MSAP key terms

A dedicated directory instance that holds users, groups, and app registrations for an organization. It has its own domain name and is the security boundary for identity and access across Azure subscriptions.

Microsoft's cloud identity and access management service, formerly Azure Active Directory. It authenticates users and apps and issues tokens used to authorize access to Azure resources and Microsoft 365.

A billing and administrative container for Azure resources. Every resource runs in exactly one subscription, and subscriptions link to a single Entra ID tenant for authentication.

A container that groups subscriptions so policies and role assignments can be applied once and inherited downward. Management groups can be nested up to six levels below the tenant root.

A logical container for related Azure resources that share a lifecycle. Deleting the group deletes everything inside it, and resources can belong to only one resource group at a time.

The deployment and management layer for Azure. Every request, whether from the portal, CLI, SDK, or a template, passes through ARM, which authenticates it, checks RBAC, and then forwards it to the resource provider.

An authorization system that grants access by assigning a role definition, which lists allowed actions, to a security principal at a scope such as a management group, subscription, resource group, or single resource.

The resource boundary at which an RBAC role assignment or Azure Policy assignment applies. Assignments at higher scopes are inherited by everything beneath them, and effective permissions are the union of all assignments.

An automatically managed service principal in Entra ID that a workload such as a VM or function app uses to obtain tokens without storing credentials. System-assigned identities share the resource lifecycle; user-assigned identities are standalone resources.

The identity object in a tenant that represents an application or automation so it can be assigned permissions. It is created in each tenant where the app is consented, and it holds credentials or federated trust.

A policy engine that evaluates signals such as user, device, location, and sign-in risk, then enforces controls like multi-factor authentication or blocking access. Policies require Entra ID licensing and apply at sign-in time.

A service for just-in-time activation of privileged directory or Azure roles. Eligible assignments require activation with justification, optional approval, and time limits, which reduces standing administrative access.

A governance service that evaluates resources against rules and can deny noncompliant deployments, audit them, or remediate them with deployIfNotExists and modify effects. Policies are grouped into initiatives and assigned to scopes.

A setting on a resource that prevents accidental deletion or modification. CanNotDelete locks block deletion while allowing changes; ReadOnly locks block both, and locks apply regardless of RBAC permissions.

A namespace that exposes blob, file, queue, and table endpoints under a unique name. Its settings, such as replication, access tier defaults, and network rules, apply to all data stored within it.

A grouping of blobs inside a storage account, similar to a folder. Containers hold an access level setting and are the unit against which blob RBAC data-plane roles and stored access policies are often applied.

The automatic copying of storage data across fault and update domains and optionally regions. Options include locally redundant, zone-redundant, geo-redundant, and geo-zone-redundant, with read-access variants for secondary endpoints.

A signed URL that grants time-limited, scoped access to storage resources without sharing account keys. Service, account, and user delegation SAS types differ in what can be signed and what can revoke them.

A named set of constraints, such as start time, expiry, and permissions, defined on a container or share. A service SAS can reference it, allowing the policy to be modified or revoked later.

A setting that trades storage cost against access cost and latency. Hot suits frequent access, Cool and Cold suit infrequent access with early-deletion penalties, and Archive requires rehydration before reading.

A rule set on a storage account that moves blobs between tiers or deletes them based on age or last-access conditions. Rules run daily and can also apply to snapshots and blob versions.

A read-only copy of a blob captured at a point in time. Snapshots share the base blob's name with a timestamp and are billed for changed blocks, making them useful for versioning and restore.

A managed SMB and NFS file share service accessible from cloud and on-premises clients. Shares can be mounted by VMs and, with Azure File Sync, tiered to on-premises Windows servers.

A service that turns a Windows Server into a cache of an Azure file share using a sync group and cloud tiering. It supports multi-site access and fast disaster recovery of file data.

A cross-platform desktop tool for browsing and managing storage accounts, blobs, queues, tables, and file shares. It supports sign-in with Entra ID or connection strings and is useful for uploads and SAS generation.

An IaaS compute resource that runs an operating system image on a chosen size in a region and availability construct. Its networking, disks, and extensions are separate resources attached to it.

A group of identical VMs managed as one unit that can autoscale on metrics or schedules. Scale sets spread instances across fault domains and support orchestration modes and rolling upgrades.

A logical grouping of VMs that distributes them across fault domains and update domains within a single datacenter. It protects against hardware failure and planned maintenance but not datacenter outage.

A physically separate group of datacenters within an Azure region, each with independent power and cooling. Deploying across zones protects workloads from a single datacenter failure with low-latency replication.

The compute backing for App Service apps that defines region, operating system, pricing tier, and instance count. Apps in the same plan share those instances and scale together.

A live app instance under a separate hostname within an App Service plan, used for staging and warm swaps. Swapping slots routes traffic to the staged instance with minimal downtime.

A serverless compute service that runs event-triggered code with automatic scaling. Hosting plans range from Consumption to Premium and Dedicated, and bindings connect functions to other services.

A service for running containers on demand without managing hosts. It bills per second of CPU and memory, supports Linux and Windows containers, and suits short-lived or burst workloads.

A private registry for storing and distributing container images and OCI artifacts. It supports geo-replication, image tasks, and authentication through Entra ID service principals or managed identities.

A serverless container platform built on Kubernetes that handles scaling, ingress, and revisions for you. It supports scale-to-zero, Dapr integration, and traffic splitting between revisions.

A private network boundary in Azure that holds subnets and controls address space and routing. Resources in a VNet can communicate by default, and peering or gateways connect separate VNets.

A range of IP addresses within a virtual network that groups resources and acts as a target for route tables, NSGs, and service endpoints. Some services require a dedicated delegated subnet.

A set of allow and deny rules evaluated by priority that filter inbound and outbound traffic at a subnet or network interface. Rules match on source, destination, port, and protocol.

A managed, stateful network security service that provides centralized filtering, threat intelligence, and FQDN-based rules for a virtual network. It uses a dedicated subnet and a static public IP.

A connection between two virtual networks that routes traffic over the Microsoft backbone without gateways. Peering is non-transitive, so spoke-to-spoke traffic needs a hub or gateway transit.

A gateway subnet resource that connects a virtual network to on-premises networks or other VNets over encrypted IPsec/IKE tunnels. It supports site-to-site, point-to-site, and VNet-to-VNet configurations.

A private, dedicated circuit from an on-premises location to Microsoft cloud services through a connectivity provider. It bypasses the public internet and offers higher reliability and predictable latency.

A hosting service for public DNS zones and for private zones resolvable only inside linked virtual networks. Records are managed through ARM, and private zones support automatic VM registration.

A layer-4 service that distributes TCP and UDP traffic across backend pool members using health probes and rules. It offers public and internal variants and supports zone-redundant frontends.

A layer-7 load balancer that routes HTTP and HTTPS traffic using URL path and host rules. It includes a web application firewall option and supports TLS termination and end-to-end TLS.

A global layer-7 entry point that routes users to the closest healthy backend and provides caching, TLS offload, and a web application firewall at the edge. It works across regions rather than inside one VNet.

The platform that collects metrics, activity logs, and resource logs, then supports alerting, dashboards, and analysis. Data can be routed to Log Analytics, storage, or event hubs for downstream processing.

A store for log data queried with Kusto Query Language. Multiple resources can send data to one workspace, and retention, access control, and solutions are configured at the workspace level.

A rule that evaluates a metric, log query, or activity event and fires when a threshold or condition is met. Alert rules target action groups that send notifications or trigger automation.

A reusable collection of notification and automation targets, such as email, SMS, webhook, function, or runbook, invoked when an alert fires. Many alert rules can share one action group.

A service that protects VMs, file shares, databases, and on-premises workloads using recovery services vaults and policies. It supports instant restore, soft delete, and cross-region restore options.

A management container that stores backup data and replication settings for Azure Backup and Azure Site Recovery. Its storage redundancy and security settings are chosen at creation and shape recovery options.

A disaster recovery service that continuously replicates VMs and physical servers to a secondary region or site. Failover and test failover run from recovery plans that order and group machines.

A container for runbooks, schedules, variables, and hybrid worker groups used to automate management tasks. Runbooks can be PowerShell, Python, or graphical and can run on Azure or on-premises workers.