Glossary

The acronyms and terms that show up most on AZ-900, in plain language.

• IaaS (Infrastructure as a Service): rent raw infrastructure like virtual machines and manage the OS yourself.
• PaaS (Platform as a Service): a managed platform to build and run apps without managing servers.
• SaaS (Software as a Service): finished software you use over the internet.
• CapEx (Capital Expenditure): a large upfront purchase of physical assets.
• OpEx (Operational Expenditure): ongoing pay as you use cost.
• VM (Virtual Machine): a virtualized computer you run in the cloud, an IaaS service.
• VMSS (Virtual Machine Scale Set): a group of identical VMs that scale automatically.
• ACI (Azure Container Instances): run a single container without managing servers.
• AKS (Azure Kubernetes Service): managed Kubernetes for orchestrating many containers.
• VNet (Virtual Network): your private network in Azure.
• VPN (Virtual Private Network) Gateway: an encrypted link between on-premises and Azure over the internet.
• ExpressRoute: a private dedicated connection to Azure that does not use the public internet.
• DNS (Domain Name System): resolves names to IP addresses.
• ARM (Azure Resource Manager): the deployment and management layer all requests pass through.
• Resource group: a container that holds related resources.
• Subscription: a billing and access boundary for resources.
• Management group: a container to govern multiple subscriptions.
• Region: a set of datacenters in one geographic area.
• Availability zone: a physically separate datacenter within a region.
• Region pair: two linked regions in a geography for resilience.
• Blob: storage for large amounts of unstructured data.
• LRS, ZRS, GRS, GZRS: storage redundancy options, from locally redundant to geo zone redundant.
• Entra ID (Microsoft Entra ID): Azure's cloud identity service, formerly Azure Active Directory.
• AD DS (Active Directory Domain Services): the traditional on-premises directory service.
• Authentication: proving who you are.
• Authorization: deciding what you are allowed to do.
• MFA (Multi Factor Authentication): requiring more than one proof of identity.
• SSO (Single Sign On): signing in once to access many apps.
• Conditional Access: sign in rules based on signals like user, location, and risk.
• RBAC (Role Based Access Control): granting least privilege by assigning roles at a scope.
• Zero Trust: never trust automatically, always verify.
• Defense in depth: layering multiple protections.
• Defender for Cloud: monitors and improves your security posture.
• Azure Policy: enforces rules on resources and reports compliance.
• Resource lock: prevents accidental change (ReadOnly) or deletion (CanNotDelete).
• Purview (Microsoft Purview): governs and understands your data.
• Cloud Shell: a browser based shell with Azure tools preinstalled.
• CLI (Command Line Interface): the cross platform Azure command tool.
• Azure Arc: extends Azure management to resources outside Azure.
• IaC (Infrastructure as Code): deploying resources from templates for repeatability.
• Advisor (Azure Advisor): personalized recommendations across cost, security, reliability, and performance.
• Service Health: the status of Azure services affecting you.
• Azure Monitor: collects metrics and logs (with Log Analytics, Alerts, Application Insights).
• SLA (Service Level Agreement): the provider's commitment to uptime and performance.
• TCO (Total Cost of Ownership): the full cost of a solution, used to compare on-premises with cloud.
• Reservation: a one or three year commitment to a resource for a large discount on steady workloads.
• Spot pricing: deeply discounted spare capacity for workloads that can be interrupted.
• Azure Hybrid Benefit: reusing existing Windows Server or SQL Server licenses to reduce cost.
• Public endpoint: a service address reachable over the public internet.
• Private endpoint: a private IP for a service inside your virtual network, keeping traffic off the public internet.
• Network security group (NSG): rules that allow or deny network traffic to and from Azure resources.
• Passwordless authentication: signing in without a password using Windows Hello, the Authenticator app, or a security key.
• Microsoft Entra Domain Services: managed domain services in Azure, such as domain join and group policy, with no domain controllers to run.
• General purpose v2: the standard storage account type, supporting blobs, files, queues, and tables.
• Premium storage: storage on solid state disks for low latency workloads, versus Standard on hard disks.
• Availability set: a grouping that spreads VMs across fault and update domains to reduce downtime.
• Fault domain: a group of hardware sharing a power and network source, isolated from other fault domains.
• Update domain: a group of resources updated together during planned maintenance, one domain at a time.
• Bicep: a simpler language for writing Azure infrastructure as code that compiles to ARM templates.