory-grant feedback, batch mode, etc.), enabled via compatibility level.

  Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

• Online vs offline migration

  Offline is a bulk copy with downtime; online continuously syncs changes with a final cutover for minimal downtime. Choose by tolerable downtime.

• SQL auditing (server/database)

  Records database events to Log Analytics, Storage, or Event Hubs. Server audit applies to all DBs; database audit applies individually.

  Prerequisites: Azure Event Hubs

• Purchasing models (vCore / DTU)

  vCore is a flexible model where you size CPU, memory, and storage separately, with Azure Hybrid Benefit and reserved discounts (recommended). DTU is a simple blended metric of compute and storage.

  Related: Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

• Encryption in transit

  Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.

  Prerequisites: Encryption at rest

• ExpressRoute peering (private/Microsoft)

  ExpressRoute peering types: private peering reaches VNets; Microsoft peering reaches public Microsoft 365/PaaS over the private circuit. Always exchanged via BGP.

  Prerequisites: ExpressRoute、Virtual network (VNet)

• Eventual consistency

  A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Strong consistency

• Azure Functions triggers

  What starts a function—HTTP (request), timer (schedule), Blob/Queue/Event (data ops), webhooks; one trigger per function.

  Prerequisites: Blob storage、Azure Functions

• Horizontal scaling (scale out)

  Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.

  Prerequisites: Fault tolerance

• HTTPS

  HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.

  Related: TLS

• Inbound NAT rule

  A Load Balancer rule that forwards traffic on a specific frontend port to a specific port on one VM in the backend pool—pinpoint forwarding, unlike a load-balancing rule's distribution across many backends. Commonly used to expose RDP/SSH to individual VMs.

  Prerequisites: Load-balancing rule

  Related: Outbound rules and SNAT (Load Balancer)

• Load-balancing rule

  A rule that distributes inbound traffic received on a Load Balancer frontend IP/port across a backend pool, based on health-probe results. The default is 5-tuple hash distribution, with session persistence (source-IP affinity) configurable.

  Related: Outbound rules and SNAT (Load Balancer)

• Broadcast

  A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.

  Prerequisites: Virtual network (VNet)

• CIDR notation

  A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.

  Prerequisites: Virtual network (VNet)

• Ephemeral port

  A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.

  Prerequisites: Port number

• Private Link and DNS integration

  Points the PaaS public FQDN via CNAME to a privatelink zone and resolves it to the private IP through the private DNS zone’s A record; forgetting this resolves to the public IP—a common incident.

  Prerequisites: Private DNS zone

  Related: Azure Private Link / Private Link Service

• Azure Route Server

  A managed service that exchanges routes via BGP between an NVA and Azure, reflecting NVA routes into the VNet without manual UDR updates.

  Prerequisites: Virtual network (VNet)、Managed services (management boundary)

• Runner

  The environment that runs Actions jobs; GitHub-hosted or self-hosted.

  Prerequisites: GitHub

  Related: GitHub Actions

• AI Gateway (API Management)

  Placed in Azure API Management to centrally authenticate, rate-limit, monitor, and manage token consumption for Microsoft Foundry model access, hiding backend keys. Distinct from Foundry guardrails (model/agent-side safety filters).

  Prerequisites: Azure API Management (APIM)、Rate limiting

• Azure Virtual Network Manager

  Groups many VNets as network groups and centrally applies connectivity and security admin rules. Security admin rules are higher-priority rules evaluated before NSGs, enforcing org-wide guardrails teams cannot override.

  Prerequisites: Virtual network (VNet)

  Related: Azure Virtual Network Manager

• Cloud Workload Protection (CWP)

  Enables per-resource-type Defender plans (Servers, Storage, Databases, Containers, Key Vault, AI) to detect runtime threats—the runtime pillar paired with Defender CSPM (proactive posture).

  Prerequisites: Azure Key Vault、Defender CSPM

• Data collection rules (DCR)

  Rules in Microsoft Sentinel/Azure Monitor defining what is collected from which sources. Used to collect Windows Security events; many servers can be aggregated first via Windows Event Forwarding (WEF).

  Prerequisites: Azure Monitor、Microsoft Sentinel

• Defender for Databases

  Provides threat protection across Azure database services, detecting suspected SQL injection, anomalous logins, and unusual sensitive-data access (formerly Advanced Threat Protection). Distinct from SQL auditing, which records.

  Prerequisites: SQL auditing (server/database)、SQL login

• Microsoft Entra Agent ID

  Gives autonomous AI agents an identity and governs their access with conditional access. Analyze the compromise blast radius in Defender XDR and minimize/revoke access.

  Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、Blast radius

• Topics and subscriptions (Service Bus)

  Pub/sub that fans one message to multiple receivers; each subscription can filter which messages it receives.

  Prerequisites: Subscription (Azure)、Azure Service Bus

• Service chaining (via NVA)

  Sets the UDR next hop to an NVA (network virtual appliance/firewall) to force traffic through it; enable IP forwarding on the NVA and front it with an internal Load Balancer for redundancy.

  Prerequisites: Azure Load Balancer

• SLO (service level objective)

  The target value an organization sets for an SLI (e.g., 99.9% availability). Usually set more conservatively than the contractual SLA (service level agreement), and the risk of falling short is tracked via how much of the error budget has been consumed.

  Prerequisites: Error budget

  Related: SLI (service level indicator)

• Strong consistency

  A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Eventual consistency

• UDP

  A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

  Related: Port number

• Unicast

  The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.

  Related: Anycast

• Vertical scaling (scale up)

  Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.

  Prerequisites: Horizontal scaling (scale out)、Single point of failure (SPOF)

• Virtual network flow logs

  Logs allowed/denied traffic to Storage (successor to NSG flow logs); visualized via Traffic Analytics to analyze traffic patterns and anomalies.

  Prerequisites: Virtual network (VNet)

• Azure Virtual Network Manager

  Centrally manages connectivity (mesh/hub-and-spoke) and security rules across many VNets, applying config to network groups at once.

  Prerequisites: Virtual network (VNet)

  Related: Azure Virtual Network Manager

• Data classification (SITs / trainable classifiers)

  Data classification identifies content using sensitive information types (patterns like credit cards or national IDs) and trainable classifiers. It informs where to apply sensitivity labels and DLP.

  Related: SQL data classification

• Distributed tracing and Application Map

  Tracks a request across services via correlation IDs and visualizes dependencies/latency on the Application Map.

  Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)

• App Service autoscaling

  Adjusts instance count to follow load. Choose rule-based Autoscale (scale on metrics like CPU/memory or schedules) or platform-managed automatic scaling. Balances cost and performance.

  Prerequisites: Azure App Service

• Deploying to App Service

  Ways to deploy code or containers to App Service (ZIP deploy, container deploy, CI/CD); combine with slots for zero downtime.

  Prerequisites: Azure App Service

• Sidecar pattern

  Running an auxiliary container (log shipping, proxy, security) alongside the main container in the same task/Pod—adding cross-cutting concerns without changing the app. A service mesh (Envoy proxy) is a prime example.

  Prerequisites: Log shipping

• Azure Advisor

  Recommends improvements for your resources across cost, security, reliability, performance, and operations.

• Network security group (NSG)

  Applies allow/deny rules by source/destination/port at the subnet or NIC level.

  Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

• Azure Service Health

  Notifies you of Azure-side incidents, planned maintenance, and health (distinct from Advisor, which advises on your resources).

  Prerequisites: Azure Advisor

• Azure File Sync

  A service that syncs on-prem Windows file servers with Azure Files. Cloud tiering moves infrequently accessed files to the cloud to save local capacity.

  Prerequisites: Azure Files (File storage)

• Self-service password reset (SSPR)

  An Entra feature letting users reset passwords without an admin, requiring multiple authentication methods and supporting password writeback to on-prem.

  Prerequisites: Authentication (AuthN)

• VM extensions and custom script

  Mechanisms to add configuration/automation to a VM. The Custom Script Extension runs scripts at boot, and DSC and the Azure Monitor Agent are also deployed as extensions.

  Prerequisites: Azure Monitor

• Defender Vulnerability Management

  Continuously detects known vulnerabilities (CVEs) on VMs and containers, with prioritization and remediation guidance, built into Defender for Servers/Containers.

  Prerequisites: Defender for Servers

• Encryption over ExpressRoute

  Ways to encrypt traffic over the private ExpressRoute circuit: MACsec on the link itself, or an IPsec VPN layered over ExpressRoute.

  Prerequisites: ExpressRoute

• Microsoft Cloud Security Benchmark (MCSB)

  Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.

  Prerequisites: Microsoft Defender for Cloud

• Regulatory compliance (standards / custom)

  Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.

  Prerequisites: Microsoft Defender for Cloud

• SLA and composite SLA

  A service level agreement (SLA) is an uptime commitment. Combining services in series makes the composite SLA the product of each, lowering overall availability—offset with redundancy.

  Prerequisites: SLA (service level agreement)

• Azure portal and Marketplace

  The Azure portal is a web console to manage resources via GUI. Azure Marketplace lets you buy and deploy Microsoft/third-party solutions. A mobile app also monitors/operates resources.

• Azure support plans

  Choose among Basic (free, billing/subscription), Developer (trial), Standard (production), and Professional Direct (business-critical), differing in response time and architecture guidance.

  Prerequisites: Subscription (Azure)

• Azure Databricks

  An Apache Spark-optimized platform for big-data processing and ML; strong for data science.

• Azure DNS (public zones)

  Hosts a domain’s public DNS records in Azure, providing internet name resolution.

• Azure Files (File storage)

  SMB/NFS file shares mountable from multiple machines simultaneously.

• Azure Firewall rules

  Azure Firewall’s three rule types: DNAT rules translate/forward inbound, network rules control L3-L4 by IP/port/protocol, and application rules control L7 by FQDN.

  Prerequisites: Azure Firewall

• Azure Pricing Calculator

  A web tool that estimates the monthly cost of a planned Azure configuration. Enter region, SKU, usage hours, and data transfer to get a per-service cost estimate, useful for comparing designs or drafting proposals; actual billing can differ due to FX rates and real usage.

  Prerequisites: Region (Azure)

• Azure Synapse Analytics

  A platform unifying large-scale data warehousing and integrated analytics (SQL, Spark, pipelines). Its capabilities are being integrated into the next-generation Microsoft Fabric, which is recommended for new workloads.

• Bidirectional Forwarding Detection (BFD)

  A protocol that quickly detects failures between adjacent routers; on ExpressRoute it speeds BGP convergence and failover.

  Prerequisites: ExpressRoute

• Blob properties and metadata

  Setting/getting a blob’s system properties (e.g., Content-Type) and user-defined key/value metadata.

  Prerequisites: Blob storage

• Blob operations with the SDK

  Development operations to create/upload/download/list containers and blobs via BlobServiceClient/ContainerClient/BlobClient.

  Prerequisites: Blob storage

• Connection tracking

  How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.

  Prerequisites: Ephemeral port

• Change feed (Cosmos DB)

  A persistent log of creates/updates in order; used for event processing, materialized views, and syncing to other stores (deletes not included by default).

  Prerequisites: Azure Cosmos DB

• Consistency levels (Cosmos DB)

  Five levels trading read consistency against performance/availability: strong → bounded staleness → session (default) → consistent prefix → eventual.

  Prerequisites: Azure Cosmos DB

• Partition key (Cosmos DB)

  The property that distributes data into logical partitions; pick a high-cardinality, evenly distributed value to avoid hot partitions and use RU/s efficiently.

  Prerequisites: Azure Cosmos DB

• Cosmos DB operations with the SDK

  Development operations to create/read/query/update databases/containers/items via CosmosClient; request cost is measured in RUs.

  Prerequisites: Azure Cosmos DB

• Deployment slots

  In App Service, deploy to a separate environment (e.g., staging) and swap after warm-up for zero-downtime releases, with easy rollback.

  Prerequisites: Azure App Service

• Azure Arc-enabled SQL

  Connects on-prem or other-cloud SQL Server to Azure via Azure Arc to centrally manage inventory, assessment, updates, and services like Defender/Purview.

  Prerequisites: Azure Arc

• SQL data classification

  A strategy that labels columns with sensitivity and information types to identify and surface sensitive data, combined with auditing to govern its handling.

  Related: Data classification (SITs / trainable classifiers)

• Dynamic data masking

  Masks sensitive data in query results without changing the stored data. Users with the UNMASK permission see the real values.

• General Purpose tier

  The balanced Azure SQL service tier. It separates compute from remote storage, suiting general-purpose workloads that balance cost and performance.

• Index and statistics maintenance

  Reorganizing/rebuilding fragmented indexes and updating statistics on a schedule to keep performance. Typically scheduled via automation (jobs).

  Prerequisites: Index

• Integrity checks (DBCC CHECKDB)

  A command that checks a database for logical and physical corruption. Run regularly to detect corruption early and, with backups, ensure data integrity.

• Intelligent Insights

  An Azure SQL feature that automatically detects performance problems and emits root causes and recommendations as diagnostic logs.

  Prerequisites: Diagnostics and logging (App Service)

• Log shipping

  A simple, mature DR method that periodically copies and restores transaction-log backups to a standby server.

• Long-term retention (LTR)

  Retains weekly/monthly/yearly backups for up to 10 years, meeting compliance requirements.

• Managed Instance database copy and move

  Native operations to copy (replicate) or move (transfer) a database between SQL Managed Instances, used for instance reorganization or environment separation.

  Prerequisites: SQL Managed Instance

• Row-level security (RLS)

  Restricts which rows each user can see using a security predicate (function). Used for tenant isolation and scoping access by responsibility.

• Serverless compute (Azure SQL)

  An Azure SQL compute tier that auto-scales by usage and auto-pauses when idle to stop per-second billing. It suits intermittent workloads.

• Azure SQL Database in Microsoft Fabric

  Azure SQL Database integrated inside Microsoft Fabric, tightly tied to OneLake mirroring and Fabric’s analytics experience.

  Prerequisites: Azure SQL Database

• Always Encrypted with VBS enclaves

  Always Encrypted using virtualization-based security (VBS) enclaves, enabling server-side operations like range comparisons and pattern matching on still-encrypted data.

  Prerequisites: Always Encrypted

• Wait statistics

  Metrics showing what sessions wait on (I/O, locks, CPU, etc.). They are the starting point for classifying bottlenecks.

• Microsoft Entra ID Protection

  Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.

  Prerequisites: Microsoft Entra ID

• gh CLI

  The official command-line tool to work with Issues, PRs, and repos from the terminal (uses the API).

  Prerequisites: Repository

• Immutable infrastructure

  An operating model that never modifies running servers—instead it rebuilds and replaces them from a new image (AMI/container). It eliminates configuration drift, and rollback is just reverting to the prior version; pairs well with blue/green and Auto Scaling.

  Prerequisites: Deployment strategies (blue/green, canary)

• Principle of least privilege

  A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.

  Prerequisites: Blast radius

• Local network gateway

  An Azure object representing the "on-prem side" of an S2S VPN; registers the on-prem public IP and address space (or BGP settings).

  Prerequisites: Site-to-site VPN (S2S)

• Default route (0.0.0.0/0)

  The catch-all route in a route table for destinations that match no more-specific route. In public subnets it points to an IGW; in private subnets to a NAT gateway—deciding the egress path.

  Prerequisites: Azure NAT Gateway

• NSG security rules

  NSG inbound/outbound rules evaluated by priority; allow/deny by source/destination (IP, ASG, service tag), port, and protocol, with default rules evaluated last.

  Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

• Authorization flows (OAuth2/OIDC)

  Token-acquisition flows: authorization code flow for interactive users, client credentials flow for daemons/service-to-service; choose by scenario.

  Prerequisites: Authorization (AuthZ)

• Packet capture (Network Watcher)

  A Network Watcher feature that captures a VM’s traffic for analysis; used to isolate app-layer issues invisible to NSG checks.

• Single point of failure (SPOF)

  A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.

• Advanced hunting (KQL)

  Uses KQL in Defender XDR / Sentinel to proactively hunt threats across telemetry, turning queries into analytics rules for automated detection.

  Prerequisites: Microsoft Sentinel

• Defender for Containers

  A Defender plan that detects container misconfigurations and runtime risks (suspicious processes, known exploits). Complements image vulnerability scanning and trusted-image allowance in ACR.

• Compliance Manager and compliance score

  Microsoft Purview Compliance Manager visualizes conformance to regulations/standards via improvement actions and a compliance score, helping prioritize risk reduction.

  Prerequisites: GitHub Actions

• Entra ID Governance

  Ensures the right people have the right access to the right resources for the right time. Includes entitlement management (access packages), access reviews, Privileged Identity Management (PIM), and lifecycle workflows.

  Prerequisites: Microsoft Entra ID

• Entra identity types

  Identity types managed by Microsoft Entra: users (member/guest), groups, devices, and workload identities (service principals/managed identities) representing apps and services.

  Prerequisites: Managed identity

• Service endpoint

  Routes subnet-to-PaaS traffic over the Azure backbone and lets the PaaS firewall allow that subnet; assigns no private IP (not reachable from on-prem). Service endpoint policies can restrict destinations.

• Subnet mask

  A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.

  Prerequisites: CIDR notation

• Azure Traffic Manager

  DNS-based global traffic distribution; routing methods (priority/weighted/performance/geographic) decide which IP is returned (real traffic goes straight to the backend).