AZ-802 Windows Server Hybrid Administrator key terms

A service that connects on-premises or multicloud Windows and Linux machines to Azure so they can be inventoried, governed, and extended with Azure services without being migrated or rehosted.

A lightweight agent installed on a machine that registers it with Azure Arc, brokers outbound communication over HTTPS, and delivers extension-based capabilities such as monitoring and policy evaluation.

An extension that audits or configures settings inside a machine, such as password policy or installed roles, by shipping a configuration package and reporting compliance state to Azure Policy.

A declarative management platform in PowerShell where you describe the required configuration of a node in a MOF document and a local configuration manager enforces it and reports drift.

A feature that lets you run commands on remote computers over WS-Management or SSH, using sessions and serialized objects, and is the transport used by many hybrid management tools.

A browser-based management tool installed on a gateway server that manages Windows Servers, clusters, and Azure virtual machines through remote management protocols, with optional Azure integration for backup and monitoring.

A device state in which a Windows device is joined to on-premises Active Directory and also registered with Microsoft Entra ID, enabling both domain sign-in and cloud-based conditional access and single sign-on.

A synchronization tool that projects on-premises Active Directory users, groups, and devices into Microsoft Entra ID, supporting password hash sync, pass-through authentication, and federation options.

A sign-in method in which a hash of the on-premises password hash is synchronized to Microsoft Entra ID so users can authenticate in the cloud with the same credentials they use on-premises.

The synchronization engine that evaluates rules to determine which on-premises objects and attributes flow to Microsoft Entra ID, resolving joins and transformations during each synchronization cycle.

A lightweight agent-based provisioning service that synchronizes on-premises Active Directory objects to Microsoft Entra ID without a full sync server, supporting multi-forest and disconnected scenarios.

A managed domain service that provides domain join, group policy, LDAP, and Kerberos/NTLM authentication for cloud workloads without deploying and patching domain controllers yourself.

A policy engine in Microsoft Entra ID that grants or blocks access based on signals such as user, device compliance, location, and risk, and can require multifactor authentication or a compliant device.

A PowerShell role-based access framework that restricts administrative sessions to a defined set of cmdlets and parameters, running under a temporary privileged account instead of full administrator rights.

A capability that puts domain users into temporary, time-bound groups such as Domain Admins, requiring an approval workflow and issuing credentials with a limited validity window.

A virtual network gateway that sends encrypted traffic between an Azure virtual network and on-premises networks or other virtual networks over site-to-site, point-to-site, or ExpressRoute connections.

An IPsec/IKE tunnel between an on-premises VPN device and an Azure VPN gateway that connects an entire local network to a virtual network using a shared key and matching address spaces.

A private connectivity service that uses a connectivity provider to link on-premises networks to Azure, bypassing the public internet for predictable latency and higher throughput.

A feature that connects two ExpressRoute circuits together through the Microsoft backbone, letting on-premises sites in different regions communicate without routing traffic across the public internet.

A managed service that exchanges routes with network virtual appliances in a virtual network using Border Gateway Protocol, simplifying insertion of appliances into the traffic path.

A dynamic routing protocol used to exchange reachability information between autonomous systems, and in Azure between gateways, route servers, and on-premises routers.

A custom route table entry that overrides Azure system routes to send subnet traffic to a specified next hop such as a virtual appliance, virtual network gateway, or the internet.

A virtual machine running networking software such as a firewall, router, or load balancer that is inserted into traffic flows, usually combined with user-defined routes and IP forwarding.

A managed DNS service that resolves names between on-premises and Azure private zones through inbound and outbound endpoints, enabling conditional forwarding without DNS server virtual machines.

A DNS zone hosted in Azure that resolves names only for resources linked to it, commonly used for private endpoint name resolution inside virtual networks.

A DNS server configured to send queries it cannot resolve to another server, often used on-premises to forward specific namespaces to Azure-hosted private zones.

A network interface in a subnet that connects privately to an Azure service through a private link, giving the service a private IP address instead of a public one.

A Windows Server feature that replicates volumes synchronously or asynchronously between servers or clusters for disaster recovery and stretched clusters, at the block level.

A service that turns a Windows Server file share into a cache of an Azure file share, using cloud tiering to keep hot data local and offload cold data to Azure.

A feature of Azure File Sync that keeps frequently accessed files on the local server while replacing rarely used files with reparse points that recall content from Azure on access.

A software-defined storage feature that pools local disks across cluster nodes to create highly available, fault-tolerant volumes using internal or direct-attached drives.

A volume on a failover cluster formatted with NTFS or ReFS that multiple nodes can access simultaneously, used by roles such as Hyper-V and Scale-Out File Server.

A group of independent servers working together to provide high availability, where roles and their resources move automatically to another node when a failure occurs.

The movement of a running virtual machine between hosts with little or no downtime, using shared storage, SMB, or live migration over a network transport.

A feature that asynchronously replicates a virtual machine from a primary host to a replica host over the network, enabling recovery at a secondary site.

A hub of tools that discovers on-premises servers and workloads, assesses readiness and cost, and performs agentless or agent-based migration to Azure virtual machines.

A cloud backup service that stores recovery points in a vault and uses an agent or extension to protect on-premises servers, Azure virtual machines, and file shares.

An Azure storage entity that holds backup data and recovery points for protected items, with settings for redundancy, retention policy, and security features such as soft delete.

A disaster recovery service that continuously replicates on-premises or Azure virtual machines to a secondary location and orchestrates test failover and planned failover.

An agent that collects performance counters, event logs, and other telemetry from machines using data collection rules and sends it to Log Analytics or metrics.

A configuration object that defines which data an agent gathers, how it is transformed, and which destination workspace or metrics store receives it.

A unique environment in Azure Monitor where log data is collected and queried using Kusto Query Language, serving as the destination for agent and diagnostic data.

A cloud security posture and workload protection service that assesses configurations, surfaces recommendations, and provides threat detection across Azure and hybrid servers.

A Defender for Cloud plan that adds vulnerability assessment, file integrity monitoring, and endpoint detection for Windows and Linux servers, including Arc-enabled machines.

An identity-centric service that replaces traditional VPN access by publishing private applications through the Global Secure Access client, enforcing per-application conditional access.

A service that assesses and schedules operating system updates for Azure, Arc-enabled, and on-premises machines, replacing legacy update management solutions.