Glossary — Every Azure Term in the JD, Defined Precisely

The JD names ~140 Azure technologies and concepts. This glossary defines each to the depth an interviewer probes, and points to the phase where you build it. If a term in the JD is not here, that is a bug — open it as a gap.

Legend: → PNN = the phase that implements/teaches it.

A. Control Plane & Resource Management

  • Azure Resource Manager (ARM) — the single control-plane API and deployment engine in front of every Azure write. A request is an idempotent PUT/PATCH/DELETE to a URI like /subscriptions/{s}/resourceGroups/{rg}/providers/{ns}/{type}/{name}?api-version=…. ARM authenticates (Entra token), authorizes (RBAC + deny assignments), validates against Policy, then routes to the resource provider. → P00, P01
  • Resource provider (RP) — a service (e.g. Microsoft.Storage, Microsoft.Compute, Microsoft.Network) that owns a set of resource types and implements their control- plane CRUD. Must be registered on a subscription before use. → P01
  • Resource ID — the canonical, hierarchical identifier: /subscriptions/{sub}/resourceGroups/{rg}/providers/{namespace}/{type}/{name}. The unit of RBAC scope, Policy scope, tagging, and locks. → P00
  • Resource group (RG) — a lifecycle and scope boundary; resources in one RG share a region for metadata (not necessarily for the resource) and are deleted together. → P01
  • Management group (MG) — a container above subscriptions forming a tree (root → MGs → subscriptions → RGs → resources). Policy and RBAC assigned at an MG flow down by inheritance. Max depth 6 levels (excluding root/subscription). → P05
  • ARM template — a declarative JSON document ($schema, parameters, variables, resources, outputs) describing desired state. The deployment engine resolves dependsOn + implicit reference()/resourceId() dependencies into a DAG and deploys in topological order. → P01
  • Bicep — a typed DSL that transpiles to ARM JSON; same engine, nicer syntax, implicit dependency detection via symbolic references. → P01
  • Deployment mode — Incremental (default; leaves un-templated resources) vs Complete (deletes anything in the RG not in the template — a foot-gun). → P01
  • What-if — ARM's dry-run that diffs desired vs current state and classifies each change (Create/Modify/Delete/NoChange/Ignore). → P01
  • Deployment stack — a resource that manages a set of resources as a unit with managed deletion and deny-settings (drift protection). → P01, P05
  • Idempotency — applying the same desired state twice yields the same result and no duplicate side effects. ARM PUT is idempotent by design; the whole IaC model depends on it. → P01, P02

B. Infrastructure as Code

  • Terraform — declarative IaC with a state file (the recorded reality), a plan (desired vs state diff → create/update/replace/delete), and apply (executes the plan in dependency order). The azurerm provider maps HCL resources to ARM calls. → P02
  • State — Terraform's source of truth mapping config addresses to real resource IDs + attributes. Stored remotely (Azure Storage backend with blob lease locking) to allow team collaboration. Drift = real ≠ state. → P02
  • Plan graph / dependency ordering — Terraform builds a DAG from references and depends_on, walks it to order create/destroy; destroys run in reverse. → P02
  • ForceNew / replace — a change to an immutable attribute requires destroy-then-create (-/+), not in-place update. Recognizing which attributes are ForceNew is principal- level Terraform. → P02
  • CDKTF (Cloud Development Kit for Terraform) — author Terraform in TypeScript/Python/ etc.; synthesizes to Terraform JSON, then uses the normal plan/apply engine. → P02
  • Drift detection — comparing real state to recorded state to find out-of-band changes (terraform plan with refresh, or a deployment stack's deny-settings). → P02
  • Module / provider / backend — reusable config unit; the plugin that talks to a target API; where state lives. → P02

C. Identity — Microsoft Entra ID (Azure AD)

  • Microsoft Entra ID — Azure's cloud identity provider (formerly Azure AD): tenants, users, groups, service principals, app registrations, and the OAuth2/OIDC token service. The control-plane authentication authority. → P03
  • Tenant — an isolated Entra directory instance; identified by a tenant ID (GUID). The token issuer (iss) is scoped to a tenant. → P03
  • App registration vs service principal — the registration is the global app definition (in its home tenant); the service principal is the local identity/credential instance in a tenant that gets role assignments. → P03
  • OAuth2 — the authorization framework (RFC 6749). Grants used in Azure: authorization code (+ PKCE) for users, client credentials for daemons, on-behalf-of for middle tiers, device code for input-constrained devices. Issues access tokens. → P03
  • OpenID Connect (OIDC) — an identity layer on top of OAuth2 that adds the ID token (a JWT proving who the user is) and a discovery document (/.well-known/openid-configuration). → P03
  • PKCE (Proof Key for Code Exchange) — RFC 7636: the public client sends code_challenge = BASE64URL(SHA256(code_verifier)); at token exchange it presents the code_verifier. Defeats authorization-code interception. → P03
  • JWT (JSON Web Token) — base64url(header).base64url(payload).base64url(signature). Validation = verify signature against the issuer's JWKS key (by kid), then check iss, aud, exp, nbf, and authorization claims (scp for delegated scopes, roles for app roles). → P03, P09
  • Claims — iss (issuer), aud (audience = your API's app ID URI), sub (subject), exp/nbf/iat (validity window), scp (space-delimited delegated scopes), roles (app roles), appid/azp (client), oid/tid (object/tenant). → P03
  • JWKS / kid — the issuer's published JSON Web Key Set; the token header's kid selects which public key validates the signature, enabling key rotation. → P03
  • Conditional Access — policy engine that gates token issuance on signals (user, device compliance, location, risk) → grant/block/require MFA. → P03
  • Managed Identity — an Entra service principal that Azure manages for you so code holds no secret. System-assigned (tied to one resource's lifecycle) or user-assigned (standalone, attachable to many). Tokens are fetched from IMDS. → P12
  • IMDS (Instance Metadata Service) — the non-routable 169.254.169.254 endpoint a VM/ Function calls to get a Managed-Identity access token, no credential required. → P12
  • Workload identity federation — exchanging a trusted external OIDC token (e.g. GitHub Actions, a Kubernetes service account) for an Entra token with no stored secret, by matching the federated credential's issuer/subject/audience. → P08, P12

D. Authorization — RBAC & Policy

  • Azure RBAC — authorization model: a role assignment binds a security principal (user/group/SP/MI) to a role definition at a scope. Allow-based; assignments are additive and inherited down the scope hierarchy. → P04
  • Role definition — a named set of permissions: Actions, NotActions (subtracted), DataActions, NotDataActions, and AssignableScopes. Effective control-plane permission = Actions − NotActions, matched with wildcards (*, Microsoft.Storage/*/read). → P04
  • Deny assignment — an explicit deny that overrides role assignments (used by Azure Blueprints/managed apps/deployment stacks). Evaluation: deny wins. → P04
  • Control plane vs data plane authorization — Actions govern managing the resource (ARM); DataActions govern the data inside it (e.g. read a blob, get a secret). A storage Owner is not automatically a Blob Data Reader. → P04, P12
  • Azure Policy — governance engine evaluating resources against rules. Effects: audit, deny, append, modify, auditIfNotExists, deployIfNotExists (DINE), disabled. Evaluated at create/update (control plane) and on a compliance scan. → P04
  • Policy alias — maps a policy field to a provider property path (e.g. Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly) so rules can read resource properties. → P04
  • Initiative (policy set) — a bundle of policy definitions assigned together (e.g. a regulatory baseline). → P04, P05
  • Exemption / exclusion — a documented, time-boxed carve-out from a policy/initiative at a scope (notScopes). → P05

E. Governance at Scale — Landing Zones

  • Cloud Adoption Framework (CAF) — Microsoft's guidance for governed cloud adoption; the Azure Landing Zone (ALZ) is its reference architecture. → P05
  • Azure Landing Zone (ALZ) — a pre-built, governed environment: a management-group hierarchy (Platform / Landing Zones / Sandbox / Decommissioned), policy-as-code baselines, RBAC, hub networking, logging, and a subscription-vending process. → P05
  • Subscription vending — the automated, policy-compliant allocation of a new subscription into the right MG with budgets, RBAC, and networking pre-wired. → P05
  • Policy-as-code — policy/initiative definitions and assignments managed in Git and deployed via pipelines, so governance is reviewed and versioned. → P05

F. Networking

  • Virtual network (VNet) — an isolated L3 network in a region with a private address space (CIDR), subdivided into subnets. Software-defined: there is no physical switch you can see. → P06
  • Network security group (NSG) — a stateful, priority-ordered allow/deny firewall on a subnet or NIC. Rules (100–4096) are evaluated low-number-first; first match wins; default rules allow VNet-in/out and Azure LB and deny the rest. Stateful: the return packet is auto-allowed. → P06
  • User-defined route (UDR) / route table — overrides Azure's system routes. Next-hop chosen by longest-prefix match; ties break UDR > BGP > system. Used to force traffic through an NVA/firewall. → P06
  • System routes / BGP — Azure's default routes (VNet-local, internet, etc.) and dynamically learned routes (via ExpressRoute/VPN). → P06
  • Private Endpoint / Private Link — a private IP in your subnet that maps to a PaaS resource (storage, SQL, Key Vault), pulling it onto your VNet; it rewrites DNS so the public FQDN resolves to the private IP via a Private DNS zone. Misconfigured DNS is the #1 Private Endpoint failure. → P06, P12
  • Service endpoint — an alternative that extends a VNet identity to a PaaS service over the Azure backbone (no private IP). → P06
  • Azure Firewall / NVA — a managed (or third-party) stateful firewall used as the hub's egress/inspection point, targeted by UDRs. → P06
  • Hub-and-spoke — a topology with shared services (firewall, DNS, gateways) in a hub VNet peered to many spoke workload VNets. → P06
  • VNet peering / ExpressRoute / VPN Gateway — VNet-to-VNet private connectivity; private dedicated circuit to on-prem; encrypted tunnel to on-prem. → P06
  • Azure Front Door / Application Gateway / Load Balancer — global L7 CDN+WAF; regional L7 WAF/router; regional L4 distributor. → P06, P09

G. Containers

  • Docker image — an ordered stack of read-only layers + a config; identified by a content-addressed digest (sha256:…). A manifest lists the config + layer digests; a tag is a mutable pointer to a digest. → P07
  • OCI distribution — the registry API: blobs (layers/config) are content-addressable; pulling resolves tag → manifest → layer digests, fetching only missing layers. → P07
  • Azure Container Registry (ACR) — managed OCI registry with geo-replication, ACR Tasks (build/patch on push), content trust (Notary signing), soft-delete, and garbage collection of untagged manifests. → P07
  • AKS (Azure Kubernetes Service) — managed Kubernetes: control plane (managed) + node pools; the scheduler bin-packs pods onto nodes by requests, respecting limits, taints/tolerations, affinity, and topology. → P07
  • Azure Container Apps (ACA) / Container Instances (ACI) — serverless containers (KEDA-driven scale-to-zero) and single-shot container groups; the non-Kubernetes paths. → P07

H. CI/CD & Supply Chain

  • Azure Pipelines / GitHub Actions — CI/CD as a DAG of stages → jobs → steps with dependsOn, conditions, matrix fan-out, environments, and approval gates. → P08
  • OIDC deployment federation — the pipeline presents its OIDC token to Entra and gets an access token via workload-identity federation — no stored cloud secret. The modern default for CI deploys. → P08, P12
  • Deployment strategy — blue-green (swap two environments), canary (shift a % then ramp), rolling — with a health gate that triggers automatic rollback. → P08, P14
  • Artifact / SBOM / provenance — the built unit, its bill of materials, and signed evidence of how/where it was built (supply-chain integrity). → P08

I. APIs & Edge

  • REST / JSON — resource-oriented HTTP: methods (GET/POST/PUT/PATCH/DELETE), status codes, idempotency, pagination, and JSON bodies. → P09
  • Azure API Management (APIM) — the API gateway: products/APIs/operations, a policy pipeline (inbound → backend → outbound → on-error) for JWT validation, rate-limit/quota, caching, transformation, and routing. → P09
  • Scope / app-role authorization — the API validates the token's scp (delegated) or roles (app) claim against the operation's requirement before letting the call through. → P09
  • Token-bucket rate limiting — capacity + refill-rate algorithm bounding request rate; the basis of rate-limit and quota policies; returns 429 Too Many Requests + Retry-After. → P09, P14

J. Eventing & Messaging

  • Azure Service Bus — enterprise message broker: queues + topics/subscriptions, peek-lock (lock → process → complete/abandon/dead-letter), sessions (FIFO per session key), duplicate detection (dedup window by MessageId), scheduled and deferred messages, transactions, and dead-letter queues (DLQ) on max-delivery or TTL expiry. At-least-once by default. → P10
  • Azure Event Grid — a push event-routing service (publish/subscribe) using CloudEvents; at-least-once delivery with exponential-backoff retry and dead-lettering to storage; filters by event type/subject. → P10
  • Event Hubs — high-throughput event streaming (partitioned log, consumer offsets); the Kafka-shaped sibling (named here for contrast). → P10
  • Logic Apps — a serverless workflow orchestrator (connectors + triggers + actions) for integration; the low-code complement to Functions. → P10
  • Delivery semantics — at-most-once (fire&forget), at-least-once (retry → may duplicate; the practical default), exactly-once-effect (at-least-once + idempotent consumer / dedup). → P10

K. Serverless Compute

  • Azure Functions — event-driven serverless compute: a trigger (queue, HTTP, timer, Event Grid) invokes a function; bindings declaratively wire inputs/outputs. The scale controller adds/removes instances based on event source backlog. → P11
  • Hosting plans — Consumption (scale-to-zero, pay-per-exec), Flex Consumption / Premium (pre-warmed, VNet), Dedicated. Cold start is the Consumption tradeoff. → P11
  • Durable Functions — stateful orchestration on Functions via event sourcing: the orchestrator function is replayed from its history on each event, so it must be deterministic (no DateTime.Now, no random, no I/O outside activities). Patterns: function chaining, fan-out/fan-in, async HTTP, monitor, human interaction. → P11

L. Secrets & Encryption

  • Azure Key Vault — managed store for secrets, keys, and certificates, with soft-delete + purge protection (recoverable deletes), versioned objects, and two authorization models: RBAC (recommended) or legacy access policies. → P12
  • Envelope encryption — encrypt data with a DEK (data encryption key), then encrypt (wrap) the DEK with a KEK (key encryption key) held in Key Vault/HSM; rotate the KEK without re-encrypting data. → P12
  • Managed HSM / key rotation / versioning — FIPS 140-2 L3 single-tenant HSM; automated key rotation creating new versions while old versions still decrypt. → P12

M. Observability & Operations

  • Azure Monitor — the umbrella: Metrics (numeric time series), Logs (Log Analytics workspace), Alerts, and Application Insights (APM + distributed tracing). → P13
  • KQL (Kusto Query Language) — the read query language over Log Analytics: where/project/summarize … by/bin()/join/top/render. The principal's incident tool. → P13
  • Application Insights / distributed tracing — request/dependency telemetry correlated by operation_Id across services; sampling controls cost/cardinality. → P13
  • Alert rule — threshold/aggregation over a metric or log query window → action group (page/email/webhook). → P13

N. Reliability, HA & Cost

  • Availability zone (AZ) — physically separate datacenter(s) within a region; spreading replicas across zones survives a datacenter failure. → P14
  • Region pair / paired region — two regions with platform-coordinated updates and (for some services) geo-replication for disaster recovery. → P14
  • SLA composition — multiply availabilities of serial dependencies; combine redundant components as 1 − ∏(1 − Aᵢ). More serial dependencies → lower composite SLA. → P00, P14
  • Retry with backoff + jitter / retry budget — bounded exponential backoff with randomized jitter to avoid thundering herds, capped by a budget so retries can't amplify an outage. → P14
  • Circuit breaker — closed → (failures exceed threshold) → open (fail fast) → half-open (probe) → closed; protects a struggling dependency. → P14
  • Throttling / 429 / Retry-After — Azure services rate-limit; well-behaved clients honor Retry-After and back off rather than hammering. → P14
  • Well-Architected Framework (WAF) — the five pillars: Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency — the rubric every design review scores against. → P00, P15
  • FinOps — quantifying and optimizing cloud spend (reservations, right-sizing, autoscale, lifecycle tiers, scale-to-zero) as an engineering discipline. → P15