AZ Landscape key terms

Delivery of computing resources such as servers, storage, and databases over the internet on demand, with the provider owning and maintaining the underlying hardware.

A billing approach where you pay only for the resources you use, metered by time or volume, instead of buying hardware up front.

The division of duties between a cloud provider and its customer: the provider secures the physical platform, while the customer secures data, identities, and configuration.

A geographic area containing one or more datacenters networked together with low latency, used to place resources close to users and to meet data residency rules.

A physically separate group of datacenters within a region, with independent power and cooling, used to keep workloads running if one zone fails.

A software-based computer that runs an operating system on shared physical hardware, giving full control over the OS and installed software.

A group of identical virtual machines managed as one unit that can automatically increase or decrease in count based on demand or a schedule.

A managed platform for hosting web apps, REST APIs, and mobile back ends without managing servers; you deploy code and Azure handles patching and scaling.

A managed Kubernetes offering where Azure runs the control plane and you manage worker node pools that host containerized workloads.

An event-driven compute service that runs small pieces of code on demand, scaling automatically and billing per execution and consumed resources.

A logically isolated private network in Azure where you place resources, define address ranges, and control traffic between subnets and external networks.

A set of allow and deny rules that filter inbound and outbound traffic to subnets or network interfaces based on source, destination, port, and protocol.

A managed gateway that connects a virtual network to another network over an encrypted internet tunnel, commonly linking on-premises sites to Azure.

A private, dedicated connection between an on-premises network and Azure through a connectivity provider, offering predictable latency and higher bandwidth than the public internet.

A network interface in your subnet that assigns a private IP address to a platform service, so traffic reaches it without crossing the public internet.

A container that gives a unique namespace for Azure storage services such as blobs, files, queues, and tables, and defines replication and access settings.

Object storage for unstructured data such as documents, images, and backups, organized into containers and offering hot, cool, cold, and archive access tiers.

The replication strategy for stored data, such as locally redundant, zone redundant, or geo-redundant, which sets durability and how many copies survive an outage.

A fully managed relational database engine in Azure that handles patching, backups, and high availability while you focus on schema and queries.

A cloud data integration service for building pipelines that copy, transform, and orchestrate data movement between on-premises and cloud stores on a schedule.

Microsoft's cloud identity service that stores users, groups, and applications, and issues tokens used to sign in and authorize access to Azure and Microsoft 365.

An Entra ID policy engine that grants or blocks access based on signals such as user, device, location, and risk, often requiring multifactor authentication.

A role-based authorization system for Azure resources that assigns built-in or custom roles to users, groups, or identities at a chosen scope.

An automatically managed identity in Entra ID that a resource such as a virtual machine or app uses to get tokens, removing the need to store credentials.

A service for storing and controlling access to secrets, encryption keys, and certificates, with logging and optional hardware-backed key protection.

A container above subscriptions that lets you apply policies and role assignments across many subscriptions at once, forming a hierarchy for governance.

A logical container holding related Azure resources that share a lifecycle, so they can be deployed, updated, and deleted together.

A governance service that evaluates resources against rules and can block or remediate noncompliant configurations, such as allowed regions or required tags.

Key-value labels attached to resources that support cost allocation, ownership tracking, and automated governance through policy enforcement.

A set of tools for viewing, analyzing, and controlling Azure spending, including budgets, alerts, and recommendations for reducing waste.

An analytics service combining data warehousing, big data processing, and pipeline orchestration in one workspace for large-scale reporting and analysis.

A managed offering that exposes OpenAI language and image models through Azure APIs, adding enterprise controls such as private networking, content filters, and regional data handling.

A platform for building, training, deploying, and monitoring machine learning models, with workspace tools, compute management, and pipeline automation.

A low-code workflow service that connects hundreds of systems with triggers and actions, automating business processes and integrating cloud and on-premises applications.

A platform for collecting metrics and logs from Azure and hybrid resources, then analyzing, visualizing, and alerting on them.

An application performance monitoring feature of Azure Monitor that tracks requests, dependencies, exceptions, and user behavior in running applications.

A data store where Azure Monitor logs are collected and queried with Kusto Query Language, serving as the basis for alerts and workbooks.

A managed backup service that protects virtual machines, files, and databases with policy-driven schedules and stores recovery points in a Recovery Services vault.