Azure AZ-104 key terms

Microsoft's cloud directory and identity service. It stores users, groups, and app registrations, and issues the tokens used to authenticate and authorize access to Azure, Microsoft 365, and custom applications.

A dedicated instance of Microsoft Entra ID created for an organization when it signs up for a Microsoft cloud service. It holds that organization's directory objects and is identified by a unique default domain name.

A logical container holding related Azure resources for one solution. Resources are deployed, managed, and deleted together as a unit, and each resource belongs to exactly one resource group.

A container that organizes subscriptions into a hierarchy so that governance assignments, such as Azure Policy and role assignments, inherit down to every subscription beneath it.

Azure's authorization system. A role definition lists allowed actions, and assigning that role to a user, group, service principal, or managed identity at a scope grants those permissions at and below that scope.

A governance service that compares resources with rules called policy definitions. It can block noncompliant resource creation, audit existing resources, or deploy remediation, and definitions can be grouped into initiatives.

A CanNotDelete or ReadOnly setting applied to a subscription, resource group, or resource. It blocks deletion or changes even for users who hold owner-level RBAC permissions.

A service principal created and rotated automatically by Azure in Microsoft Entra ID. Code on a VM, app, or other resource uses it to request tokens for other services without storing secrets.

A Microsoft Entra ID policy engine that evaluates signals such as user, group, location, device state, and sign-in risk, then allows, blocks, or challenges access, for example by requiring multifactor authentication.

A top-level Azure namespace that exposes blob, file, queue, and table endpoints under a unique name. It sets the redundancy, performance tier, and default access tier used by the data it holds.

A per-blob or per-account setting (hot, cool, cold, or archive) that balances storage cost against access cost and latency. Archived blobs must be rehydrated before they can be read.

Fully managed SMB and NFS file shares hosted in a storage account. Shares can be mounted from Windows, Linux, and macOS, and on-premises servers can sync with them using Azure File Sync.

A signed token appended to a storage URL that grants specific permissions for a limited time. Account, service, and user delegation variants let clients reach data without the account key.

A named policy defined on a blob container, file share, queue, or table that stores start time, expiry, and permissions. SAS tokens tied to it can be revoked or adjusted centrally.

The replication option chosen for a storage account: locally redundant within one region, zone redundant across availability zones, or geo-redundant to a paired region, with read-access variants of the geo options.

A rule on a storage account that automatically transitions blobs between access tiers or deletes them when conditions such as days since last modification or last access are met.

A command-line tool for fast, resumable copies of files and blobs to, from, and between storage accounts, commonly used for migrations and bulk data movement.

An IaaS compute resource with a chosen size, operating system image, disks, and network interface. You manage the guest operating system, patching, and scaling yourself.

A grouping of VMs that Azure spreads across fault domains and update domains inside a single datacenter, protecting workloads from hardware failure and planned maintenance at the same time.

A physically separate datacenter group within an Azure region with independent power and cooling. Deploying VMs across zones gives higher availability than an availability set.

A compute resource that creates and manages a set of identical VMs from one configuration. It can autoscale on metrics or a schedule and integrates with load balancers.

A JSON file, or the Bicep language that compiles to JSON, that declaratively describes the resources and configuration for a deployment so Azure Resource Manager can create or update them repeatably.

A small package installed on a virtual machine after deployment that adds management capability, such as running a script, installing an agent, or joining a domain.

The compute backing for Azure App Service apps. It defines the region, operating system, pricing tier, and the number and size of instances that the hosted apps share.

A managed Kubernetes service in which Azure runs the control plane while you deploy node pools built from VMs or scale sets to host containerized workloads.

A private network boundary in Azure. It defines an address space, holds subnets, and provides isolation and routing for the resources connected to it.

A range of IP addresses within a virtual network's address space where resources such as VMs and private endpoints are placed. Network security groups and route tables attach at this level.

A set of allow and deny rules that filter inbound and outbound traffic by source, destination, port, and protocol. It can be attached to a subnet, a network interface, or both.

A connection that links two virtual networks so resources communicate using private IP addresses over Microsoft's backbone. Peering can be regional or global and is not transitive by default.

A route table entry that overrides Azure's default system routes to send subnet traffic to a chosen next hop, such as a firewall, network virtual appliance, or VPN gateway.

A layer-4 service that distributes TCP and UDP traffic across backend VMs or scale set instances using a public or internal frontend, health probes, and load-balancing rules.

A layer-7 web traffic manager that routes HTTP and HTTPS requests based on URL paths and host headers, and can provide TLS termination, cookie affinity, and a web application firewall.

A network interface in a subnet that connects privately to a service such as storage or Azure SQL through Azure Private Link, giving that service a private IP inside your virtual network.

A managed jump-host service deployed into a dedicated subnet that gives browser-based RDP and SSH access to VMs over TLS without exposing public IP addresses on those VMs.

The platform that collects metrics, activity logs, and resource logs from Azure resources and lets you query, visualize, and create alerts on that telemetry.

A data store in Azure Monitor where log data from multiple resources is collected and queried with Kusto Query Language. Diagnostic settings and monitoring agents send data into it.

A reusable list of notification and automation targets, such as email, SMS, webhook, Azure Function, or Logic App, that an alert rule invokes when it fires.

A per-resource configuration that sends platform metrics and resource logs to a Log Analytics workspace, a storage account, an event hub, or a partner solution.

An Azure Backup container that stores backup data, backup policies, and recovery points for virtual machines, file shares, and other workloads, and supports restore operations.

Kusto Query Language, the read-only query language used in Log Analytics and Azure Monitor to filter, summarize, joins, and chart log tables.