Precise definitions for terms that show up across lessons — especially the ones that sound similar but aren't. Grows as lessons are added; every lesson should use these terms consistently with what's defined here.
The split of security/operational duties between Microsoft and the customer. Microsoft always owns physical datacenter security; everything above that (OS, app, data) shifts depending on IaaS/PaaS/SaaS. See Lesson 1.
Public cloud — shared infrastructure owned by the provider. Private cloud — dedicated infrastructure for one organization. Hybrid cloud — a connected mix of both. See Lesson 1.
Pay only for what you use (OpEx), instead of buying hardware upfront sized for peak load (CapEx). See Lesson 1.
You deploy code; the platform provisions, patches, and scales the compute automatically — including down to zero. Still runs on servers, you just never manage them. See Lesson 1.
Vertical scaling (scale up/down) changes the capability of one resource — e.g. more CPU/RAM on a VM. Horizontal scaling (scale out/in) changes the number of resource instances — e.g. adding more VMs behind a load balancer. See Lesson 2.
A system stays up despite disruptions, backed by a per-service SLA (e.g. 99.9%, 99.99% uptime guarantees). See Lesson 2.
A system's ability to recover from failure and keep functioning — supported by decentralizing across Azure regions. A pillar of the Azure Well-Architected Framework. See Lesson 2.
Performance predictability — autoscaling/load balancing keep the experience consistent under shifting demand. Cost predictability — real-time usage tracking and the Pricing Calculator let you forecast spend. See Lesson 2.
Management of the cloud — automated things that happen to your resources, no hands involved: auto-scale, deployment templates, health monitoring with auto-replace, metric alerts.
Management in the cloud — the interfaces you personally use to reach in and act: web portal, CLI, APIs, PowerShell.
Mnemonic: "in" = interfaces you use by hand. "of" = automated, happens on its own. Flagged as a genuine trouble spot on first pass — see learning record 0001 if this one isn't sticking; ask your teacher rather than re-reading silently. See Lesson 2.
Infrastructure as a Service — you manage OS, patching, and config; provider manages hardware/connectivity/physical security. Platform as a Service — provider also manages OS, middleware, and runtimes; you manage only your app and data. Software as a Service — provider manages almost everything; you manage data, identity, and access. Control decreases and convenience increases as you move IaaS → PaaS → SaaS. See Lesson 3.
Region — a geographic area with one or more networked datacenters. Availability zone — a physically separate datacenter within a region (minimum 3 per AZ-enabled region), an isolation boundary. Region pair — two regions in the same geography, ≥300 miles apart, for disaster resilience. See Lesson 4.
Nesting order, top to bottom: management group (governance at scale, up to 6 levels deep) → subscription (billing + access-control boundary) → resource group (a resource belongs to exactly one, at a time) → resource (the actual thing deployed). Policy and access inherit downward. See Lesson 4.
Virtual machine — full OS control, IaaS, slowest start, billed while provisioned. Container — shares host OS, lightweight, fast start, billed while running. Function — serverless, wakes on an event, billed only for execution time. See Lesson 5.
Scale sets — identical, load-balanced VMs that auto-scale out/in with demand (elastic capacity). Availability sets — VMs grouped by fault domain + update domain so one failure/maintenance event can't take them all down (resiliency, not scale). See Lesson 5.
VPN Gateway — encrypted tunnel over the public internet (site-to-site, point-to-site, or VNet-to-VNet). ExpressRoute — dedicated private connection via a provider that never touches the public internet; higher reliability/bandwidth, used for compliance-sensitive or latency-critical workloads. Even over ExpressRoute, DNS queries and CDN requests still go over the public internet. See Lesson 6.
Public endpoint — public IP, reachable from anywhere. Private endpoint — private IP inside a VNet, reachable only from within. See Lesson 6.
Direct private connection between two virtual networks (even across regions), over the Microsoft backbone, never the public internet. See Lesson 6.
Hot — frequent access. Cool — infrequent, 30-day minimum. Cold — infrequent, 90-day minimum. Archive — rare access, 180-day minimum, highest rehydration latency, lowest storage cost. See Lesson 7.
Azure Storage always keeps 3 copies in the primary region. LRS — 3 copies, one datacenter. ZRS — 3 copies across availability zones. GRS — LRS in primary + async LRS copy in a secondary region. GZRS — ZRS in primary + async LRS copy in a secondary region. Add RA- (RA-GRS/RA-GZRS) to read the secondary copy before failover. See Lesson 7.
AzCopy and Storage Explorer (GUI wrapper around AzCopy) are one-directional, on-demand file copy tools. Azure File Sync is a standing, bi-directional sync between Azure Files and a local Windows Server cache. See Lesson 8.
Azure Migrate — hub for online, real-time assessment/migration of on-prem infrastructure. Azure Data Box — physical device (up to 80 TB) for offline bulk transfer when bandwidth is the bottleneck. See Lesson 8.
Entra ID — cloud identity/access management (auth, SSO, app/device management). Entra Domain Services — managed classic domain services (domain join, group policy, LDAP, Kerberos/NTLM) for legacy apps, no domain controllers to maintain yourself. See Lesson 9.
SSO — one sign-in, many apps. MFA — a second factor (know/have/are). Passwordless — no password at all (Windows Hello for Business, Microsoft Authenticator app, FIDO2 keys); rated highest on both security and convenience. See Lesson 9.
RBAC — authorization: what you're allowed to do, scoped to a resource/group/subscription/management group, inherits downward. Conditional Access — a sign-in-time gate: signals (who/where/device) → decision → enforcement (allow/block/require MFA), independent of RBAC permissions. See Lesson 9.
B2B collaboration — external partner becomes a guest user in your directory. B2B direct connect — mutual trust between tenants, no directory presence (currently Teams shared channels). See Lesson 9.
Assumes breach and verifies every request explicitly, regardless of network location. Three principles: verify explicitly, use least privilege access, assume breach. See Lesson 10.
Zero Trust — a mindset for access decisions: verify every request explicitly, no matter where it comes from. Defense-in-depth — a structure of nested layers (physical → identity & access → perimeter → network → compute → application → data) around the environment, so one breach doesn't mean total loss. Complementary: Zero Trust governs who passes each layer; defense-in-depth is the set of layers.
Layer order as a castle: physical (walls) → identity & access (gate guards) → perimeter (moat — stops mass attacks like DDoS before they arrive) → network (roads/checkpoints between things already inside — segmentation) → compute (buildings) → application (what happens inside them) → data (the vault, always innermost). Flagged as a trouble spot — perimeter vs. network especially — see learning record 0002. See Lesson 10 · Lesson 11.
Security posture management and threat protection service, native to Azure and extendable to hybrid/multicloud via Azure Arc. Three pillars, best read as a timeline: continuously assess ("what's wrong right now?" — raw vulnerability findings) → secure ("how do I improve, and track it?" — benchmark-based recommendations rolled into the secure score) → defend ("am I under attack right now?" — alerts, kill-chain correlation, advanced threat protection). The secure score belongs to Secure, not Assess — see learning record 0002. See Lesson 10 · Lesson 11.
Pricing calculator — estimates the cost of a new Azure deployment planned from scratch. TCO calculator — compares existing on-premises infrastructure cost against running that same workload in Azure. Pricing calculator looks forward from nothing; TCO calculator looks sideways from what you already have. See Lesson 13.
Reservation — discount for committing to 1 or 3 years upfront. Spot pricing — deep discount on unused spare capacity, can be evicted anytime, unrelated to any commitment length. See Lesson 13.
Name/value metadata attached to a resource, resource group, or subscription. Doesn't change how anything runs — lets you group and report on resources (e.g. in Cost Management) across resource-group boundaries. A resource sits in exactly one resource group but can carry many tags. See Lesson 13.
RBAC — controls who can perform which actions, scoped to a role assignment. Azure Policy — controls what a resource's properties are allowed to be, regardless of who's creating it; can deny a request even from a user with full RBAC write permission. RBAC gates the actor; Policy gates the outcome. See Lesson 14.
CanNotDelete — blocks deletion only, resource can still be modified. ReadOnly — blocks both modification and deletion. Both override RBAC entirely, including Owner. Locks inherit downward (subscription → resource group → resource); the more restrictive lock wins. See Lesson 14.
Unified data governance across on-premises, multicloud, and SaaS — not Azure-only. Discovers, catalogs, and classifies data, then layers on risk and compliance management. See Lesson 14.
Declarative — state the desired end result; the platform works out how to get there (ARM templates, Bicep). Imperative — specify the exact sequence of steps to run, in order (a CLI or PowerShell script). Declarative says "what," imperative says "how, in order." See Lesson 15.
Projects non-Azure resources (on-premises, other clouds, Kubernetes anywhere) into Azure Resource Manager, so Policy, tags, and RBAC apply to them the same as native Azure resources — one control plane for hybrid/multicloud. See Lesson 15.
Interchangeable doors into the same Azure Resource Manager. Portal — web GUI. Cloud Shell — browser-based CLI, no install, persistent file share. Azure CLI — locally installed, cross-platform, az commands. Azure PowerShell — locally installed, cmdlet syntax. Mobile app — monitor and act from a phone. See Lesson 15.
Advisor — personalized recommendations about your own resources (reliability, security, performance, cost, operational excellence) — things you can fix. Service Health — status of the Azure platform itself (outages, planned maintenance, advisories), filtered to services/regions you use — things Microsoft has to fix. Advisor looks at you; Service Health looks at Azure. See Lesson 16.
Metrics — lightweight numerical time-series, near real-time. Log Analytics — richer structured log data queried with KQL. Application Insights — Azure Monitor's APM feature, tracking requests/exceptions/dependencies for a specific running app rather than raw infrastructure. See Lesson 16.