Instiq

Microsoft Security, Compliance, and Identity Fundamentals — knowledge map

The 270 core concepts of Microsoft Security, Compliance, and Identity Fundamentals and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.

Concepts (270)

  • Encryption

    Transforming data with a key so only authorized parties can decrypt; symmetric/asymmetric, at rest/in transit.

    Related: Encryption in transit、Encryption at rest

  • Virtual network (VNet)

    A private network in Azure; divided by subnets and connected to other VNets via peering.

  • Blob storage

    Storage for unstructured data (objects) such as images, video, and backups.

  • Region (Azure)

    A geographic grouping of one or more datacenters; chosen by latency, data sovereignty, feature availability, and cost.

  • CIA triad

    The three pillars of information security: Confidentiality, Integrity, Availability.

  • Azure SQL authentication/access control and data protection

    Authentication: Microsoft Entra (recommended—centralized, MFA/Conditional Access, passwordless via managed identity) and SQL auth. Distinguish logins (server) from users (DB); contained users are preferred in SQL Database. Authorize via fixed/custom roles and GRANT/DENY/REVOKE (DENY wins) for least privilege. Narrow rows with row-level security (RLS) and columns with column-level permissions. Data protection: dynamic data masking (limits display; UNMASK reveals real values) and auditing (log operations to Log Analytics/Storage). Encryption is TDE/Always Encrypted (separate entries).

    Prerequisites: Authentication methods (MFA / passwordless)、Authentication (AuthN)、Conditional Access、Always Encrypted

  • Authentication (AuthN)

    Verifying "who you are" (identity); performed before authorization.

    Related: Authorization (AuthZ)

  • Microsoft Entra ID

    Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.

    Prerequisites: Access management (RBAC / least privilege / JIT)

  • Azure Key Vault

    Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.

  • ExpressRoute

    A dedicated private connection that does not use the internet; high reliability, consistent low latency, high bandwidth.

  • Microsoft Defender for Cloud

    Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.

    Prerequisites: Microsoft Defender XDR

  • Routing (system routes, service chaining, forced tunneling)

    Azure path control. System routes are auto-provided by Azure for intra-VNet, peering, gateways, and default internet. UDRs (user-defined routes) override them, defining destination prefix → next hop (virtual appliance/gateway/internet/none). Service chaining sets the UDR next hop to an NVA (firewall) to force traffic through it (IP forwarding required on the NVA; for redundancy front it with an internal Load Balancer). Forced tunneling forces outbound internet via on-prem with a UDR. Gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway. Route selection: longest-prefix match, then UDR > BGP > system.

    Prerequisites: ExpressRoute、Virtual network (VNet)、Network Watcher tools (IP flow verify, Connection Monitor, next hop)、Azure Load Balancer

  • Microsoft Purview

    Microsoft's unified governance and compliance solutions: information protection, data lifecycle, risk management, eDiscovery, and auditing, plus cross-estate data governance via the data map/catalog (integrating the former Azure Purview).

    Prerequisites: eDiscovery

    Related: Purview Information Protection

  • Conditional Access

    Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).

    Prerequisites: Zero Trust

  • Subscription (Azure)

    The billing/usage boundary and a logical container for resources; often split by department or environment.

  • Data protection and HA/DR (backup/restore, HA/DR, PITR, LTR, geo, failover groups)

    Azure SQL takes automated backups (full/differential/log). PITR restores to any point within retention (default 7 days, max 35). LTR retains weekly/monthly/yearly up to 10 years. Geo-restore restores to another region from GRS geo-redundant backups (asynchronous, larger RPO). HA is zone redundancy (in-region, across AZs); DR is active geo-replication (readable secondary in another region) and failover groups (auto-fail-over a group of DBs via listeners without changing the connection string). VM uses Always On availability groups. Design by RPO/RTO; synchronous gives RPO≈0, asynchronous covers distance.

    Prerequisites: Region (Azure)、CIA triad、Active geo-replication、Failover groups

  • Monitoring and optimization (Query Store, DMVs, automatic tuning)

    Measure first to find bottlenecks. Query Store keeps query history, plans, and wait stats for regression detection and plan forcing. DMVs expose live internal state (wait stats, blocking) via SQL. In the execution plan, watch scan vs seek, key lookups, and non-SARGable predicates; improve with indexes (create missing, drop unused, rebuild fragmented) and updated statistics. Azure SQL automatic tuning (auto-apply recommended indexes, FORCE LAST GOOD PLAN) and intelligent query processing help.

    Prerequisites: Index、Automatic tuning (plan forcing)、Session blocking、Dynamic management views (DMVs)

  • Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

    Settings that determine Azure SQL performance/availability/cost. Tiers: General Purpose (balanced, remote storage), Business Critical (local SSD, built-in replicas, low latency, read scale-out), Hyperscale (up to ~100TB, page servers separate storage, fast backup/restore). Purchasing: vCore (flexible, Azure Hybrid Benefit, reserved discounts—recommended) vs DTU (simple metric). Compute is provisioned or serverless (auto pause/resume for intermittent loads). Share capacity across many DBs with an elastic pool. Read scale-out is on BC/Hyperscale.

    Prerequisites: CIA triad、Business Critical tier、Elastic pool、General Purpose tier

    Related: Purchasing models (vCore / DTU)

  • Managed identity

    An identity letting apps access Azure resources securely without managing secrets; a service principal auto-managed by Azure.

  • SQL login

    A server-level security principal in SQL Server/Azure SQL, responsible for authentication (whether one can connect to the server); database access is only granted once mapped to a user. Comes in two flavors: Microsoft Entra logins and SQL-authenticated logins.

    Prerequisites: SQL authentication

  • Authentication methods (MFA / passwordless)

    Means of verifying identity. Methods stronger than passwords alone, such as multifactor authentication (MFA) and passwordless (FIDO2 security keys, Authenticator, Windows Hello).

    Prerequisites: Authentication (AuthN)、Multi-factor authentication (MFA)

  • Authorization (AuthZ)

    Deciding "what you can do" once authenticated (permissions); performed after authentication.

    Related: Authentication (AuthN)

  • Azure App Service

    PaaS to host web apps and APIs quickly, with no OS management and easy scaling.

  • Azure API Management (APIM)

    An API gateway exposing multiple backend APIs through one front door. Policies (XML; inbound/backend/outbound/on-error) apply auth (validate-jwt), rate limiting, transformation, caching, and CORS. Offer to consumers via products and subscriptions (keys), document in the developer portal, authenticate to backends with a managed identity, and store secrets in named values (Key Vault).

    Prerequisites: Azure Front Door、Managed identity

    Related: Named values (APIM)、API Management policies、Developer portal (APIM)、Products and subscriptions (APIM)

  • Azure Virtual WAN

    A large-scale networking service centralizing many sites, VNets, and remote users via a managed hub on the Microsoft backbone. It aggregates VPN, ExpressRoute, and VNet connections; the hub transits, so spokes reach each other without the non-transitivity problem. SKUs: Basic (S2S VPN only) and Standard (full: ExpressRoute/P2S/hub-to-hub/Secured Hub). A Secured Virtual Hub embeds Azure Firewall and uses Firewall Manager to centrally apply policy across hubs. Use hand-built hub-and-spoke for small scale, Virtual WAN for large/global.

    Prerequisites: ExpressRoute、Virtual network (VNet)、Azure Firewall、Site-to-site VPN (S2S)

    Related: Virtual hub (Virtual WAN)

  • Contained database user

    A user whose authentication (password or Microsoft Entra ID) is bound to the database itself rather than depending on a server-level login. The standard pattern in Azure SQL Database, it avoids having to recreate server logins when a secondary is promoted in a failover group.

    Prerequisites: Authentication (AuthN)、Microsoft Entra ID、Azure SQL Database、Failover groups

    Related: Database user

  • Index

    A structure that speeds searching on columns; faster reads but added write-time cost.

  • Microsoft Defender XDR

    Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).

  • Encryption at rest

    Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.

    Related: Encryption

  • Retention policy

    Keeps data for the required period and deletes it when no longer needed, managing its lifecycle.

  • Availability zone

    A physically separated datacenter within a region (independent power/cooling/network); zone redundancy gives high availability.

    Prerequisites: Region (Azure)

    Related: Zone redundancy (Azure SQL)

  • Always Encrypted

    Encrypts sensitive Azure SQL columns (e.g., credit card numbers) on the client so the server never sees plaintext. Keys (the column master key) live on the client or in Key Vault. Since the server can’t see plaintext, queries are generally limited (e.g., equality); range operations require Secure Enclaves. Unlike TDE (at rest only), it protects data in use—even from DBAs.

    Prerequisites: Encryption、Encryption at rest、Azure Key Vault

    Related: Customer-managed keys (CMK) / Platform-managed keys (PMK)

  • Customer-managed keys (CMK) / Platform-managed keys (PMK)

    Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.

    Prerequisites: Encryption、Encryption at rest、Azure Key Vault

    Related: Always Encrypted

  • Transparent Data Encryption (TDE)

    Encrypts an Azure SQL database at rest (files and backups) and is on by default. It needs no app changes (transparent) and decrypts on the server during processing, so DBAs and the server can handle plaintext. The protector can switch from the default service-managed key to a CMK (BYOK). TDE protects data at rest; TLS protects in transit.

    Prerequisites: BYOK and infrastructure encryption、Customer-managed keys (CMK) / Platform-managed keys (PMK)、Azure SQL Database、Encryption

  • Network Watcher tools (IP flow verify, Connection Monitor, next hop)

    Network Watcher diagnostic tools for visibility and isolation. IP flow verify instantly decides whether a specific source/destination/port is allowed/denied by NSGs (with the matched rule name). Connection Monitor continuously monitors reachability, latency, and packet loss between endpoints. Next hop shows a packet’s actual next hop to isolate UDR mistakes. NSG/VNet flow logs record allowed/denied traffic to Storage, visualized via Traffic Analytics. Also packet capture, connection troubleshoot, and topology. Pick the tool for “is the NSG blocking, or a routing issue?”

    Prerequisites: Virtual network (VNet)、Connection Monitor、Packet capture (Network Watcher)、Virtual network flow logs

  • Azure SQL Database

    A fully managed relational PaaS; Azure handles patching, backups, availability. Best for new cloud apps.

  • Task automation (SQL Server Agent, Elastic Jobs)

    Routine-ops automation depends on the deployment. SQL Server Agent is the job scheduler on VM/Managed Instance (jobs, steps, schedules, operator notifications). Azure SQL Database lacks SQL Agent, so use Elastic Jobs (job agent + job DB; run T-SQL in parallel across DBs via target groups). Azure Automation runbooks (PowerShell/Python, Hybrid Workers) automate cross-cloud/on-prem ops. Schedule statistics updates, index rebuilds, DBCC CHECKDB, and backup verification, and notify on failure.

    Prerequisites: Azure SQL Database、Index、Azure Automation (runbooks)、Elastic Jobs

  • Microsoft Entra authentication for Azure SQL

    The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.

    Prerequisites: Authentication methods (MFA / passwordless)、Conditional Access、Microsoft Entra ID、Managed identity

    Related: SQL authentication

  • Permissions (GRANT/DENY/REVOKE, least privilege)

    Grant permissions per securable via fixed/custom database roles and GRANT/DENY/REVOKE. DENY takes precedence; apply least privilege to all securables.

  • Zone redundancy (Azure SQL)

    An HA configuration spreading replicas across availability zones within a region to tolerate datacenter failure. Available on many service tiers.

    Prerequisites: Region (Azure)

    Related: Availability zone

  • Azure Front Door

    A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.

    Prerequisites: CIA triad

  • Private endpoint

    A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.

    Prerequisites: Virtual network (VNet)

    Related: Azure NAT Gateway、User-defined route (UDR)

  • Microsoft Sentinel

    A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.

    Prerequisites: SOAR

    Related: SIEM

  • Purview Information Protection

    Microsoft Purview Information Protection discovers and classifies sensitive information and applies protection (encryption, access restriction, watermarks) via sensitivity labels. It is foundational to limiting exposure in Copilot responses.

    Prerequisites: Encryption、Sensitivity labels

    Related: Microsoft Purview

  • Region pair

    A pair of distant regions within the same geography—used for broad-disaster redundancy, sequential updates, and as the GRS replication target. Note newer regions (since 2024) may have no pair, in which case availability zones (zone redundancy) are used instead.

    Prerequisites: Availability zone、Redundancy (LRS/ZRS/GRS/GZRS)、Region (Azure)、CIA triad

  • Messaging/eventing (Service Bus, Event Grid, Event Hubs)

    Loose-coupling options. Service Bus = enterprise messaging (queues/topics; ordering/transactions/dedup/dead-letter). Storage Queue = simple, cheap high-volume queue. Event Grid = reactive pub/sub of discrete events (e.g., "blob created"). Event Hubs = high-volume streaming/telemetry ingestion (high throughput, partitions). Message = command; event = notification.

    Prerequisites: Blob storage、Azure Event Grid、Azure Event Hubs、Queue storage

  • Load balancing (Load Balancer / Application Gateway / Traffic Manager)

    Azure services distributing traffic to backends. Azure Load Balancer = L4 (TCP/UDP), regional, fast (internal/public, health probes, backend pools). Application Gateway = L7 (HTTP), regional, URL path-based routing, SSL termination, WAF. Front Door = L7, global (edge delivery, WAF/CDN, reverse proxy). Traffic Manager = DNS-based global routing (real traffic goes straight to the backend). Decide by L4 vs L7 and regional vs global.

    Prerequisites: Application Gateway、Region (Azure)、Azure Load Balancer、Azure Front Door

  • Azure Firewall

    A managed, stateful network firewall for centralized traffic control.

  • ExpressRoute gateway

    A virtual network gateway connecting an ExpressRoute circuit to a VNet; the SKU sets bandwidth and performance.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • Hashing

    A one-way, non-reversible transform; used for password storage and tamper detection (cannot be decrypted, unlike encryption).

    Prerequisites: Encryption

  • Sensitive data protection (PII / masking)

    Protecting sensitive data such as PII (personally identifiable information) and PHI: discover/classify with Macie, then protect via encryption, access control, and minimization. Masking/tokenization hides values, and handling varies by data classification; also prevent sensitive data leaking into logs.

    Prerequisites: Data classification (SITs / trainable classifiers)、SQL data classification、Encryption

  • Cloud Workload Protection (CWP)

    Enables per-resource-type Defender plans (Servers, Storage, Databases, Containers, Key Vault, AI) to detect runtime threats—the runtime pillar paired with Defender CSPM (proactive posture).

    Prerequisites: Azure Key Vault、Defender CSPM

  • User-defined route (UDR)

    A manual route overriding system routes: define destination prefix → next hop (virtual appliance/gateway/internet/none) and associate the route table with a subnet.

    Prerequisites: Network Watcher tools (IP flow verify, Connection Monitor, next hop)、System routes

    Related: Azure NAT Gateway、Private endpoint

  • Application Gateway

    A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.

    Prerequisites: Region (Azure)

  • Azure Arc

    Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).

    Prerequisites: Role-based access control (RBAC)、Tags (Azure)

  • Multi-factor authentication (MFA)

    Strengthens identity proof with a second factor beyond a password.

    Prerequisites: Authentication (AuthN)

  • Azure Monitor

    The monitoring foundation collecting metrics and logs; feeds Log Analytics (KQL), Application Insights (app monitoring), and alerts.

  • Role-based access control (RBAC)

    Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.

    Prerequisites: Authorization (AuthZ)

  • Virtual machine scale sets (VMSS)

    A set of identical VMs that autoscales with load (the performance axis; availability is via sets/zones).

    Prerequisites: Azure Virtual Machines (VM)、Availability set (fault/update domains)、CIA triad

  • VPN Gateway

    Connects on-premises over an encrypted tunnel across the internet.

    Prerequisites: Encryption

  • Hybrid identity (Entra Connect)

    Syncs on-prem Active Directory with Entra ID for hybrid identity. Choose authentication among password hash sync, pass-through authentication, and federation (AD FS).

    Prerequisites: Authentication methods (MFA / passwordless)、Authentication (AuthN)、Microsoft Entra ID、Hashing

  • Storage access (access keys/SAS)

    Ways to access Azure Storage: access keys (full account access, rotate them), SAS (shared access signature; delegated access scoped by target/operation/expiry—user delegation SAS is safest), and Entra ID + RBAC (key-free, recommended). Restrict to a VNet with private endpoints/firewall.

    Prerequisites: Microsoft Entra ID、Role-based access control (RBAC)、Virtual network (VNet)、Private endpoint

  • BCDR design (backup/disaster recovery)

    Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.

    Prerequisites: Region (Azure)、Azure Backup、Azure Site Recovery (ASR)、Zone redundancy (Azure SQL)

  • Web Application Firewall (Azure WAF)

    Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.

    Prerequisites: Application Gateway、Region (Azure)、Azure Front Door

  • Azure Backup

    A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.

    Prerequisites: Encryption、Retention policy

    Related: Azure Site Recovery (ASR)

  • Diagnostic settings

    Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.

    Prerequisites: Subscription (Azure)、Azure storage account、Log Analytics workspace、SIEM

  • Azure Load Balancer

    A fast regional L4 (TCP/UDP) load balancer; configure public/internal, health probes, and backend pools.

    Prerequisites: Region (Azure)

  • Azure storage account

    A container bundling Blob, File, Table, and Queue storage services.

    Prerequisites: Blob storage、Queue storage

  • Azure Cosmos DB

    A globally distributed, low-latency, auto-scaling managed NoSQL DB supporting multiple APIs (NoSQL/MongoDB/Cassandra/Gremlin/Table).

  • Log Replay Service (LRS)

    For SQL Managed Instance migrations, continuously restores/applies backups from Blob to enable an online migration with a manual cutover.

    Prerequisites: Blob storage、Online vs offline migration、SQL Managed Instance

  • Query Store

    Retains query text, execution plans, and runtime statistics as history. It underpins regression detection and plan forcing.

    Prerequisites: Automatic tuning (plan forcing)、Execution plan

  • Read scale-out

    On Business Critical / Hyperscale, routes read workloads to read-only secondary replicas to offload the primary. Used via ApplicationIntent=ReadOnly in the connection string.

    Prerequisites: Resource lock、Hyperscale tier and page servers

    Related: Business Critical tier

  • SQL authentication

    Traditional authentication where the username/password are managed within SQL. A fallback when Entra auth is unavailable, requiring strong passwords and least privilege.

    Prerequisites: Authentication (AuthN)

    Related: Microsoft Entra authentication for Azure SQL

  • Encryption in transit

    Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.

    Prerequisites: Encryption at rest

    Related: Encryption

  • B2C (Azure AD B2C)

    CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.

    Prerequisites: Microsoft Entra ID、Access management (RBAC / least privilege / JIT)、SQL login

    Related: B2B collaboration (Microsoft Entra External ID)

  • Microsoft Entra ID Protection

    Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.

    Prerequisites: Conditional Access、Microsoft Entra ID

  • ExpressRoute FastPath

    An option that, on supported SKUs, bypasses the virtual network gateway in the ExpressRoute data path for lower latency and higher throughput (normally the path traverses the gateway). Certain configurations (e.g., via UDRs or load balancers) are excluded from FastPath support.

    Prerequisites: ExpressRoute、Virtual network (VNet)、ExpressRoute gateway

    Related: ExpressRoute Direct

  • Azure Event Grid

    Reactive pub/sub delivering discrete events (e.g., "blob created"); subscribe via event subscriptions and react in near real time.

    Prerequisites: Blob storage、Subscription (Azure)

  • Forced tunneling and gateway transit

    Forced tunneling routes outbound internet via on-prem with a UDR; gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway.

    Prerequisites: ExpressRoute、ExpressRoute gateway

  • Log Analytics workspace

    A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.

    Prerequisites: Azure Monitor、Retention policy、Microsoft Sentinel

  • Point-to-site VPN (P2S)

    Connects individual client devices to an Azure VNet; choose a tunnel type and authentication (certificate, RADIUS, Microsoft Entra ID) and distribute a VPN client configuration.

    Prerequisites: Authentication (AuthN)、Microsoft Entra ID、Virtual network (VNet)、VPN Gateway

  • Private DNS zone

    A DNS zone valid only inside VNets; link it to a VNet to resolve internal or privatelink names to private IPs—key to operating private endpoints.

    Prerequisites: Virtual network (VNet)、Private endpoint

  • Site-to-site VPN (S2S)

    Connects an on-prem site to an Azure VNet over a persistent IPsec tunnel; configure a VPN gateway and an on-prem local network gateway.

    Prerequisites: Virtual network (VNet)、VPN Gateway

  • Access management (RBAC / least privilege / JIT)

    Role-based access control (RBAC) grants permissions by job function, applies least privilege, and PIM just-in-time (JIT) elevation enables privileges only when needed.

    Prerequisites: Role-based access control (RBAC)

  • Sensitivity labels

    Classify data and apply protection (encryption, usage limits); labels travel with the file, persisting outside the org.

    Prerequisites: Encryption

  • SIEM

    Security Information and Event Management: centrally collects logs and events from many sources (servers, network gear, apps) and correlates them to detect threats. Products like Microsoft Sentinel, Google SecOps, and Splunk fill this role.

    Related: Microsoft Sentinel

  • Database user

    A database-level security principal in SQL Server (and Azure SQL), mapped to a login, whose role memberships and GRANT/DENY/REVOKE determine authorization to objects. DENY is a T-SQL-specific permission state unique to SQL Server—PostgreSQL and MySQL have no equivalent. Contrasted with a contained user, which is created without a login.

    Prerequisites: Authorization (AuthZ)、Permissions (GRANT/DENY/REVOKE, least privilege)、SQL login

    Related: Contained database user

  • VPN gateway SKU and redundancy

    The SKU determining a VPN gateway’s performance/bandwidth/tunnel count; for availability use active/active or zone-redundant configurations.

    Prerequisites: Redundancy (LRS/ZRS/GRS/GZRS)、VPN Gateway、CIA triad、Zone redundancy (Azure SQL)

  • Zero Trust

    The principle of "never trust, always verify"; verify identity, device, and context on every access, even inside.

  • Data classification (SITs / trainable classifiers)

    Data classification identifies content using sensitive information types (patterns like credit cards or national IDs) and trainable classifiers. It informs where to apply sensitivity labels and DLP.

    Prerequisites: Sensitivity labels

    Related: SQL data classification

  • ACR (Azure Container Registry)

    A private registry to store/manage container images; ACR Tasks builds in the cloud, and authentication uses a managed identity.

    Prerequisites: Authentication (AuthN)、Container image、Managed identity

  • Azure App Configuration

    A service to centrally manage app settings and feature flags; centralizes config, references Key Vault for secrets, and enables progressive rollout via flags.

    Prerequisites: App Service configuration (settings, TLS, connections)、Azure Key Vault

    Related: Feature flags

  • App Service configuration (settings, TLS, connections)

    Configure app settings/connection strings (injected as env vars), custom-domain TLS/certs, and service connections; secrets can use Key Vault references.

    Prerequisites: Azure App Service、Azure Key Vault

  • Access tiers (Hot/Cool/Cold/Archive)

    Blob tiers optimizing storage cost by access frequency; lower tiers cost less to store but are slower/costlier to retrieve.

    Prerequisites: Blob storage

  • Management group

    The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.

    Prerequisites: Subscription (Azure)

  • Network security group (NSG)

    Applies allow/deny rules by source/destination/port at the subnet or NIC level.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Redundancy (LRS/ZRS/GRS/GZRS)

    Resilience set by number/scope of copies: LRS<ZRS<GRS<GZRS; GRS/GZRS replicate to another region.

    Prerequisites: Region (Azure)

  • Availability set (fault/update domains)

    Spreads VMs within one datacenter across fault domains (power/network/rack) and update domains (planned-maintenance units) to avoid simultaneous impact from unplanned failures and planned maintenance. Use availability zones for datacenter-level failures.

    Prerequisites: Availability zone、CIA triad

  • Self-service password reset (SSPR)

    An Entra feature letting users reset passwords without an admin, requiring multiple authentication methods and supporting password writeback to on-prem.

    Prerequisites: Authentication (AuthN)

  • Azure Data Lake Storage Gen2

    A data lake for large-scale analytics that adds a hierarchical namespace on top of Blob storage. With directory structure and POSIX-like ACLs, it serves as the storage layer for Synapse/Databricks analytics.

    Prerequisites: Blob storage、Azure Databricks、Azure Synapse Analytics

  • Hub-spoke network topology

    A design that centralizes shared services (firewall, gateway, DNS) in a hub VNet with spoke VNets connected by peering; can also be realized in a managed way via Virtual WAN.

    Prerequisites: Virtual network (VNet)、Azure Virtual WAN

  • Azure landing zone (CAF)

    A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.

    Prerequisites: Management group、Hub-spoke network topology

    Related: Azure landing zone

  • AKS security

    Secures Kubernetes workloads via AKS network isolation (private clusters, network policies), Entra-integrated authentication/authorization, and monitoring with Defender for Containers.

    Prerequisites: Authentication (AuthN)、Authorization (AuthZ)、Defender for Containers

  • BYOK and infrastructure encryption

    BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.

    Prerequisites: Customer-managed keys (CMK) / Platform-managed keys (PMK)、Encryption

  • Just-In-Time (JIT) VM access

    A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.

    Prerequisites: Microsoft Defender for Cloud

    Related: Azure Bastion

  • Azure landing zone

    A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.

    Prerequisites: Management group、Subscription (Azure)

    Related: Azure landing zone (CAF)

  • AzCopy

    A command-line tool for fast bulk copy/upload/download to and from Blob storage/file shares. Supports parallel transfer and resumable checkpoints, better suited to scripting/automation than the GUI Storage Explorer. Authenticates via Microsoft Entra ID or a SAS token.

    Prerequisites: Blob storage、Microsoft Entra ID

    Related: Azure Storage Explorer

  • Azure Database for MySQL

    A managed relational service for the open-source MySQL engine. The current offering is the Flexible Server, supporting same-zone placement for latency optimization and flexible compute/storage scaling; Azure handles patching, backups, and failover.

    Prerequisites: Availability zone、CIA triad

    Related: Azure Database for PostgreSQL

  • Azure Database for PostgreSQL

    A managed relational service for the open-source PostgreSQL engine. The current offering is the Flexible Server, supporting availability-zone placement, burstable SKUs, and fine-grained maintenance windows; Azure handles patching, backups, and failover.

    Prerequisites: Availability zone、CIA triad

    Related: Azure Database for MySQL

  • Azure Site Recovery (ASR)

    A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.

    Prerequisites: Region (Azure)

    Related: Azure Backup

  • Azure DDoS Protection

    Detects and absorbs DDoS attacks that flood a service, protecting availability.

    Prerequisites: CIA triad

  • Automatic tuning (plan forcing)

    Azure SQL automatically creates recommended indexes and applies FORCE LAST GOOD PLAN (forcing the last known good plan) on regressions.

    Prerequisites: Index

  • Session blocking

    When one session waits on locks held by another. Identify long blocks and deadlock signs via DMVs and resolve via queries, indexes, or isolation levels.

    Prerequisites: Index

  • Business Critical tier

    An Azure SQL service tier delivering low latency and high availability via local SSD and built-in Always On replicas. It includes a secondary for read scale-out.

    Prerequisites: CIA triad

    Related: Read scale-out

  • Dynamic management views (DMVs)

    Views that expose live internal server/database state (waits, blocking, index usage, etc.) queryable via SQL.

    Prerequisites: Index、Session blocking

  • Elastic pool

    Shares compute resources (eDTUs/vCores) across multiple Azure SQL Databases, optimizing cost for many DBs with offset usage peaks.

    Prerequisites: Azure SQL Database、Purchasing models (vCore / DTU)

  • Execution plan

    A diagram of how a query executes. Inspect scan vs seek, key lookups, and non-SARGable predicates to decide index or rewrite improvements.

    Prerequisites: Index

  • Database migration (assess, DMS, online/offline)

    Moving from on-prem to Azure SQL. First assess (Data Migration Assistant / Azure Migrate for compatibility, target, SKU sizing), then execute (Azure Database Migration Service or the Azure SQL Migration extension; Log Replay Service for MI). Choose offline (bulk copy, downtime) or online (continuous sync with a final cutover, minimal downtime). After migrating, adjust the compatibility level and check regressions via Query Store. Pick the target by need for instance features, OS control, and tolerable downtime.

    Prerequisites: Log Replay Service (LRS)、Online vs offline migration、Query Store

  • eDiscovery

    Searches, preserves (holds), collects, and exports relevant content for litigation or investigations.

  • Azure Event Hubs

    High-throughput ingestion of large streaming/telemetry; processed in parallel via partitions and consumer groups.

  • Azure Functions hosting plans

    Choosing billing/performance for the runtime: Flex Consumption (current default—fast scale, VNet, always-ready instances), the older Consumption (auto-scale, cold starts), Premium (pre-warmed, VNet), and Dedicated (App Service plan).

    Prerequisites: Azure App Service、Azure Functions、Virtual network (VNet)

  • Key Vault objects (keys/secrets/certificates, dev)

    Securely fetching and using secrets, keys, and certificates from code; avoid hard-coding (e.g., connection strings)—use Key Vault references or managed identity.

    Prerequisites: Azure Key Vault、Managed identity

  • Outbound rules and SNAT (Load Balancer)

    Translates (SNATs) the source address of outbound traffic from backend-pool VMs to the Load Balancer's frontend IP, enabling outbound connectivity for VMs without a public IP. Outbound rules control port allocation—watch for SNAT port exhaustion under heavy outbound load.

    Related: Inbound NAT rule、Load-balancing rule

  • Load-balancing rule

    A rule that distributes inbound traffic received on a Load Balancer frontend IP/port across a backend pool, based on health-probe results. The default is 5-tuple hash distribution, with session persistence (source-IP affinity) configurable.

    Prerequisites: Hashing

    Related: Outbound rules and SNAT (Load Balancer)

  • Messages vs events

    A message is a command the sender expects to be handled (Service Bus/Queue); an event is a notification of something that happened (Event Grid/Event Hubs)—a key selection axis.

    Prerequisites: Azure Event Grid、Azure Event Hubs、Azure Service Bus

  • Azure NAT Gateway

    Outbound-only NAT for a subnet; provides stable egress and avoids SNAT port exhaustion (does not provide inbound).

    Prerequisites: Outbound rules and SNAT (Load Balancer)

    Related: Private endpoint、User-defined route (UDR)

  • Microsoft Defender for AI services

    A cloud workload protection plan in Microsoft Defender for Cloud (officially Microsoft Defender for AI services; formerly Defender for AI workloads). Detects and alerts on runtime threats to AI workloads (prompt-injection attempts, credential misuse, sensitive-data exfiltration, etc.). Posture is visualized in the Data and AI Security dashboard.

    Prerequisites: Microsoft Defender for Cloud、Microsoft Defender XDR、Cloud Workload Protection (CWP)

  • Defender for Servers

    Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.

    Prerequisites: Azure Arc、Just-In-Time (JIT) VM access

  • Microsoft Entra Agent ID

    Gives autonomous AI agents an identity and governs their access with conditional access. Analyze the compromise blast radius in Defender XDR and minimize/revoke access.

    Prerequisites: Conditional Access、Microsoft Defender XDR、Permissions (GRANT/DENY/REVOKE, least privilege)

  • Secured Virtual Hub

    A virtual hub with Azure Firewall embedded, centrally applying policy across hubs via Firewall Manager to inspect traffic centrally.

    Prerequisites: Azure Firewall、Virtual hub (Virtual WAN)

  • Azure Service Bus

    An enterprise message broker supporting ordering, transactions, dedup, and dead-lettering; used for reliable command delivery.

  • SQL Managed Instance

    A PaaS with near-full SQL Server compatibility; good for migrating existing SQL Server (lift-and-shift).

  • System routes

    Default routes Azure auto-provides for intra-VNet, peering, gateways, and default internet; can be overridden by UDRs.

    Prerequisites: Virtual network (VNet)

  • TLS

    A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.

    Prerequisites: Authentication (AuthN)、Encryption

    Related: HTTPS

  • Virtual hub (Virtual WAN)

    The managed hub at the core of Virtual WAN; hosts VPN/ExpressRoute/P2S gateways and connections, transiting spokes via hub routing.

    Prerequisites: ExpressRoute

    Related: Azure Virtual WAN

  • WAF policy and detection/prevention modes

    A Web Application Firewall config associated with Application Gateway or Front Door; choose detection mode (log only) or prevention mode (block), using OWASP rule sets to stop common attacks.

    Prerequisites: Application Gateway、Web Application Firewall (Azure WAF)、Azure Front Door

  • Developer portal (APIM)

    An auto-generated portal for API consumers offering documentation, try-it, and subscription sign-up.

    Prerequisites: Subscription (Azure)

    Related: Azure API Management (APIM)

  • Named values (APIM)

    Centralizes constants/secrets used in policies; secrets are referenced securely via Key Vault integration.

    Prerequisites: Azure Key Vault

    Related: Azure API Management (APIM)

  • Products and subscriptions (APIM)

    Bundles APIs as "products" that consumers use via subscriptions (keys); manages exposure and terms per product.

    Prerequisites: Subscription (Azure)

    Related: Azure API Management (APIM)

  • Diagnostics and logging (App Service)

    Collecting app/web-server/detailed-error logs and viewing the live log stream; integrates with App Insights for monitoring.

    Prerequisites: Azure App Service

  • Azure Functions

    The flagship serverless (FaaS): event-driven function execution billed only for what runs.

  • Azure Policy

    Defines/enforces rules (allowed regions, required tags, etc.) that resources must meet and evaluates compliance.

    Prerequisites: Region (Azure)、Tags (Azure)

  • Tags (Azure)

    key=value labels on resources for cost reporting/organization and governance with Policy.

  • Azure Virtual Machines (VM)

    IaaS virtual machines; the most flexible compute where you manage the OS and above.

  • Storage account kinds and performance

    General-purpose v2 (GPv2) is the standard handling Blob/File/Queue/Table. Performance is Standard (HDD) or Premium (SSD, low latency); Premium splits into BlockBlob/FileShare/Page kinds.

    Prerequisites: Blob storage、Azure storage account

  • Scale set autoscaling

    Automatically scales a virtual machine scale set’s instance count by metrics (e.g., CPU) or schedule, with scale-in/out rules and min/max bounds.

    Prerequisites: Azure Virtual Machines (VM)、Virtual machine scale sets (VMSS)

  • Azure Pipelines

    A CI/CD pipeline service defined as code (YAML). Composed of stages → jobs → steps, triggered by push/PR/schedule, and reused via templates. Runs on Microsoft-hosted or self-hosted agents.

  • App Service Environment (ASE)

    A dedicated, isolated App Service environment integrated into a virtual network, used for sensitive workloads needing network isolation and high scale.

    Prerequisites: Azure App Service、Virtual network (VNet)

  • Azure Bastion

    A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.

    Prerequisites: Azure portal and Marketplace

    Related: Just-In-Time (JIT) VM access

  • Encryption over ExpressRoute

    Ways to encrypt traffic over the private ExpressRoute circuit: MACsec on the link itself, or an IPsec VPN layered over ExpressRoute.

    Prerequisites: ExpressRoute、Encryption

  • Key rotation and backup

    Periodically auto-rotates Key Vault keys/secrets/certificates to reduce leak risk, and uses backup/restore to guard against accidental deletion or failure.

    Prerequisites: Azure Key Vault、Key Vault objects (keys/secrets/certificates, dev)

  • Workflow automation (Defender for Cloud)

    Triggers Logic Apps on security alerts or recommendations to automate responses like notifications, ticketing, and remediation.

    Prerequisites: Microsoft Defender for Cloud、Azure Logic Apps

  • BGP and route propagation

    The standard protocol for dynamically exchanging routes between on-prem and the Azure gateway. Peers are identified by ASN; the Azure gateway’s default ASN is 65515 and on-prem sets its own. Enabling BGP on a VPN auto-learns on-prem subnet changes, removing UDR edits. ExpressRoute always exchanges routes via BGP (private/Microsoft peering). Reflecting learned routes into the VNet is route propagation; disabling it on a route table lets UDRs reliably win. With multiple routes to the same destination, ExpressRoute is preferred over VPN (basis for backup-VPN designs). Precedence: longest-prefix match, then UDR > BGP > system.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • Azure Storage Explorer

    A standalone GUI app (Windows/macOS/Linux) to browse, upload, and manage Blob storage, file shares, queues, and tables. Suited to inspecting small amounts of data, manual operations, and quick permission tweaks; use AzCopy for high-speed bulk transfer.

    Prerequisites: Blob storage

    Related: AzCopy

  • Blob access tiers

    Cost-optimization tiers by access frequency: hot (frequent), cool (infrequent), cold, and archive (rarely accessed, slow to rehydrate).

    Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

  • Blob lifecycle management

    Policies that auto-move blobs across access tiers (hot→cool→archive) or delete them after N days; optimizes storage cost.

    Prerequisites: Access tiers (Hot/Cool/Cold/Archive)、Blob storage

  • Container image

    An immutable package of an app and its dependencies; built from a Dockerfile, pushed to a registry (ACR), and run by services.

  • Consistency levels (Cosmos DB)

    Five levels trading read consistency against performance/availability: strong → bounded staleness → session (default) → consistent prefix → eventual.

    Prerequisites: CIA triad、Azure Cosmos DB

  • Azure DNS Private Resolver

    A managed service brokering DNS resolution between on-prem and Azure; conditional forwarders route specific domains to the right DNS.

    Prerequisites: Azure DNS (public zones)

  • Active geo-replication

    A DR feature asynchronously creating a readable secondary in another region. It supports manual failover and up to four secondaries.

    Prerequisites: Region (Azure)

  • Azure Arc-enabled SQL

    Connects on-prem or other-cloud SQL Server to Azure via Azure Arc to centrally manage inventory, assessment, updates, and services like Defender/Purview.

    Prerequisites: Azure Arc、Microsoft Purview

  • SQL data classification

    A strategy that labels columns with sensitivity and information types to identify and surface sensitive data, combined with auditing to govern its handling.

    Related: Data classification (SITs / trainable classifiers)

  • Dynamic data masking

    Masks sensitive data in query results without changing the stored data. Users with the UNMASK permission see the real values.

    Prerequisites: Sensitive data protection (PII / masking)

  • Elastic Jobs

    Automation for Azure SQL Database. Uses a job agent and job DB to run T-SQL in parallel across DBs via target groups.

    Prerequisites: Azure SQL Database

  • Failover groups

    A DR feature connecting a group of DBs via listeners and failing them over automatically without changing the connection string.

  • Geo-restore

    A DR option restoring from GRS geo-redundant backups to another region. Because the copy is asynchronous, RPO is larger.

    Prerequisites: Region (Azure)

  • Hyperscale tier and page servers

    An Azure SQL service tier scaling to ~100TB. Page servers separate storage to enable snapshot-based fast backup/restore and rapid scaling.

  • Intelligent query processing (IQP)

    A set of features that improve query performance without rewrites (adaptive joins, memory-grant feedback, batch mode, etc.), enabled via compatibility level.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Long-term retention (LTR)

    Retains weekly/monthly/yearly backups for up to 10 years, meeting compliance requirements.

    Prerequisites: Retention policy

  • Online vs offline migration

    Offline is a bulk copy with downtime; online continuously syncs changes with a final cutover for minimal downtime. Choose by tolerable downtime.

  • SQL auditing (server/database)

    Records database events to Log Analytics, Storage, or Event Hubs. Server audit applies to all DBs; database audit applies individually.

    Prerequisites: Azure Event Hubs

  • Always Encrypted with VBS enclaves

    Always Encrypted using virtualization-based security (VBS) enclaves, enabling server-side operations like range comparisons and pattern matching on still-encrypted data.

    Prerequisites: Always Encrypted、Encryption

  • Purchasing models (vCore / DTU)

    vCore is a flexible model where you size CPU, memory, and storage separately, with Azure Hybrid Benefit and reserved discounts (recommended). DTU is a simple blended metric of compute and storage.

    Related: Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

  • B2B collaboration (Microsoft Entra External ID)

    Invites users from external organizations (e.g., partners) as guests, letting them collaborate using their own existing identity. Now unified under Microsoft Entra External ID, invitations and permissions are governed via Conditional Access and cross-tenant access settings. An invited guest is registered as a guest user object within the inviting organization's own tenant and authenticates with their external organization's credentials—no separate tenant is created for the guest.

    Prerequisites: Conditional Access

    Related: B2C (Azure AD B2C)

  • ExpressRoute peering (private/Microsoft)

    ExpressRoute peering types: private peering reaches VNets; Microsoft peering reaches public Microsoft 365/PaaS over the private circuit. Always exchanged via BGP.

    Prerequisites: ExpressRoute、Virtual network (VNet)

  • ExpressRoute Direct

    An ExpressRoute form that connects directly to Microsoft's edge routers over dedicated 10 Gbps or 100 Gbps port pairs, without going through a connectivity provider. Multiple ExpressRoute circuits can be carved out of one physical connection, suited to workloads needing very high bandwidth and low latency.

    Prerequisites: ExpressRoute

    Related: ExpressRoute FastPath

  • Azure Functions triggers

    What starts a function—HTTP (request), timer (schedule), Blob/Queue/Event (data ops), webhooks; one trigger per function.

    Prerequisites: Blob storage、Azure Functions

  • HTTPS

    HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.

    Prerequisites: Encryption

    Related: TLS

  • Inbound NAT rule

    A Load Balancer rule that forwards traffic on a specific frontend port to a specific port on one VM in the backend pool—pinpoint forwarding, unlike a load-balancing rule's distribution across many backends. Commonly used to expose RDP/SSH to individual VMs.

    Prerequisites: Load-balancing rule

    Related: Outbound rules and SNAT (Load Balancer)

  • Queue storage

    A message queue to decouple components and smooth processing spikes.

  • Advanced hunting (KQL)

    Uses KQL in Defender XDR / Sentinel to proactively hunt threats across telemetry, turning queries into analytics rules for automated detection.

    Prerequisites: Microsoft Defender XDR、Microsoft Sentinel

  • Azure Virtual Network Manager

    Groups many VNets as network groups and centrally applies connectivity and security admin rules. Security admin rules are higher-priority rules evaluated before NSGs, enforcing org-wide guardrails teams cannot override.

    Prerequisites: Virtual network (VNet)

    Related: Azure Virtual Network Manager

  • Data collection rules (DCR)

    Rules in Microsoft Sentinel/Azure Monitor defining what is collected from which sources. Used to collect Windows Security events; many servers can be aggregated first via Windows Event Forwarding (WEF).

    Prerequisites: Azure Monitor、Microsoft Sentinel

  • Defender CSPM

    Cloud Security Posture Management. Surfaces config weaknesses as recommendations, visualizes connected risk via attack path analysis, and finds hard-coded secrets via secret scanning—proactive posture, a separate pillar from runtime threat detection (CWP).

  • Defender for Databases

    Provides threat protection across Azure database services, detecting suspected SQL injection, anomalous logins, and unusual sensitive-data access (formerly Advanced Threat Protection). Distinct from SQL auditing, which records.

    Prerequisites: SQL auditing (server/database)、SQL login

  • Defender for Key Vault

    A threat-protection plan that detects anomalous access patterns to a Key Vault (unusual locations, bulk retrieval) at runtime. Distinct from Defender CSPM secret scanning, which proactively finds hard-coded secrets.

    Prerequisites: Azure Key Vault、Defender CSPM

  • Compliance Manager and compliance score

    Microsoft Purview Compliance Manager visualizes conformance to regulations/standards via improvement actions and a compliance score, helping prioritize risk reduction.

    Prerequisites: Microsoft Purview

  • Entra identity types

    Identity types managed by Microsoft Entra: users (member/guest), groups, devices, and workload identities (service principals/managed identities) representing apps and services.

    Prerequisites: Managed identity

  • Records management and data lifecycle

    Microsoft Purview records management declares regulated documents as immutable "records" via retention labels and deletes them after a disposition review past the retention period, integrating with data lifecycle management.

    Prerequisites: Microsoft Purview、Retention policy

  • Topics and subscriptions (Service Bus)

    Pub/sub that fans one message to multiple receivers; each subscription can filter which messages it receives.

    Prerequisites: Subscription (Azure)、Azure Service Bus

  • Service chaining (via NVA)

    Sets the UDR next hop to an NVA (network virtual appliance/firewall) to force traffic through it; enable IP forwarding on the NVA and front it with an internal Load Balancer for redundancy.

    Prerequisites: Azure Load Balancer

  • SOAR

    Security Orchestration, Automation and Response: automates and orchestrates the post-detection response (investigation, containment, notification) to alerts from a SIEM via playbooks, cutting analyst repetitive work and response time.

    Prerequisites: SIEM

  • Virtual network flow logs

    Logs allowed/denied traffic to Storage (successor to NSG flow logs); visualized via Traffic Analytics to analyze traffic patterns and anomalies.

    Prerequisites: Virtual network (VNet)

  • Azure Virtual Network Manager

    Centrally manages connectivity (mesh/hub-and-spoke) and security rules across many VNets, applying config to network groups at once.

    Prerequisites: Virtual network (VNet)

    Related: Azure Virtual Network Manager

  • VNet peering

    Connects two VNets over the Microsoft backbone with low latency; non-transitive by default (A-B-C does not give A↔C), so hub transit needs UDRs or gateway transit.

    Prerequisites: Virtual network (VNet)、Forced tunneling and gateway transit

  • Communication Compliance

    Microsoft Purview Communication Compliance detects inappropriate language or policy violations in email and chat and flags them as policy violations.

    Prerequisites: Microsoft Purview

  • API Management policies

    XML rules controlling API behavior (inbound/backend/outbound/on-error); apply auth (validate-jwt), rate limiting, transformation, caching, and CORS.

    Related: Azure API Management (APIM)

  • App Service autoscaling

    Adjusts instance count to follow load. Choose rule-based Autoscale (scale on metrics like CPU/memory or schedules) or platform-managed automatic scaling. Balances cost and performance.

    Prerequisites: Azure App Service

  • Deploying to App Service

    Ways to deploy code or containers to App Service (ZIP deploy, container deploy, CI/CD); combine with slots for zero downtime.

    Prerequisites: Azure App Service

  • Application Insights

    An APM service for apps; collects requests, dependencies, exceptions, metrics, logs, and traces to analyze performance and failures. Part of Azure Monitor.

    Prerequisites: Azure Monitor

  • ARM template

    The foundational JSON format for declaratively describing Azure resource configuration as IaC. Deploying the same template repeatedly converges to the same state (idempotent), with parameter files swapping per-environment values. Deployments are incremental (default) or complete mode—complete mode deletes resources not present in the template, a common gotcha.

  • Azure Advisor

    Recommends improvements for your resources across cost, security, reliability, performance, and operations.

  • Resource lock

    A safety net preventing deletion or change (CanNotDelete / ReadOnly), stopping mistakes even by authorized users.

  • Azure Service Health

    Notifies you of Azure-side incidents, planned maintenance, and health (distinct from Advisor, which advises on your resources).

    Prerequisites: Azure Advisor

  • Blob protection (soft delete, versioning, object replication)

    Blob/container soft delete recovers from accidental deletion, versioning keeps history, and object replication asynchronously copies to another account.

    Prerequisites: Blob storage

  • Azure File Sync

    A service that syncs on-prem Windows file servers with Azure Files. Cloud tiering moves infrequently accessed files to the cloud to save local capacity.

    Prerequisites: Azure Files (File storage)

  • Managed disks

    Block storage for VM disks managed by Azure. Types include Ultra, Premium SSD v2, Premium SSD, Standard SSD, and Standard HDD, with snapshots and disk encryption (SSE/ADE).

    Prerequisites: Encryption

  • VM extensions and custom script

    Mechanisms to add configuration/automation to a VM. The Custom Script Extension runs scripts at boot, and DSC and the Azure Monitor Agent are also deployed as extensions.

    Prerequisites: Azure Monitor

  • Azure Logic Apps

    A service that integrates workflows with no-code/low-code using many connectors. It links SaaS, on-prem, and Azure services via triggers/actions to automate business processes and connect systems.

  • Environments and approvals/gates (Azure Pipelines)

    Environments representing deploy targets (Dev/Test/Staging/Prod) and checks that control deployment to them. Combine approvals (human sign-off), gates (automated checks like monitoring queries), branch control, business hours, and required templates to protect production resources.

    Prerequisites: Azure Pipelines

  • Feature flags

    A mechanism that decouples deployment (placing code in prod) from feature enablement (release). Managed via Azure App Configuration Feature Manager, etc., enabling staged rollout, A/B testing, and instant disable (kill-switch) without redeploy.

    Related: Azure App Configuration

  • Security testing (SAST/DAST/SCA)

    Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).

    Prerequisites: Container image

  • Variable groups and Key Vault integration

    Variable groups bundle settings shared across pipelines, with secrets retrieved securely via Azure Key Vault integration; secure files handle certificates, etc.

    Prerequisites: Azure Key Vault

  • YAML pipelines and templates

    Defines pipelines as code (YAML) with stages, jobs, and steps. Templates reuse common logic, and multi-stage pipelines combine CI and CD to multiple environments in one definition.

    Prerequisites: Azure Pipelines

  • Confidential disk encryption and double encryption

    In addition to confidential disk encryption that protects confidential-VM disks with virtualization-based security, you can configure double encryption layering platform and customer keys.

    Prerequisites: Encryption

  • Custom roles (Azure / Entra roles)

    When built-in roles lack granularity, define custom roles that allow only the needed actions. Azure resource roles and Microsoft Entra roles are managed as separate systems.

  • Defender for Cloud DevOps security

    Connects GitHub, Azure DevOps, and GitLab to Defender for Cloud to detect misconfigurations, exposed secrets, and vulnerabilities in code and pipelines.

    Prerequisites: Microsoft Defender for Cloud

  • Defender Vulnerability Management

    Continuously detects known vulnerabilities (CVEs) on VMs and containers, with prioritization and remediation guidance, built into Defender for Servers/Containers.

    Prerequisites: Defender for Servers

  • Microsoft Cloud Security Benchmark (MCSB)

    Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.

    Prerequisites: Microsoft Defender for Cloud

  • Regulatory compliance (standards / custom)

    Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.

    Prerequisites: Microsoft Defender for Cloud

  • Blob versioning

    A Blob storage protection that automatically keeps prior versions on each overwrite/delete to enable recovery from mistakes, used with soft delete and immutable storage.

    Prerequisites: Blob storage

  • SLA and composite SLA

    A service level agreement (SLA) is an uptime commitment. Combining services in series makes the composite SLA the product of each, lowering overall availability—offset with redundancy.

    Prerequisites: CIA triad

  • Azure portal and Marketplace

    The Azure portal is a web console to manage resources via GUI. Azure Marketplace lets you buy and deploy Microsoft/third-party solutions. A mobile app also monitors/operates resources.

  • Azure support plans

    Choose among Basic (free, billing/subscription), Developer (trial), Standard (production), and Professional Direct (business-critical), differing in response time and architecture guidance.

    Prerequisites: Subscription (Azure)

  • Azure CDN

    Caches static content at edge for low-latency delivery. The Microsoft standard profile is current; legacy Verizon/Edgio profiles are being retired. New workloads are recommended to use Azure Front Door (with integrated CDN). Updates apply via purge.

    Prerequisites: Azure Front Door

  • Azure Databricks

    An Apache Spark-optimized platform for big-data processing and ML; strong for data science.

  • Azure DNS (public zones)

    Hosts a domain’s public DNS records in Azure, providing internet name resolution.

  • Azure Files (File storage)

    SMB/NFS file shares mountable from multiple machines simultaneously.

  • Azure Firewall rules

    Azure Firewall’s three rule types: DNAT rules translate/forward inbound, network rules control L3-L4 by IP/port/protocol, and application rules control L7 by FQDN.

    Prerequisites: Azure Firewall

  • Azure Pricing Calculator

    A web tool that estimates the monthly cost of a planned Azure configuration. Enter region, SKU, usage hours, and data transfer to get a per-service cost estimate, useful for comparing designs or drafting proposals; actual billing can differ due to FX rates and real usage.

    Prerequisites: Region (Azure)

  • Azure Synapse Analytics

    A platform unifying large-scale data warehousing and integrated analytics (SQL, Spark, pipelines). Its capabilities are being integrated into the next-generation Microsoft Fabric, which is recommended for new workloads.

  • Bidirectional Forwarding Detection (BFD)

    A protocol that quickly detects failures between adjacent routers; on ExpressRoute it speeds BGP convergence and failover.

    Prerequisites: ExpressRoute

  • Bicep

    A DSL offering more concise syntax than ARM template JSON. Running az bicep build compiles it into an equivalent ARM template JSON, which is what actually gets deployed. Modules and loop syntax improve readability and reuse.

    Prerequisites: ARM template

  • Blob properties and metadata

    Setting/getting a blob’s system properties (e.g., Content-Type) and user-defined key/value metadata.

    Prerequisites: Blob storage

  • Blob operations with the SDK

    Development operations to create/upload/download/list containers and blobs via BlobServiceClient/ContainerClient/BlobClient.

    Prerequisites: Blob storage

  • Connection Monitor

    A Network Watcher feature that continuously monitors reachability, latency, and packet loss between endpoints, detecting route changes and failures.

  • Change feed (Cosmos DB)

    A persistent log of creates/updates in order; used for event processing, materialized views, and syncing to other stores (deletes not included by default).

    Prerequisites: Azure Cosmos DB

  • Partition key (Cosmos DB)

    The property that distributes data into logical partitions; pick a high-cardinality, evenly distributed value to avoid hot partitions and use RU/s efficiently.

    Prerequisites: Azure Cosmos DB

  • Cosmos DB operations with the SDK

    Development operations to create/read/query/update databases/containers/items via CosmosClient; request cost is measured in RUs.

    Prerequisites: Azure Cosmos DB

  • Cross-region Load Balancer

    Bundles regional Load Balancers behind one global IP for geo-redundancy and low-latency routing.

    Prerequisites: Region (Azure)

  • Deployment slots

    In App Service, deploy to a separate environment (e.g., staging) and swap after warm-up for zero-downtime releases, with easy rollback.

    Prerequisites: Azure App Service

  • Azure Automation (runbooks)

    A service automating cross-cloud/on-prem operations via PowerShell/Python runbooks. Hybrid Workers enable on-prem execution.

  • General Purpose tier

    The balanced Azure SQL service tier. It separates compute from remote storage, suiting general-purpose workloads that balance cost and performance.

  • Index and statistics maintenance

    Reorganizing/rebuilding fragmented indexes and updating statistics on a schedule to keep performance. Typically scheduled via automation (jobs).

    Prerequisites: Index

  • Integrity checks (DBCC CHECKDB)

    A command that checks a database for logical and physical corruption. Run regularly to detect corruption early and, with backups, ensure data integrity.

  • Intelligent Insights

    An Azure SQL feature that automatically detects performance problems and emits root causes and recommendations as diagnostic logs.

    Prerequisites: Diagnostics and logging (App Service)

  • Managed Instance database copy and move

    Native operations to copy (replicate) or move (transfer) a database between SQL Managed Instances, used for instance reorganization or environment separation.

    Prerequisites: SQL Managed Instance

  • Object-level encryption

    Encrypts specific columns or objects (cell-level encryption with certificates/symmetric keys). Its granularity differs from TDE, which encrypts the whole database.

    Prerequisites: Encryption

  • Row-level security (RLS)

    Restricts which rows each user can see using a security predicate (function). Used for tenant isolation and scoping access by responsibility.

  • Serverless compute (Azure SQL)

    An Azure SQL compute tier that auto-scales by usage and auto-pauses when idle to stop per-second billing. It suits intermittent workloads.

  • Azure SQL Database in Microsoft Fabric

    Azure SQL Database integrated inside Microsoft Fabric, tightly tied to OneLake mirroring and Fabric’s analytics experience.

    Prerequisites: Azure SQL Database

  • Wait statistics

    Metrics showing what sessions wait on (I/O, locks, CPU, etc.). They are the starting point for classifying bottlenecks.

  • Local network gateway

    An Azure object representing the "on-prem side" of an S2S VPN; registers the on-prem public IP and address space (or BGP settings).

    Prerequisites: Site-to-site VPN (S2S)

  • Microsoft Priva

    A solution to manage personal-data privacy risks and handle data subject requests (DSRs), detecting and remediating over-retention or oversharing of personal data.

    Prerequisites: Retention policy

  • Microsoft Secure Score

    A measure that quantifies an organization’s security posture with recommended improvement actions and progress, viewed in the Microsoft Defender portal.

    Prerequisites: Microsoft Defender XDR

  • NSG security rules

    NSG inbound/outbound rules evaluated by priority; allow/deny by source/destination (IP, ASG, service tag), port, and protocol, with default rules evaluated last.

    Prerequisites: Permissions (GRANT/DENY/REVOKE, least privilege)

  • Authorization flows (OAuth2/OIDC)

    Token-acquisition flows: authorization code flow for interactive users, client credentials flow for daemons/service-to-service; choose by scenario.

    Prerequisites: Authorization (AuthZ)

  • Packet capture (Network Watcher)

    A Network Watcher feature that captures a VM’s traffic for analysis; used to isolate app-layer issues invisible to NSG checks.

  • Public-key cryptography (asymmetric)

    Encrypt with a public key and decrypt with a private key (or sign with the private key and verify with the public key). It solves key distribution and underpins TLS, SSH, code signing, and certificates; slower than symmetric, so data is encrypted with a symmetric key that is itself protected by the public key (envelope).

    Prerequisites: Encryption

  • Azure Route Server

    A managed service that exchanges routes via BGP between an NVA and Azure, reflecting NVA routes into the VNet without manual UDR updates.

    Prerequisites: Virtual network (VNet)

  • AI Gateway (API Management)

    Placed in Azure API Management to centrally authenticate, rate-limit, monitor, and manage token consumption for Microsoft Foundry model access, hiding backend keys. Distinct from Foundry guardrails (model/agent-side safety filters).

    Prerequisites: Azure API Management (APIM)

  • Defender for Containers

    A Defender plan that detects container misconfigurations and runtime risks (suspicious processes, known exploits). Complements image vulnerability scanning and trusted-image allowance in ACR.

  • Purview DSPM for AI

    Microsoft Purview Data Security Posture Management for AI. Visualizes sensitive-data risk and overexposure handled by Copilot and AI apps, driving remediation via labeling, access review, and DLP—a proactive posture capability.

    Prerequisites: Microsoft Purview

  • Microsoft Entra Private Access

    Replaces VPN by granting identity-based, per-app (Zero Trust) access to internal apps, reaching only the needed apps rather than the whole network.

    Prerequisites: Zero Trust

  • Trusted launch

    Boot-level VM protection providing secure boot (only signed bootloaders run), virtual TPM (vTPM), and integrity monitoring against rootkits and boot-level malware. Configured as the VM security type—a separate layer from at-rest disk encryption.

    Prerequisites: Encryption

  • Entra ID Governance

    Ensures the right people have the right access to the right resources for the right time. Includes entitlement management (access packages), access reviews, Privileged Identity Management (PIM), and lifecycle workflows.

    Prerequisites: Microsoft Entra ID

  • Service endpoint

    Routes subnet-to-PaaS traffic over the Azure backbone and lets the PaaS firewall allow that subnet; assigns no private IP (not reachable from on-prem). Service endpoint policies can restrict destinations.

  • Azure Traffic Manager

    DNS-based global traffic distribution; routing methods (priority/weighted/performance/geographic) decide which IP is returned (real traffic goes straight to the backend).