Azure AZ-600 key terms

A Microsoft hybrid cloud appliance that runs Azure-consistent services in your own datacenter, delivered as an integrated system from a hardware partner and operated by your own team rather than by Microsoft.

The factory-assembled hardware rack, including compute, storage, and network switches, that a hardware partner validates and ships for running Azure Stack Hub; you cannot build or modify the hardware yourself.

The subset of Azure capabilities, such as virtual machines, storage accounts, and resource groups, exposed through the same APIs and portal experience as public Azure, allowing applications to move between clouds with limited change.

A group of Azure Stack Hub hosts managed together as a single cluster that provides compute and storage capacity; a stamp has at least one scale unit, and additional nodes are added to expand it.

A single physical server host inside a scale unit, contributing CPU, memory, and disks to the cluster; the number of nodes determines capacity and resiliency characteristics of the stamp.

One complete Azure Stack Hub deployment, including its hardware, software version, region name, and identity configuration; an organization may operate several stamps for separation or disaster recovery.

A named geographic grouping inside a stamp, such as local, that scopes resource placement and appears in resource IDs and endpoints; most stamps have a single region, and the name is chosen at deployment.

The partner-supported schedule for firmware and driver updates, warranty coverage, and eventual replacement of the integrated system, which you must plan for because the appliance cannot be upgraded indefinitely.

The process of adding physical nodes to an existing scale unit to increase capacity, performed with the privileged endpoint and validated by the hardware partner before and after the change.

Estimating the compute, storage, and network headroom a stamp needs for tenants and infrastructure services, accounting for resiliency reserves and growth, so that workloads are not starved of resources.

The operator-facing web console, reached at the admin management endpoint, used to create plans and offers, monitor health, manage updates, and configure infrastructure settings for the stamp.

The tenant-facing web console where subscribers browse the marketplace, create resource groups, and deploy services allowed by their subscriptions and plans; it resembles the public Azure portal.

A just-in-time remote PowerShell endpoint on a stamp that exposes operator-only commands for tasks such as adding nodes, retrieving logs, and unlocking support scenarios; access is logged and time-limited.

The REST and portal endpoint used by operators to manage the stamp, distinct from tenant-facing endpoints; it hosts the admin portal and the infrastructure management APIs.

A DNS name and URL that clients use to reach a service, such as portal, management, or storage endpoints; endpoints are registered in DNS during deployment and must be reachable from clients.

A conditional forwarder configured on the stamp so that internal name resolution can reach external names, such as Microsoft update or identity endpoints, while keeping internal zones authoritative.

The identity model in which the stamp trusts an Azure AD tenant for operator and tenant sign-in, enabling single sign-on and role-based access but requiring outbound connectivity to Azure AD.

An alternative identity model where the stamp federates with your on-premises AD FS, allowing disconnected or sovereign deployments to authenticate users without depending on public Azure AD endpoints.

An operating mode in which the stamp has no internet connectivity, so marketplace content, updates, and identity must be supplied from local sources such as a storage account or offline media.

The process of downloading curated marketplace items to a storage account and publishing them to the stamp, which is required for disconnected stamps and useful for controlling which images tenants can deploy.

A grouping of one or more services with quotas and settings that defines what a subscriber can provision; plans are combined into offers and are the unit of service composition.

A collection of one or more plans that an operator publishes so tenants can subscribe; users see offers in the portal, and the offer determines the plans and quotas their subscription receives.

A limit on a resource type, such as virtual machine cores or storage capacity, assigned to a plan; quotas prevent one subscription from consuming all capacity and are edited by operators.

A tenant's billing and access boundary for using services on the stamp; subscriptions are created from offers, and operators can view and manage them but tenants control their own resources.

A logical container that groups related resources for a tenant so they can be deployed, updated, and deleted together; access control and tagging are often applied at this scope.

A service component that exposes resource types through the management API, such as the compute or storage provider; operators register providers and tenants deploy resources through them.

A capability made available to tenants through plans, such as virtual machines, storage, or web apps; each service has a resource provider, quotas, and regional availability.

The authorization model that assigns built-in or custom roles to users, groups, and service principals at a scope such as subscription or resource group, determining allowed actions.

A controlled sequence that applies a full or express update package to the stamp, progressing through infrastructure and service layers while health checks gate each step.

A cumulative update bundle that brings a stamp to a specific version, including all prior fixes; it is larger and takes longer than an express package but can jump versions.

A smaller update that contains only the changes since the last full package and can be applied more quickly; it requires the stamp to already be at the matching baseline version.

An automated validation of alerts, infrastructure roles, and services that runs before and during updates and operations; failures block progress so operators can remediate before continuing.

A notification raised by the stamp's monitoring when a component breaches a threshold or fails, visible in the admin portal and used to trigger remediation and to gate updates.

The operator procedure that gathers logs and telemetry from infrastructure roles, often through the privileged endpoint, to send to Microsoft support or to investigate failures locally.

A scheduled capture of the stamp's control-plane configuration and secrets, stored off-appliance, that is required to restore the infrastructure after a catastrophic failure.

The plan and tested procedures for restoring tenant workloads and stamp infrastructure after an outage, often using a second stamp or external replication because a stamp is a single region.

The design of connectivity between the stamp and your datacenter, including border switches, BGP peering, VLANs, and outbound access needed for identity, updates, and telemetry.

A tenant subscription granted elevated rights to manage its own plans, offers, and user subscriptions on the stamp, enabling a service-provider model on shared infrastructure.