Instiq

Microsoft Azure Data Fundamentals — knowledge map

The 271 core concepts of Microsoft Azure Data Fundamentals and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.

Concepts (271)

  • Blob storage

    Storage for unstructured data (objects) such as images, video, and backups.

    Prerequisites: Structured data、Unstructured data

  • Virtual network (VNet)

    A private network in Azure; divided by subnets and connected to other VNets via peering.

  • Region (Azure)

    A geographic grouping of one or more datacenters; chosen by latency, data sovereignty, feature availability, and cost.

  • ExpressRoute

    A dedicated private connection that does not use the internet; high reliability, consistent low latency, high bandwidth.

  • Azure SQL authentication/access control and data protection

    Authentication: Microsoft Entra (recommended—centralized, MFA/Conditional Access, passwordless via managed identity) and SQL auth. Distinguish logins (server) from users (DB); contained users are preferred in SQL Database. Authorize via fixed/custom roles and GRANT/DENY/REVOKE (DENY wins) for least privilege. Narrow rows with row-level security (RLS) and columns with column-level permissions. Data protection: dynamic data masking (limits display; UNMASK reveals real values) and auditing (log operations to Log Analytics/Storage). Encryption is TDE/Always Encrypted (separate entries).

    Prerequisites: Always Encrypted、Custom roles (Azure / Entra roles)、Contained database user、Dynamic data masking

  • Azure Key Vault

    Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.

  • Subscription (Azure)

    The billing/usage boundary and a logical container for resources; often split by department or environment.

  • Routing (system routes, service chaining, forced tunneling)

    Azure path control. System routes are auto-provided by Azure for intra-VNet, peering, gateways, and default internet. UDRs (user-defined routes) override them, defining destination prefix → next hop (virtual appliance/gateway/internet/none). Service chaining sets the UDR next hop to an NVA (firewall) to force traffic through it (IP forwarding required on the NVA; for redundancy front it with an internal Load Balancer). Forced tunneling forces outbound internet via on-prem with a UDR. Gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway. Route selection: longest-prefix match, then UDR > BGP > system.

    Prerequisites: ExpressRoute、Virtual network (VNet)、Network Watcher tools (IP flow verify, Connection Monitor, next hop)、Azure Load Balancer

  • Azure SQL Database

    A fully managed relational PaaS; Azure handles patching, backups, availability. Best for new cloud apps.

    Prerequisites: Managed services (management boundary)

  • Index

    A structure that speeds searching on columns; faster reads but added write-time cost.

  • Azure ML jobs and AutoML/sweep (MLflow, hyperparameter tuning)

    Training runs as jobs: command (single script), sweep (hyperparameter search), and pipeline (a DAG of components). Define in YAML (CLI v2)/SDK v2. Tracking uses natively integrated MLflow (log_metric/log_param/log_artifact, autolog) to compare experiments. AutoML auto-searches algorithms/preprocessing from a task and picks via a leaderboard. A sweep tunes hyperparameters with a search space + sampling (grid/random/Bayesian) + early termination (Bandit/median stopping), controlling parallelism/cost via max_concurrent_trials.

    Prerequisites: Azure Machine Learning、Command job、Component (reusable step)、Early termination policy (Bandit/median)

  • Microsoft Fabric (capacity, workspace, experiences)

    A SaaS analytics platform unifying data integration, analytics, and BI. Hierarchy: capacity → workspace → items. Capacity is the compute+billing unit (F SKUs, Power BI Premium P SKUs; consumes capacity units (CU); smoothing/bursting level usage; can pause/resume). A workspace is the collaboration/access unit. Experiences are role-specific (Data Engineering/Data Factory/Data Warehouse/Real-Time Intelligence/Power BI). Defining trait: all experiences share OneLake. It is a unified SaaS, not a bundle of PaaS.

    Prerequisites: Azure Data Factory、Data warehouse、Microsoft Power BI

    Related: OneLake

  • Azure Machine Learning

    Supports the ML workflow (prepare→train→evaluate→deploy→predict); includes Automated ML (auto-best) and Designer (no-code).

  • Azure Synapse Analytics

    A platform unifying large-scale data warehousing and integrated analytics (SQL, Spark, pipelines). Its capabilities are being integrated into the next-generation Microsoft Fabric, which is recommended for new workloads.

    Prerequisites: Microsoft Fabric (capacity, workspace, experiences)

  • Azure Cosmos DB

    A globally distributed, low-latency, auto-scaling managed NoSQL DB supporting multiple APIs (NoSQL/MongoDB/Cassandra/Gremlin/Table).

    Prerequisites: Non-relational (NoSQL)

  • Azure ML compute and data (workspace, cluster, data assets)

    The Azure ML workspace centrally manages ML artifacts (data, models, experiments, endpoints) with associated resources (storage/Key Vault/Application Insights/Container Registry). Compute: a compute instance for dev (personal; stop to save cost) and a compute cluster to scale training (autoscale, 0 nodes when idle, low-priority/Spot VMs). Data: a datastore (connection info to Blob/ADLS) and data assets (reusable, versioned references: uri_file/uri_folder/mltable). Trained models are versioned in the model registry. Environments (conda/Docker) pin dependencies for reproducibility. Interact via Studio/Python SDK v2/CLI v2.

    Prerequisites: Blob storage、Azure Machine Learning、Compute cluster、Compute instance

  • Azure ML deployment (online/batch endpoints, traffic split)

    Inference is served via endpoints. A managed online endpoint = real-time low-latency (Azure manages infra, autoscale); Kubernetes online = existing AKS; batch endpoint = async scoring of large data on a compute cluster. Place multiple deployments under one endpoint and use traffic split for blue/green (gradual rollout, instant rollback). A deployment needs a scoring script (init/run), an environment, and the right instance type/count (MLflow models may need no inference code). Access via managed identity + key/token auth, with private endpoints if needed.

    Prerequisites: Azure Machine Learning、Batch endpoint、Compute cluster、Managed online endpoint

  • Monitoring and optimization (Query Store, DMVs, automatic tuning)

    Measure first to find bottlenecks. Query Store keeps query history, plans, and wait stats for regression detection and plan forcing. DMVs expose live internal state (wait stats, blocking) via SQL. In the execution plan, watch scan vs seek, key lookups, and non-SARGable predicates; improve with indexes (create missing, drop unused, rebuild fragmented) and updated statistics. Azure SQL automatic tuning (auto-apply recommended indexes, FORCE LAST GOOD PLAN) and intelligent query processing help.

    Prerequisites: Index、Automatic tuning (plan forcing)、Session blocking、Dynamic management views (DMVs)

  • Structured data

    Data with a fixed schema of rows and columns; typed, fast to search/aggregate. E.g., relational DB tables.

  • Azure App Service

    PaaS to host web apps and APIs quickly, with no OS management and easy scaling.

  • Azure API Management (APIM)

    An API gateway exposing multiple backend APIs through one front door. Policies (XML; inbound/backend/outbound/on-error) apply auth (validate-jwt), rate limiting, transformation, caching, and CORS. Offer to consumers via products and subscriptions (keys), document in the developer portal, authenticate to backends with a managed identity, and store secrets in named values (Key Vault).

    Prerequisites: Subscription (Azure)、Azure Front Door、Managed identity

    Related: Named values (APIM)、API Management policies、Developer portal (APIM)、Products and subscriptions (APIM)

  • Azure Virtual WAN

    A large-scale networking service centralizing many sites, VNets, and remote users via a managed hub on the Microsoft backbone. It aggregates VPN, ExpressRoute, and VNet connections; the hub transits, so spokes reach each other without the non-transitivity problem. SKUs: Basic (S2S VPN only) and Standard (full: ExpressRoute/P2S/hub-to-hub/Secured Hub). A Secured Virtual Hub embeds Azure Firewall and uses Firewall Manager to centrally apply policy across hubs. Use hand-built hub-and-spoke for small scale, Virtual WAN for large/global.

    Prerequisites: ExpressRoute、Virtual network (VNet)、Azure Firewall、Site-to-site VPN (S2S)

    Related: Virtual hub (Virtual WAN)

  • Data warehouse

    A platform storing shaped, structured data for analytics/aggregation; schema defined on write.

    Prerequisites: Structured data

  • Permissions (GRANT/DENY/REVOKE, least privilege)

    Grant permissions per securable via fixed/custom database roles and GRANT/DENY/REVOKE. DENY takes precedence; apply least privilege to all securables.

  • Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

    Settings that determine Azure SQL performance/availability/cost. Tiers: General Purpose (balanced, remote storage), Business Critical (local SSD, built-in replicas, low latency, read scale-out), Hyperscale (up to ~100TB, page servers separate storage, fast backup/restore). Purchasing: vCore (flexible, Azure Hybrid Benefit, reserved discounts—recommended) vs DTU (simple metric). Compute is provisioned or serverless (auto pause/resume for intermittent loads). Share capacity across many DBs with an elastic pool. Read scale-out is on BC/Hyperscale.

    Prerequisites: Business Critical tier、Elastic pool、General Purpose tier、Hyperscale tier and page servers

    Related: Purchasing models (vCore / DTU)

  • JSON

    A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.

    Prerequisites: Structured data

  • Managed services (management boundary)

    A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.

  • Dashboard (Power BI)

    A single-screen summary collecting key metrics (KPIs) from multiple reports; created/shared in the Power BI service (reports are multi-page, dashboards single-screen).

    Prerequisites: Report (Power BI)

    Related: Microsoft Power BI

  • Private endpoint

    A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.

    Prerequisites: Virtual network (VNet)

    Related: Azure NAT Gateway、User-defined route (UDR)

  • Availability zone

    A physically separated datacenter within a region (independent power/cooling/network); zone redundancy gives high availability.

    Prerequisites: Region (Azure)

    Related: Zone redundancy (Azure SQL)

  • Network Watcher tools (IP flow verify, Connection Monitor, next hop)

    Network Watcher diagnostic tools for visibility and isolation. IP flow verify instantly decides whether a specific source/destination/port is allowed/denied by NSGs (with the matched rule name). Connection Monitor continuously monitors reachability, latency, and packet loss between endpoints. Next hop shows a packet’s actual next hop to isolate UDR mistakes. NSG/VNet flow logs record allowed/denied traffic to Storage, visualized via Traffic Analytics. Also packet capture, connection troubleshoot, and topology. Pick the tool for “is the NSG blocking, or a routing issue?”

    Prerequisites: Virtual network (VNet)、Connection Monitor、Packet capture (Network Watcher)、Virtual network flow logs

  • Azure storage account

    A container bundling Blob, File, Table, and Queue storage services.

    Prerequisites: Blob storage、Queue storage

  • Data lake

    A platform storing large amounts of raw, varied data (structured–unstructured) cheaply; schema on read.

    Prerequisites: Unstructured data

  • Component (reusable step)

    A reusable unit of processing bundling inputs, outputs, code, and environment. Composed as pipeline steps and versioned/shared.

  • Task automation (SQL Server Agent, Elastic Jobs)

    Routine-ops automation depends on the deployment. SQL Server Agent is the job scheduler on VM/Managed Instance (jobs, steps, schedules, operator notifications). Azure SQL Database lacks SQL Agent, so use Elastic Jobs (job agent + job DB; run T-SQL in parallel across DBs via target groups). Azure Automation runbooks (PowerShell/Python, Hybrid Workers) automate cross-cloud/on-prem ops. Schedule statistics updates, index rebuilds, DBCC CHECKDB, and backup verification, and notify on failure.

    Prerequisites: Azure SQL Database、Index、Azure Automation (runbooks)、Elastic Jobs

  • Data protection and HA/DR (backup/restore, HA/DR, PITR, LTR, geo, failover groups)

    Azure SQL takes automated backups (full/differential/log). PITR restores to any point within retention (default 7 days, max 35). LTR retains weekly/monthly/yearly up to 10 years. Geo-restore restores to another region from GRS geo-redundant backups (asynchronous, larger RPO). HA is zone redundancy (in-region, across AZs); DR is active geo-replication (readable secondary in another region) and failover groups (auto-fail-over a group of DBs via listeners without changing the connection string). VM uses Always On availability groups. Design by RPO/RTO; synchronous gives RPO≈0, asynchronous covers distance.

    Prerequisites: Region (Azure)、Active geo-replication、Failover groups、Geo-restore

  • Zone redundancy (Azure SQL)

    An HA configuration spreading replicas across availability zones within a region to tolerate datacenter failure. Available on many service tiers.

    Prerequisites: Region (Azure)

    Related: Availability zone

  • Managed identity

    An identity letting apps access Azure resources securely without managing secrets; a service principal auto-managed by Azure.

  • Report (Power BI)

    Multi-page interactive analysis on one dataset—arrange visuals and explore with filters and drill-down; authored in Power BI Desktop.

    Related: Microsoft Power BI

  • Microsoft Power BI

    A BI tool to visualize/share data as reports (multi-page interactive analysis) and dashboards (single-screen summary).

    Related: Dashboard (Power BI)、Report (Power BI)

  • Access tiers (Hot/Cool/Cold/Archive)

    Blob tiers optimizing storage cost by access frequency; lower tiers cost less to store but are slower/costlier to retrieve.

    Prerequisites: Blob storage

  • Microsoft Defender for Cloud

    Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.

  • Tags (Azure)

    key=value labels on resources for cost reporting/organization and governance with Policy.

  • Messaging/eventing (Service Bus, Event Grid, Event Hubs)

    Loose-coupling options. Service Bus = enterprise messaging (queues/topics; ordering/transactions/dedup/dead-letter). Storage Queue = simple, cheap high-volume queue. Event Grid = reactive pub/sub of discrete events (e.g., "blob created"). Event Hubs = high-volume streaming/telemetry ingestion (high throughput, partitions). Message = command; event = notification.

    Prerequisites: Blob storage、Azure Event Grid、Azure Event Hubs、Queue storage

  • Azure Data Lake Storage Gen2

    A data lake for large-scale analytics that adds a hierarchical namespace on top of Blob storage. With directory structure and POSIX-like ACLs, it serves as the storage layer for Synapse/Databricks analytics.

    Prerequisites: Blob storage、Azure Databricks、Azure Synapse Analytics、Data lake

  • Load balancing (Load Balancer / Application Gateway / Traffic Manager)

    Azure services distributing traffic to backends. Azure Load Balancer = L4 (TCP/UDP), regional, fast (internal/public, health probes, backend pools). Application Gateway = L7 (HTTP), regional, URL path-based routing, SSL termination, WAF. Front Door = L7, global (edge delivery, WAF/CDN, reverse proxy). Traffic Manager = DNS-based global routing (real traffic goes straight to the backend). Decide by L4 vs L7 and regional vs global.

    Prerequisites: Application Gateway、Region (Azure)、Azure Load Balancer、Azure Front Door

  • Contained database user

    A user whose authentication (password or Microsoft Entra ID) is bound to the database itself rather than depending on a server-level login. The standard pattern in Azure SQL Database, it avoids having to recreate server logins when a secondary is promoted in a failover group.

    Prerequisites: Azure SQL Database、Failover groups、SQL login

    Related: Database user

  • Sweep job (hyperparameter tuning)

    A job that runs many trials with a search space, sampling, primary metric, and early termination to find the best hyperparameter configuration.

    Prerequisites: Search space

    Related: Primary metric

  • ExpressRoute gateway

    A virtual network gateway connecting an ExpressRoute circuit to a VNet; the SKU sets bandwidth and performance.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • Azure Front Door

    A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.

  • Non-relational (NoSQL)

    Databases storing data flexibly without a fixed schema; four kinds: key-value/document/column-family/graph.

  • Semi-structured data

    Data structured by tags/keys but not bound to a fixed schema; flexible. E.g., JSON, XML.

    Prerequisites: Tags (Azure)、JSON、Structured data

  • SQL login

    A server-level security principal in SQL Server/Azure SQL, responsible for authentication (whether one can connect to the server); database access is only granted once mapped to a user. Comes in two flavors: Microsoft Entra logins and SQL-authenticated logins.

    Prerequisites: SQL authentication

  • User-defined route (UDR)

    A manual route overriding system routes: define destination prefix → next hop (virtual appliance/gateway/internet/none) and associate the route table with a subnet.

    Prerequisites: Network Watcher tools (IP flow verify, Connection Monitor, next hop)、System routes

    Related: Azure NAT Gateway、Private endpoint

  • Unstructured data

    Data with no fixed schema, stored as files/objects. E.g., images, video, audio, documents.

    Prerequisites: Structured data

  • Application Gateway

    A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.

    Prerequisites: Region (Azure)

  • Azure Arc

    Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).

    Prerequisites: Role-based access control (RBAC)、Tags (Azure)

  • Region pair

    A pair of distant regions within the same geography—used for broad-disaster redundancy, sequential updates, and as the GRS replication target. Note newer regions (since 2024) may have no pair, in which case availability zones (zone redundancy) are used instead.

    Prerequisites: Availability zone、Redundancy (LRS/ZRS/GRS/GZRS)、Region (Azure)、Zone redundancy (Azure SQL)

  • BCDR design (backup/disaster recovery)

    Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.

    Prerequisites: Region (Azure)、Azure Backup、Azure Site Recovery (ASR)、Zone redundancy (Azure SQL)

  • Always Encrypted

    Encrypts sensitive Azure SQL columns (e.g., credit card numbers) on the client so the server never sees plaintext. Keys (the column master key) live on the client or in Key Vault. Since the server can’t see plaintext, queries are generally limited (e.g., equality); range operations require Secure Enclaves. Unlike TDE (at rest only), it protects data in use—even from DBAs.

    Prerequisites: Azure Key Vault

    Related: Customer-managed keys (CMK) / Platform-managed keys (PMK)

  • Customer-managed keys (CMK) / Platform-managed keys (PMK)

    Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.

    Prerequisites: Azure Key Vault

    Related: Always Encrypted

  • Web Application Firewall (Azure WAF)

    Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.

    Prerequisites: Application Gateway、Region (Azure)、Azure Front Door

  • Azure Data Factory

    An ETL/ELT pipeline service for ingesting, transforming, and orchestrating data.

  • Azure Database for PostgreSQL

    A managed relational service for the open-source PostgreSQL engine. The current offering is the Flexible Server, supporting availability-zone placement, burstable SKUs, and fine-grained maintenance windows; Azure handles patching, backups, and failover.

    Prerequisites: Availability zone

    Related: Azure Database for MySQL

  • Azure Load Balancer

    A fast regional L4 (TCP/UDP) load balancer; configure public/internal, health probes, and backend pools.

    Prerequisites: Region (Azure)

  • Blob access tiers

    Cost-optimization tiers by access frequency: hot (frequent), cool (infrequent), cold, and archive (rarely accessed, slow to rehydrate).

    Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

  • Log Replay Service (LRS)

    For SQL Managed Instance migrations, continuously restores/applies backups from Blob to enable an online migration with a manual cutover.

    Prerequisites: Blob storage、Online vs offline migration、SQL Managed Instance

  • Query Store

    Retains query text, execution plans, and runtime statistics as history. It underpins regression detection and plan forcing.

    Prerequisites: Automatic tuning (plan forcing)、Execution plan

  • Read scale-out

    On Business Critical / Hyperscale, routes read workloads to read-only secondary replicas to offload the primary. Used via ApplicationIntent=ReadOnly in the connection string.

    Prerequisites: Resource lock、Hyperscale tier and page servers

    Related: Business Critical tier

  • Cosmos DB APIs

    Cosmos DB offers multiple APIs by workload: NoSQL (document, default), MongoDB, Cassandra, Gremlin (graph), and Table—chosen for migration or use case.

    Prerequisites: Azure Cosmos DB、Non-relational (NoSQL)

  • Modern data warehouse architecture

    The analytics flow: ingest → store (data lake) → prepare/transform → model/serve (DWH) → visualize. It combines batch and stream, with Synapse/Fabric covering each stage.

    Prerequisites: Azure Synapse Analytics、Data lake、Data warehouse、Microsoft Fabric (capacity, workspace, experiences)

  • Query tools (Azure Data Studio / SSMS)

    Tools to connect, run SQL, and manage databases: Windows SQL Server Management Studio (SSMS), Visual Studio Code with the MSSQL extension, and web-based SQL query editors in the Azure portal or Microsoft Fabric (Azure Data Studio was retired on 2026-02-28).

    Prerequisites: Azure portal and Marketplace、Microsoft Fabric (capacity, workspace, experiences)

  • Transactional vs analytical workloads

    OLTP handles many small reads/writes fast with consistency for operational systems; OLAP aggregates/analyzes large data for decisions. Data flows OLTP → (ETL) → OLAP.

    Prerequisites: OLAP (analytical)、OLTP (transactional)

  • ELT (extract, load, transform)

    A data-integration pattern that loads raw extracted data into the destination (warehouse/lake) first, then transforms it there using the destination's own compute. It grew popular as cloud warehouses gained parallel processing power, and keeping the raw data around adds flexibility.

    Prerequisites: Data warehouse

    Related: ETL (extract, transform, load)

  • ExpressRoute FastPath

    An option that, on supported SKUs, bypasses the virtual network gateway in the ExpressRoute data path for lower latency and higher throughput (normally the path traverses the gateway). Certain configurations (e.g., via UDRs or load balancers) are excluded from FastPath support.

    Prerequisites: ExpressRoute、Virtual network (VNet)、ExpressRoute gateway

    Related: ExpressRoute Direct

  • ETL (extract, transform, load)

    A data-integration pattern that extracts data from a source and transforms it (cleansing, reshaping, aggregating) before loading it into the destination. It needs separate transform compute (a server or managed service), but only clean, shaped data ever lands in the destination.

    Prerequisites: Managed services (management boundary)

    Related: ELT (extract, load, transform)

  • Azure Event Grid

    Reactive pub/sub delivering discrete events (e.g., "blob created"); subscribe via event subscriptions and react in near real time.

    Prerequisites: Blob storage、Subscription (Azure)

  • Forced tunneling and gateway transit

    Forced tunneling routes outbound internet via on-prem with a UDR; gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway.

    Prerequisites: ExpressRoute、ExpressRoute gateway

  • OLAP (analytical)

    An analytical workload of large reads/aggregations over historical data, run against a data warehouse.

    Prerequisites: Data warehouse

  • OLTP (transactional)

    A workload of many small, fast reads/writes for operations; ACID guarantees transaction correctness.

    Prerequisites: ACID

  • Private DNS zone

    A DNS zone valid only inside VNets; link it to a VNet to resolve internal or privatelink names to private IPs—key to operating private endpoints.

    Prerequisites: Virtual network (VNet)、Private endpoint

  • Queue storage

    A message queue to decouple components and smooth processing spikes.

    Prerequisites: Component (reusable step)

  • Site-to-site VPN (S2S)

    Connects an on-prem site to an Azure VNet over a persistent IPsec tunnel; configure a VPN gateway and an on-prem local network gateway.

    Prerequisites: Virtual network (VNet)、VPN Gateway

  • SQL Managed Instance

    A PaaS with near-full SQL Server compatibility; good for migrating existing SQL Server (lift-and-shift).

  • Table storage

    Simple, inexpensive key-value (NoSQL) tables for large volumes of lightweight structured data.

    Prerequisites: Non-relational (NoSQL)、Structured data

  • YAML

    A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.

    Prerequisites: JSON

  • ACID

    Properties of reliable transactions: Atomicity, Consistency, Isolation, Durability.

  • Azure App Configuration

    A service to centrally manage app settings and feature flags; centralizes config, references Key Vault for secrets, and enables progressive rollout via flags.

    Prerequisites: App Service configuration (settings, TLS, connections)、Azure Key Vault

    Related: Feature flags

  • App Service configuration (settings, TLS, connections)

    Configure app settings/connection strings (injected as env vars), custom-domain TLS/certs, and service connections; secrets can use Key Vault references.

    Prerequisites: Azure App Service、Azure Key Vault

  • Management group

    The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.

    Prerequisites: Subscription (Azure)

  • Redundancy (LRS/ZRS/GRS/GZRS)

    Resilience set by number/scope of copies: LRS<ZRS<GRS<GZRS; GRS/GZRS replicate to another region.

    Prerequisites: Region (Azure)

  • Virtual machine scale sets (VMSS)

    A set of identical VMs that autoscales with load (the performance axis; availability is via sets/zones).

    Prerequisites: Azure Virtual Machines (VM)、Availability set (fault/update domains)

  • VPN Gateway

    Connects on-premises over an encrypted tunnel across the internet.

  • Storage access (access keys/SAS)

    Ways to access Azure Storage: access keys (full account access, rotate them), SAS (shared access signature; delegated access scoped by target/operation/expiry—user delegation SAS is safest), and Entra ID + RBAC (key-free, recommended). Restrict to a VNet with private endpoints/firewall.

    Prerequisites: Role-based access control (RBAC)、Virtual network (VNet)、Private endpoint

  • Hub-spoke network topology

    A design that centralizes shared services (firewall, gateway, DNS) in a hub VNet with spoke VNets connected by peering; can also be realized in a managed way via Virtual WAN.

    Prerequisites: Virtual network (VNet)、Azure Virtual WAN

  • Azure landing zone (CAF)

    A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.

    Prerequisites: Management group、Hub-spoke network topology

    Related: Azure landing zone

  • Azure Pipelines

    A CI/CD pipeline service defined as code (YAML). Composed of stages → jobs → steps, triggered by push/PR/schedule, and reused via templates. Runs on Microsoft-hosted or self-hosted agents.

    Prerequisites: YAML

  • Just-In-Time (JIT) VM access

    A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.

    Prerequisites: Microsoft Defender for Cloud

    Related: Azure Bastion

  • Transparent Data Encryption (TDE)

    Encrypts an Azure SQL database at rest (files and backups) and is on by default. It needs no app changes (transparent) and decrypts on the server during processing, so DBAs and the server can handle plaintext. The protector can switch from the default service-managed key to a CMK (BYOK). TDE protects data at rest; TLS protects in transit.

    Prerequisites: BYOK and infrastructure encryption、Customer-managed keys (CMK) / Platform-managed keys (PMK)、Azure SQL Database

  • Azure landing zone

    A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.

    Prerequisites: Management group、Subscription (Azure)

    Related: Azure landing zone (CAF)

  • Azure Backup

    A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.

    Prerequisites: Managed services (management boundary)

    Related: Azure Site Recovery (ASR)

  • Diagnostic settings

    Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.

    Prerequisites: Subscription (Azure)、Azure storage account、Log Analytics workspace

  • Azure Files (File storage)

    SMB/NFS file shares mountable from multiple machines simultaneously.

  • Azure Firewall

    A managed, stateful network firewall for centralized traffic control.

  • Azure Site Recovery (ASR)

    A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.

    Prerequisites: Region (Azure)

    Related: Azure Backup

  • Azure DNS Private Resolver

    A managed service brokering DNS resolution between on-prem and Azure; conditional forwarders route specific domains to the right DNS.

    Prerequisites: Azure DNS (public zones)、Managed services (management boundary)

  • Compute cluster

    Autoscaling compute that scales training or batch inference. It can shrink to 0 nodes when idle and use low-priority/Spot VMs to cut cost.

  • Search space

    The definition of which hyperparameters to tune and their candidate ranges (discrete choice, continuous uniform/loguniform, etc.).

  • Azure ML workspace

    The top-level resource that centrally manages ML artifacts (data, models, experiments, endpoints), with associated storage, Key Vault, Application Insights, and Container Registry.

    Prerequisites: Azure Machine Learning、Azure Key Vault

  • Automatic tuning (plan forcing)

    Azure SQL automatically creates recommended indexes and applies FORCE LAST GOOD PLAN (forcing the last known good plan) on regressions.

    Prerequisites: Index

  • Session blocking

    When one session waits on locks held by another. Identify long blocks and deadlock signs via DMVs and resolve via queries, indexes, or isolation levels.

    Prerequisites: Index

  • Dynamic management views (DMVs)

    Views that expose live internal server/database state (waits, blocking, index usage, etc.) queryable via SQL.

    Prerequisites: Index、Session blocking

  • Elastic pool

    Shares compute resources (eDTUs/vCores) across multiple Azure SQL Databases, optimizing cost for many DBs with offset usage peaks.

    Prerequisites: Azure SQL Database、Purchasing models (vCore / DTU)

  • Microsoft Entra authentication for Azure SQL

    The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.

    Prerequisites: Managed identity

    Related: SQL authentication

  • Execution plan

    A diagram of how a query executes. Inspect scan vs seek, key lookups, and non-SARGable predicates to decide index or rewrite improvements.

    Prerequisites: Index

  • Database migration (assess, DMS, online/offline)

    Moving from on-prem to Azure SQL. First assess (Data Migration Assistant / Azure Migrate for compatibility, target, SKU sizing), then execute (Azure Database Migration Service or the Azure SQL Migration extension; Log Replay Service for MI). Choose offline (bulk copy, downtime) or online (continuous sync with a final cutover, minimal downtime). After migrating, adjust the compatibility level and check regressions via Query Store. Pick the target by need for instance features, OS control, and tolerable downtime.

    Prerequisites: Log Replay Service (LRS)、Online vs offline migration、Query Store

  • SQL authentication

    Traditional authentication where the username/password are managed within SQL. A fallback when Entra auth is unavailable, requiring strong passwords and least privilege.

    Related: Microsoft Entra authentication for Azure SQL

  • Azure SQL Database in Microsoft Fabric

    Azure SQL Database integrated inside Microsoft Fabric, tightly tied to OneLake mirroring and Fabric’s analytics experience.

    Prerequisites: Azure SQL Database、Microsoft Fabric (capacity, workspace, experiences)、OneLake

  • Azure Event Hubs

    High-throughput ingestion of large streaming/telemetry; processed in parallel via partitions and consumer groups.

  • Foreign key

    A column referencing another table’s primary key to relate tables; preserves referential integrity.

    Prerequisites: Primary key

  • Azure Functions hosting plans

    Choosing billing/performance for the runtime: Flex Consumption (current default—fast scale, VNet, always-ready instances), the older Consumption (auto-scale, cold starts), Premium (pre-warmed, VNet), and Dedicated (App Service plan).

    Prerequisites: Azure App Service、Azure Functions、Virtual network (VNet)

  • Key Vault objects (keys/secrets/certificates, dev)

    Securely fetching and using secrets, keys, and certificates from code; avoid hard-coding (e.g., connection strings)—use Key Vault references or managed identity.

    Prerequisites: Azure Key Vault、Managed identity

  • Outbound rules and SNAT (Load Balancer)

    Translates (SNATs) the source address of outbound traffic from backend-pool VMs to the Load Balancer's frontend IP, enabling outbound connectivity for VMs without a public IP. Outbound rules control port allocation—watch for SNAT port exhaustion under heavy outbound load.

    Related: Inbound NAT rule、Load-balancing rule

  • Messages vs events

    A message is a command the sender expects to be handled (Service Bus/Queue); an event is a notification of something that happened (Event Grid/Event Hubs)—a key selection axis.

    Prerequisites: Azure Event Grid、Azure Event Hubs、Azure Service Bus

  • Azure NAT Gateway

    Outbound-only NAT for a subnet; provides stable egress and avoids SNAT port exhaustion (does not provide inbound).

    Prerequisites: Outbound rules and SNAT (Load Balancer)

    Related: Private endpoint、User-defined route (UDR)

  • OneLake

    Fabric’s single unified storage per org (ADLS Gen2-compatible; tables in Delta), shared by all experiences to keep data in one place.

    Prerequisites: Azure Data Lake Storage Gen2

    Related: Microsoft Fabric (capacity, workspace, experiences)

  • Defender for Servers

    Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.

    Prerequisites: Azure Arc、Just-In-Time (JIT) VM access

  • Secured Virtual Hub

    A virtual hub with Azure Firewall embedded, centrally applying policy across hubs via Firewall Manager to inspect traffic centrally.

    Prerequisites: Azure Firewall、Virtual hub (Virtual WAN)

  • Azure Service Bus

    An enterprise message broker supporting ordering, transactions, dedup, and dead-lettering; used for reliable command delivery.

  • Database user

    A database-level security principal in SQL Server (and Azure SQL), mapped to a login, whose role memberships and GRANT/DENY/REVOKE determine authorization to objects. DENY is a T-SQL-specific permission state unique to SQL Server—PostgreSQL and MySQL have no equivalent. Contrasted with a contained user, which is created without a login.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)、SQL login

    Related: Contained database user

  • System routes

    Default routes Azure auto-provides for intra-VNet, peering, gateways, and default internet; can be overridden by UDRs.

    Prerequisites: Virtual network (VNet)

  • Virtual hub (Virtual WAN)

    The managed hub at the core of Virtual WAN; hosts VPN/ExpressRoute/P2S gateways and connections, transiting spokes via hub routing.

    Prerequisites: ExpressRoute

    Related: Azure Virtual WAN

  • VPN gateway SKU and redundancy

    The SKU determining a VPN gateway’s performance/bandwidth/tunnel count; for availability use active/active or zone-redundant configurations.

    Prerequisites: Redundancy (LRS/ZRS/GRS/GZRS)、VPN Gateway、Zone redundancy (Azure SQL)

  • WAF policy and detection/prevention modes

    A Web Application Firewall config associated with Application Gateway or Front Door; choose detection mode (log only) or prevention mode (block), using OWASP rule sets to stop common attacks.

    Prerequisites: Application Gateway、Web Application Firewall (Azure WAF)、Azure Front Door

  • ACR (Azure Container Registry)

    A private registry to store/manage container images; ACR Tasks builds in the cloud, and authentication uses a managed identity.

    Prerequisites: Container image、Managed identity

  • Developer portal (APIM)

    An auto-generated portal for API consumers offering documentation, try-it, and subscription sign-up.

    Prerequisites: Subscription (Azure)

    Related: Azure API Management (APIM)

  • Named values (APIM)

    Centralizes constants/secrets used in policies; secrets are referenced securely via Key Vault integration.

    Prerequisites: Azure Key Vault

    Related: Azure API Management (APIM)

  • Products and subscriptions (APIM)

    Bundles APIs as "products" that consumers use via subscriptions (keys); manages exposure and terms per product.

    Prerequisites: Subscription (Azure)

    Related: Azure API Management (APIM)

  • Diagnostics and logging (App Service)

    Collecting app/web-server/detailed-error logs and viewing the live log stream; integrates with App Insights for monitoring.

    Prerequisites: Azure App Service

  • ARM template

    The foundational JSON format for declaratively describing Azure resource configuration as IaC. Deploying the same template repeatedly converges to the same state (idempotent), with parameter files swapping per-environment values. Deployments are incremental (default) or complete mode—complete mode deletes resources not present in the template, a common gotcha.

    Prerequisites: JSON

  • Azure Functions

    The flagship serverless (FaaS): event-driven function execution billed only for what runs.

  • Azure Policy

    Defines/enforces rules (allowed regions, required tags, etc.) that resources must meet and evaluates compliance.

    Prerequisites: Region (Azure)、Tags (Azure)

  • Role-based access control (RBAC)

    Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.

  • Azure Virtual Machines (VM)

    IaaS virtual machines; the most flexible compute where you manage the OS and above.

  • Availability set (fault/update domains)

    Spreads VMs within one datacenter across fault domains (power/network/rack) and update domains (planned-maintenance units) to avoid simultaneous impact from unplanned failures and planned maintenance. Use availability zones for datacenter-level failures.

    Prerequisites: Availability zone

  • Storage account kinds and performance

    General-purpose v2 (GPv2) is the standard handling Blob/File/Queue/Table. Performance is Standard (HDD) or Premium (SSD, low latency); Premium splits into BlockBlob/FileShare/Page kinds.

    Prerequisites: Blob storage、Azure storage account

  • Scale set autoscaling

    Automatically scales a virtual machine scale set’s instance count by metrics (e.g., CPU) or schedule, with scale-in/out rules and min/max bounds.

    Prerequisites: Azure Virtual Machines (VM)、Virtual machine scale sets (VMSS)

  • YAML pipelines and templates

    Defines pipelines as code (YAML) with stages, jobs, and steps. Templates reuse common logic, and multi-stage pipelines combine CI and CD to multiple environments in one definition.

    Prerequisites: Azure Pipelines、YAML

  • App Service Environment (ASE)

    A dedicated, isolated App Service environment integrated into a virtual network, used for sensitive workloads needing network isolation and high scale.

    Prerequisites: Azure App Service、Virtual network (VNet)

  • Azure Bastion

    A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.

    Prerequisites: Azure portal and Marketplace

    Related: Just-In-Time (JIT) VM access

  • BYOK and infrastructure encryption

    BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.

    Prerequisites: Customer-managed keys (CMK) / Platform-managed keys (PMK)

  • Key rotation and backup

    Periodically auto-rotates Key Vault keys/secrets/certificates to reduce leak risk, and uses backup/restore to guard against accidental deletion or failure.

    Prerequisites: Azure Key Vault、Key Vault objects (keys/secrets/certificates, dev)

  • Regulatory compliance (standards / custom)

    Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.

    Prerequisites: Microsoft Defender for Cloud、Dashboard (Power BI)

  • Workflow automation (Defender for Cloud)

    Triggers Logic Apps on security alerts or recommendations to automate responses like notifications, ticketing, and remediation.

    Prerequisites: Microsoft Defender for Cloud、Azure Logic Apps

  • BGP and route propagation

    The standard protocol for dynamically exchanging routes between on-prem and the Azure gateway. Peers are identified by ASN; the Azure gateway’s default ASN is 65515 and on-prem sets its own. Enabling BGP on a VPN auto-learns on-prem subnet changes, removing UDR edits. ExpressRoute always exchanges routes via BGP (private/Microsoft peering). Reflecting learned routes into the VNet is route propagation; disabling it on a route table lets UDRs reliably win. With multiple routes to the same destination, ExpressRoute is preferred over VPN (basis for backup-VPN designs). Precedence: longest-prefix match, then UDR > BGP > system.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • Azure portal and Marketplace

    The Azure portal is a web console to manage resources via GUI. Azure Marketplace lets you buy and deploy Microsoft/third-party solutions. A mobile app also monitors/operates resources.

  • AzCopy

    A command-line tool for fast bulk copy/upload/download to and from Blob storage/file shares. Supports parallel transfer and resumable checkpoints, better suited to scripting/automation than the GUI Storage Explorer. Authenticates via Microsoft Entra ID or a SAS token.

    Prerequisites: Blob storage

    Related: Azure Storage Explorer

  • Azure Database for MySQL

    A managed relational service for the open-source MySQL engine. The current offering is the Flexible Server, supporting same-zone placement for latency optimization and flexible compute/storage scaling; Azure handles patching, backups, and failover.

    Prerequisites: Availability zone

    Related: Azure Database for PostgreSQL

  • Azure Storage Explorer

    A standalone GUI app (Windows/macOS/Linux) to browse, upload, and manage Blob storage, file shares, queues, and tables. Suited to inspecting small amounts of data, manual operations, and quick permission tweaks; use AzCopy for high-speed bulk transfer.

    Prerequisites: Blob storage

    Related: AzCopy

  • Bicep

    A DSL offering more concise syntax than ARM template JSON. Running az bicep build compiles it into an equivalent ARM template JSON, which is what actually gets deployed. Modules and loop syntax improve readability and reuse.

    Prerequisites: ARM template、JSON

  • Blob lifecycle management

    Policies that auto-move blobs across access tiers (hot→cool→archive) or delete them after N days; optimizes storage cost.

    Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

  • Container image

    An immutable package of an app and its dependencies; built from a Dockerfile, pushed to a registry (ACR), and run by services.

  • Batch endpoint

    An endpoint that asynchronously scores large data on a compute cluster. Invoking it starts a batch scoring job.

    Prerequisites: Compute cluster

  • Early termination policy (Bandit/median)

    A sweep setting that cancels unpromising trials to save cost. Options include Bandit (slack factor), median stopping, and truncation selection.

    Prerequisites: Sweep job (hyperparameter tuning)

  • MLflow tracking

    Experiment tracking natively integrated in Azure ML. Logs training via log_metric/log_param/log_artifact and autolog to compare runs.

    Prerequisites: Azure Machine Learning

  • Pipeline job

    A sequence connecting multiple components as a DAG, passing data between steps. It can be scheduled and monitored.

    Prerequisites: Component (reusable step)

  • Responsible AI dashboard

    A set of Azure ML tools to assess models for responsible AI, offering error analysis, interpretability, fairness, and counterfactuals in one dashboard.

    Prerequisites: Azure Machine Learning、Dashboard (Power BI)

  • Sampling method (grid/random/Bayesian)

    How a sweep picks configurations from the search space: grid (exhaustive), random (broad and fast), and Bayesian (learns promising regions from prior results).

    Prerequisites: Search space、Sweep job (hyperparameter tuning)

  • Synapse Spark / serverless Spark

    Spark compute to interactively wrangle large data from notebooks, using an attached Synapse Spark pool or Azure ML serverless Spark.

    Prerequisites: Azure Machine Learning、Azure Synapse Analytics

  • Active geo-replication

    A DR feature asynchronously creating a readable secondary in another region. It supports manual failover and up to four secondaries.

    Prerequisites: Region (Azure)

  • Business Critical tier

    An Azure SQL service tier delivering low latency and high availability via local SSD and built-in Always On replicas. It includes a secondary for read scale-out.

    Related: Read scale-out

  • Elastic Jobs

    Automation for Azure SQL Database. Uses a job agent and job DB to run T-SQL in parallel across DBs via target groups.

    Prerequisites: Azure SQL Database

  • Failover groups

    A DR feature connecting a group of DBs via listeners and failing them over automatically without changing the connection string.

  • Geo-restore

    A DR option restoring from GRS geo-redundant backups to another region. Because the copy is asynchronous, RPO is larger.

    Prerequisites: Region (Azure)

  • Hyperscale tier and page servers

    An Azure SQL service tier scaling to ~100TB. Page servers separate storage to enable snapshot-based fast backup/restore and rapid scaling.

  • Intelligent query processing (IQP)

    A set of features that improve query performance without rewrites (adaptive joins, memory-grant feedback, batch mode, etc.), enabled via compatibility level.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Online vs offline migration

    Offline is a bulk copy with downtime; online continuously syncs changes with a final cutover for minimal downtime. Choose by tolerable downtime.

  • Purchasing models (vCore / DTU)

    vCore is a flexible model where you size CPU, memory, and storage separately, with Azure Hybrid Benefit and reserved discounts (recommended). DTU is a simple blended metric of compute and storage.

    Related: Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

  • Data ingestion and processing (pipelines)

    Azure Data Factory / Synapse pipelines copy and orchestrate data, with mapping data flows transforming it without code; an integration runtime performs execution.

    Prerequisites: Azure Data Factory、Azure Synapse Analytics

  • Power BI components (Power Query/model/visuals)

    In Power BI Desktop, Power Query ingests and shapes (cleanses) data → build a data model (relationships, measures) → construct reports with visuals, then share via the Power BI service.

    Prerequisites: Report (Power BI)、Microsoft Power BI

  • Synapse components (SQL/Spark pools)

    Azure Synapse Analytics unifies a dedicated SQL pool (provisioned DWH), serverless SQL pool (query the data lake), Apache Spark pool (big-data processing), and pipelines in one studio.

    Prerequisites: Azure Synapse Analytics、Data lake

  • ExpressRoute peering (private/Microsoft)

    ExpressRoute peering types: private peering reaches VNets; Microsoft peering reaches public Microsoft 365/PaaS over the private circuit. Always exchanged via BGP.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • ExpressRoute Direct

    An ExpressRoute form that connects directly to Microsoft's edge routers over dedicated 10 Gbps or 100 Gbps port pairs, without going through a connectivity provider. Multiple ExpressRoute circuits can be carved out of one physical connection, suited to workloads needing very high bandwidth and low latency.

    Prerequisites: ExpressRoute

    Related: ExpressRoute FastPath

  • Azure Functions triggers

    What starts a function—HTTP (request), timer (schedule), Blob/Queue/Event (data ops), webhooks; one trigger per function.

    Prerequisites: Blob storage、Azure Functions

  • Inbound NAT rule

    A Load Balancer rule that forwards traffic on a specific frontend port to a specific port on one VM in the backend pool—pinpoint forwarding, unlike a load-balancing rule's distribution across many backends. Commonly used to expose RDP/SSH to individual VMs.

    Prerequisites: Load-balancing rule

    Related: Outbound rules and SNAT (Load Balancer)

  • Load-balancing rule

    A rule that distributes inbound traffic received on a Load Balancer frontend IP/port across a backend pool, based on health-probe results. The default is 5-tuple hash distribution, with session persistence (source-IP affinity) configurable.

    Related: Outbound rules and SNAT (Load Balancer)

  • Log Analytics workspace

    A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.

    Prerequisites: Microsoft Sentinel

  • Point-to-site VPN (P2S)

    Connects individual client devices to an Azure VNet; choose a tunnel type and authentication (certificate, RADIUS, Microsoft Entra ID) and distribute a VPN client configuration.

    Prerequisites: Virtual network (VNet)、VPN Gateway

  • Primary key

    A column that uniquely identifies each row; no duplicates or nulls.

  • Azure Route Server

    A managed service that exchanges routes via BGP between an NVA and Azure, reflecting NVA routes into the VNet without manual UDR updates.

    Prerequisites: Virtual network (VNet)、Managed services (management boundary)

  • Azure Virtual Network Manager

    Groups many VNets as network groups and centrally applies connectivity and security admin rules. Security admin rules are higher-priority rules evaluated before NSGs, enforcing org-wide guardrails teams cannot override.

    Prerequisites: Virtual network (VNet)

    Related: Azure Virtual Network Manager

  • Topics and subscriptions (Service Bus)

    Pub/sub that fans one message to multiple receivers; each subscription can filter which messages it receives.

    Prerequisites: Subscription (Azure)、Azure Service Bus

  • Service chaining (via NVA)

    Sets the UDR next hop to an NVA (network virtual appliance/firewall) to force traffic through it; enable IP forwarding on the NVA and front it with an internal Load Balancer for redundancy.

    Prerequisites: Azure Load Balancer

  • Virtual network flow logs

    Logs allowed/denied traffic to Storage (successor to NSG flow logs); visualized via Traffic Analytics to analyze traffic patterns and anomalies.

    Prerequisites: Virtual network (VNet)

  • Azure Virtual Network Manager

    Centrally manages connectivity (mesh/hub-and-spoke) and security rules across many VNets, applying config to network groups at once.

    Prerequisites: Virtual network (VNet)

    Related: Azure Virtual Network Manager

  • VNet peering

    Connects two VNets over the Microsoft backbone with low latency; non-transitive by default (A-B-C does not give A↔C), so hub transit needs UDRs or gateway transit.

    Prerequisites: Virtual network (VNet)、Forced tunneling and gateway transit

  • API Management policies

    XML rules controlling API behavior (inbound/backend/outbound/on-error); apply auth (validate-jwt), rate limiting, transformation, caching, and CORS.

    Related: Azure API Management (APIM)

  • App Service autoscaling

    Adjusts instance count to follow load. Choose rule-based Autoscale (scale on metrics like CPU/memory or schedules) or platform-managed automatic scaling. Balances cost and performance.

    Prerequisites: Azure App Service

  • Deploying to App Service

    Ways to deploy code or containers to App Service (ZIP deploy, container deploy, CI/CD); combine with slots for zero downtime.

    Prerequisites: Azure App Service

  • Azure Advisor

    Recommends improvements for your resources across cost, security, reliability, performance, and operations.

  • Network security group (NSG)

    Applies allow/deny rules by source/destination/port at the subnet or NIC level.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Resource lock

    A safety net preventing deletion or change (CanNotDelete / ReadOnly), stopping mistakes even by authorized users.

  • Azure Service Health

    Notifies you of Azure-side incidents, planned maintenance, and health (distinct from Advisor, which advises on your resources).

    Prerequisites: Azure Advisor

  • Blob protection (soft delete, versioning, object replication)

    Blob/container soft delete recovers from accidental deletion, versioning keeps history, and object replication asynchronously copies to another account.

    Prerequisites: Blob storage

  • Azure File Sync

    A service that syncs on-prem Windows file servers with Azure Files. Cloud tiering moves infrequently accessed files to the cloud to save local capacity.

    Prerequisites: Azure Files (File storage)

  • Azure Logic Apps

    A service that integrates workflows with no-code/low-code using many connectors. It links SaaS, on-prem, and Azure services via triggers/actions to automate business processes and connect systems.

  • Environments and approvals/gates (Azure Pipelines)

    Environments representing deploy targets (Dev/Test/Staging/Prod) and checks that control deployment to them. Combine approvals (human sign-off), gates (automated checks like monitoring queries), branch control, business hours, and required templates to protect production resources.

    Prerequisites: Azure Pipelines

  • Feature flags

    A mechanism that decouples deployment (placing code in prod) from feature enablement (release). Managed via Azure App Configuration Feature Manager, etc., enabling staged rollout, A/B testing, and instant disable (kill-switch) without redeploy.

    Related: Azure App Configuration

  • Security testing (SAST/DAST/SCA)

    Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).

    Prerequisites: Container image

  • Variable groups and Key Vault integration

    Variable groups bundle settings shared across pipelines, with secrets retrieved securely via Azure Key Vault integration; secure files handle certificates, etc.

    Prerequisites: Azure Key Vault

  • AKS security

    Secures Kubernetes workloads via AKS network isolation (private clusters, network policies), Entra-integrated authentication/authorization, and monitoring with Defender for Containers.

    Prerequisites: Defender for Containers

  • Custom roles (Azure / Entra roles)

    When built-in roles lack granularity, define custom roles that allow only the needed actions. Azure resource roles and Microsoft Entra roles are managed as separate systems.

  • Defender for Cloud DevOps security

    Connects GitHub, Azure DevOps, and GitLab to Defender for Cloud to detect misconfigurations, exposed secrets, and vulnerabilities in code and pipelines.

    Prerequisites: Microsoft Defender for Cloud

  • Defender Vulnerability Management

    Continuously detects known vulnerabilities (CVEs) on VMs and containers, with prioritization and remediation guidance, built into Defender for Servers/Containers.

    Prerequisites: Defender for Servers

  • Encryption over ExpressRoute

    Ways to encrypt traffic over the private ExpressRoute circuit: MACsec on the link itself, or an IPsec VPN layered over ExpressRoute.

    Prerequisites: ExpressRoute

  • Microsoft Cloud Security Benchmark (MCSB)

    Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.

    Prerequisites: Microsoft Defender for Cloud

  • Blob versioning

    A Blob storage protection that automatically keeps prior versions on each overwrite/delete to enable recovery from mistakes, used with soft delete and immutable storage.

    Prerequisites: Blob storage

  • Azure support plans

    Choose among Basic (free, billing/subscription), Developer (trial), Standard (production), and Professional Direct (business-critical), differing in response time and architecture guidance.

    Prerequisites: Subscription (Azure)

  • Azure CDN

    Caches static content at edge for low-latency delivery. The Microsoft standard profile is current; legacy Verizon/Edgio profiles are being retired. New workloads are recommended to use Azure Front Door (with integrated CDN). Updates apply via purge.

    Prerequisites: Azure Front Door

  • Azure Databricks

    An Apache Spark-optimized platform for big-data processing and ML; strong for data science.

  • Azure DNS (public zones)

    Hosts a domain’s public DNS records in Azure, providing internet name resolution.

  • Azure Firewall rules

    Azure Firewall’s three rule types: DNAT rules translate/forward inbound, network rules control L3-L4 by IP/port/protocol, and application rules control L7 by FQDN.

    Prerequisites: Azure Firewall

  • Azure Pricing Calculator

    A web tool that estimates the monthly cost of a planned Azure configuration. Enter region, SKU, usage hours, and data transfer to get a per-service cost estimate, useful for comparing designs or drafting proposals; actual billing can differ due to FX rates and real usage.

    Prerequisites: Region (Azure)

  • Bidirectional Forwarding Detection (BFD)

    A protocol that quickly detects failures between adjacent routers; on ExpressRoute it speeds BGP convergence and failover.

    Prerequisites: ExpressRoute

  • Blob properties and metadata

    Setting/getting a blob’s system properties (e.g., Content-Type) and user-defined key/value metadata.

    Prerequisites: Blob storage

  • Blob operations with the SDK

    Development operations to create/upload/download/list containers and blobs via BlobServiceClient/ContainerClient/BlobClient.

    Prerequisites: Blob storage

  • Connection Monitor

    A Network Watcher feature that continuously monitors reachability, latency, and packet loss between endpoints, detecting route changes and failures.

  • Change feed (Cosmos DB)

    A persistent log of creates/updates in order; used for event processing, materialized views, and syncing to other stores (deletes not included by default).

    Prerequisites: Azure Cosmos DB

  • Consistency levels (Cosmos DB)

    Five levels trading read consistency against performance/availability: strong → bounded staleness → session (default) → consistent prefix → eventual.

    Prerequisites: Azure Cosmos DB

  • Partition key (Cosmos DB)

    The property that distributes data into logical partitions; pick a high-cardinality, evenly distributed value to avoid hot partitions and use RU/s efficiently.

    Prerequisites: Azure Cosmos DB

  • Cosmos DB operations with the SDK

    Development operations to create/read/query/update databases/containers/items via CosmosClient; request cost is measured in RUs.

    Prerequisites: Azure Cosmos DB

  • Cross-region Load Balancer

    Bundles regional Load Balancers behind one global IP for geo-redundancy and low-latency routing.

    Prerequisites: Region (Azure)

  • Deployment slots

    In App Service, deploy to a separate environment (e.g., staging) and swap after warm-up for zero-downtime releases, with easy rollback.

    Prerequisites: Azure App Service

  • Command job

    The basic job that runs a single script with a specified environment, compute, and inputs. Pass parameters and data inputs, and diagnose failures via logs.

  • Compute instance

    A managed VM for individual development and notebook execution. It can be stopped to save cost and includes a terminal and Jupyter.

  • Data assets (uri_file/uri_folder/mltable)

    A reusable, versioned reference to data. Types: uri_file (a single file), uri_folder (a folder), and mltable (a schematized tabular form).

  • Model catalog

    A catalog in Azure AI Foundry / Azure ML to discover, compare, and deploy many foundation models (OpenAI, Hugging Face, Meta, etc.).

    Prerequisites: Azure Machine Learning

  • Model registry

    A place to version, register, and reference trained models with stages and lineage, used to select what to deploy.

  • Managed online endpoint

    An endpoint serving real-time low-latency inference where Azure manages infrastructure and autoscale. Kubernetes online uses an existing AKS.

  • Primary metric

    The metric a sweep or AutoML optimizes against (e.g., accuracy, AUC), with a direction to maximize or minimize.

    Related: Sweep job (hyperparameter tuning)

  • Registries (cross-workspace sharing)

    An org-level catalog to share models, components, environments, and data across multiple workspaces, used to promote from dev to production.

    Prerequisites: Component (reusable step)

  • Scoring script (init/run)

    The script implementing inference in a deployment: init() loads the model and run() handles each request. It may be unnecessary for MLflow models.

  • Traffic split and blue/green

    Place multiple deployments under one endpoint and split traffic by percentage. Roll out a new version gradually and roll back instantly on issues.

  • Azure Arc-enabled SQL

    Connects on-prem or other-cloud SQL Server to Azure via Azure Arc to centrally manage inventory, assessment, updates, and services like Defender/Purview.

    Prerequisites: Azure Arc

  • Azure Automation (runbooks)

    A service automating cross-cloud/on-prem operations via PowerShell/Python runbooks. Hybrid Workers enable on-prem execution.

  • Database watcher

    A managed feature that collects Azure SQL monitoring data into a centralized dashboard, used for performance monitoring across multiple databases.

    Prerequisites: Dashboard (Power BI)

  • Dynamic data masking

    Masks sensitive data in query results without changing the stored data. Users with the UNMASK permission see the real values.

  • General Purpose tier

    The balanced Azure SQL service tier. It separates compute from remote storage, suiting general-purpose workloads that balance cost and performance.

  • Index and statistics maintenance

    Reorganizing/rebuilding fragmented indexes and updating statistics on a schedule to keep performance. Typically scheduled via automation (jobs).

    Prerequisites: Index

  • Integrity checks (DBCC CHECKDB)

    A command that checks a database for logical and physical corruption. Run regularly to detect corruption early and, with backups, ensure data integrity.

  • Intelligent Insights

    An Azure SQL feature that automatically detects performance problems and emits root causes and recommendations as diagnostic logs.

    Prerequisites: Diagnostics and logging (App Service)

  • Long-term retention (LTR)

    Retains weekly/monthly/yearly backups for up to 10 years, meeting compliance requirements.

  • Managed Instance database copy and move

    Native operations to copy (replicate) or move (transfer) a database between SQL Managed Instances, used for instance reorganization or environment separation.

    Prerequisites: SQL Managed Instance

  • Row-level security (RLS)

    Restricts which rows each user can see using a security predicate (function). Used for tenant isolation and scoping access by responsibility.

  • Serverless compute (Azure SQL)

    An Azure SQL compute tier that auto-scales by usage and auto-pauses when idle to stop per-second billing. It suits intermittent workloads.

  • SQL auditing (server/database)

    Records database events to Log Analytics, Storage, or Event Hubs. Server audit applies to all DBs; database audit applies individually.

    Prerequisites: Azure Event Hubs

  • Always Encrypted with VBS enclaves

    Always Encrypted using virtualization-based security (VBS) enclaves, enabling server-side operations like range comparisons and pattern matching on still-encrypted data.

    Prerequisites: Always Encrypted

  • Wait statistics

    Metrics showing what sessions wait on (I/O, locks, CPU, etc.). They are the starting point for classifying bottlenecks.

  • Data visualization and report types

    Choose visuals by purpose (bar, line, pie, matrix, map, KPI). There are interactive reports and paginated reports formatted for printing.

    Prerequisites: Report (Power BI)

  • B2C (Azure AD B2C)

    CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.

    Prerequisites: SQL login

  • Eventual consistency

    A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.

    Related: Strong consistency

  • Local network gateway

    An Azure object representing the "on-prem side" of an S2S VPN; registers the on-prem public IP and address space (or BGP settings).

    Prerequisites: Site-to-site VPN (S2S)

  • NSG security rules

    NSG inbound/outbound rules evaluated by priority; allow/deny by source/destination (IP, ASG, service tag), port, and protocol, with default rules evaluated last.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Packet capture (Network Watcher)

    A Network Watcher feature that captures a VM’s traffic for analysis; used to isolate app-layer issues invisible to NSG checks.

  • Defender for Containers

    A Defender plan that detects container misconfigurations and runtime risks (suspicious processes, known exploits). Complements image vulnerability scanning and trusted-image allowance in ACR.

  • Microsoft Sentinel

    A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.

  • Service endpoint

    Routes subnet-to-PaaS traffic over the Azure backbone and lets the PaaS firewall allow that subnet; assigns no private IP (not reachable from on-prem). Service endpoint policies can restrict destinations.

  • Strong consistency

    A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.

    Related: Eventual consistency

  • Azure Traffic Manager

    DNS-based global traffic distribution; routing methods (priority/weighted/performance/geographic) decide which IP is returned (real traffic goes straight to the backend).