Azure AZ-500 key terms

Microsoft's cloud identity provider that stores users, groups, and applications and issues tokens for Azure and Microsoft 365; it supports federation, Conditional Access, directory roles, and synchronization from on-premises Active Directory.

Policy engine in Entra ID that evaluates signals such as user, group, device, location, and sign-in risk, then enforces grant controls like multi-factor authentication or block, plus session controls.

Entra ID service that makes directory roles and Azure resource roles eligible instead of permanent, requiring activation with justification, approval, MFA, and a time limit; every activation is audited.

Identity created automatically in Entra ID for an Azure resource so code can request tokens without stored secrets; a system-assigned identity lives with one resource, while a user-assigned identity can be shared.

Directory object in Entra ID that represents an application within one tenant; role assignments and API permissions are granted to it so the application can act without a human signing in.

Entra ID object defining an application's identity, redirect URIs, and API permissions, distinguishing delegated permissions that act in a user context from application permissions that are app-only and usually admin-consented.

Authorization system for Azure resources that assigns built-in or custom roles to users, groups, service principals, and managed identities at a scope; evaluation is additive and allow-based, with deny assignments as the exception.

The boundary, such as management group, subscription, resource group, or individual resource, at which a role assignment applies; granted permissions inherit to every child scope beneath it.

Service that detects risky users and risky sign-ins using signals such as leaked credentials, anonymous IP addresses, and atypical travel, then shows risk in reports and supplies risk conditions to Conditional Access.

Recurring governance task in which reviewers confirm, remove, or time-limit group memberships, application assignments, and privileged role assignments so that stale entitlements do not accumulate.

Entitlement management container that bundles groups, applications, and SharePoint sites users request through approval workflows, with expiration dates and periodic reassessment policies attached.

Entra ID container that restricts the reach of a directory role to a defined subset of users, groups, or devices, enabling delegated administration without granting tenant-wide rights.

Stateful filter for inbound and outbound traffic attached to a subnet or network adapter, evaluated by prioritized rules that match source, destination, port, protocol, and application security group.

Logical grouping of virtual machine network interfaces used as source or destination in network security group rules, letting many machines share one rule instead of listing individual IP addresses.

Managed, stateful firewall service for virtual networks offering FQDN and network filtering, threat intelligence, and centralized policy; the Premium tier adds intrusion detection, TLS inspection, and URL filtering.

Azure service that mitigates volumetric, protocol, and resource-layer attacks against public IP addresses; the Standard tier adds adaptive tuning, attack telemetry, rapid response support, and cost protection.

Network interface placed in a subnet that gives a private IP connection to a platform service through Azure Private Link, so traffic to that service never crosses the public internet.

Subnet configuration that routes traffic to a supported Azure service over the Microsoft backbone and lets that service restrict access to the subnet; the service still keeps its public IP address.

Fully managed jump-host service deployed into a dedicated subnet that provides browser-based RDP and SSH over TLS, so virtual machines need no public IP address or open management ports.

Custom entry in a route table that overrides Azure system routes to steer subnet traffic toward a network virtual appliance, virtual network gateway, or the internet.

Layer 7 protection on Application Gateway or Azure Front Door that inspects HTTP requests against OWASP rule sets and custom rules to block attacks such as SQL injection and cross-site scripting.

Service for storing secrets, encryption keys, and certificates in software- or HSM-protected stores, with authorization through Azure RBAC or vault access policies plus logging and optional network restrictions.

Key Vault settings that keep deleted vaults and objects recoverable for a retention period; purge protection additionally blocks permanent deletion until that period ends, defeating ransomware deletion attempts.

Encryption key created and held in Key Vault or Managed HSM that a service such as Storage, Disk, or Azure SQL uses for encryption at rest, giving you control over rotation and revocation.

Signed token granting scoped, time-limited permissions on storage resources; a user delegation signature is secured by an Entra ID credential rather than by the storage account access key.

Storage account setting that permits authorization with the account access keys, which grant full data-plane rights; disabling it forces clients to authenticate with Entra ID identities or signatures instead.

Azure SQL feature that encrypts data, log, and backup files at rest, using either a service-managed key or a customer-managed key stored in Key Vault.

SQL client-side encryption in which column values are encrypted by the driver so the database engine only handles ciphertext; column master keys reside in Key Vault or a Windows certificate store.

Method of connecting to Azure SQL with Entra identities such as users, groups, or managed identities, which removes SQL logins and passwords and enables centralized MFA and Conditional Access.

Virtual machine security profile that enables Secure Boot and a virtual TPM so the boot chain is measured and protected against rootkits and bootkits; guest attestation can then verify boot integrity.

Cloud security posture management and workload protection platform that continually assesses resources against security standards, calculates a secure score, and raises alerts for detected threats.

Defender for Cloud metric summarizing how well resources satisfy security recommendations, expressed as points earned against points available, with prioritized improvement actions listed for remediation.

Paid Defender for Cloud plan for virtual machines that adds threat detection, file integrity monitoring, vulnerability assessment, just-in-time access, and adaptive application controls on top of free posture assessment.

Defender for Cloud feature that leaves management ports closed in the network security group by default and opens them only for an approved request from a specified source address during a limited window.

Cloud-native SIEM and SOAR service built on Log Analytics that ingests security telemetry through connectors, detects threats with analytics rules, creates incidents, and automates response with playbooks.

Azure data store and query engine where Sentinel and Defender telemetry is collected; retention settings, table plans, and commitment tiers determine cost and how far back analysts can search.

Kusto Query Language used to explore Log Analytics and Sentinel tables, combining operators such as where, project, summarize, join, and extend to build detection, hunting, and investigation queries.

Sentinel detection that runs a query on a schedule or applies Fusion correlation, comparing results against a threshold and generating alerts grouped into incidents with mapped entities and severity.

Azure Logic App that Sentinel can run manually or automatically in response to an incident, for example to disable a compromised account, isolate a machine, or post a Teams message.

Sentinel rule that evaluates incident or alert conditions and then triggers a playbook or changes properties such as severity, status, or owner, running independently of analytics rules.