AZ-900 Glossary: 55 Azure Key Terms Explained (2026)

A blob storage cost setting that trades storage price against access price: hot for frequent access, cool and cold for less frequent access, and archive for rarely used data that must be rehydrated before reading.

On the examMatch access frequency to tier. Archive is cheapest to store but offline and slow to retrieve; hot costs most to store but least to read. Tiers apply to blob data.

Azure's deployment and management layer. Every request from the portal, CLI, PowerShell or SDK passes through it, and it applies authentication, RBAC, policies, locks and tags consistently.

On the examKnow that all tools talk to ARM, and that ARM templates are declarative JSON files describing what to deploy, which ARM then builds in the right order.

A way to spread VMs across separate fault domains (power and network racks) and update domains (maintenance batches) inside one datacenter so a single hardware fault or update does not take them all down.

On the examProtects against rack failure or planned maintenance, not a datacenter outage. If the question says 'entire datacenter', choose availability zones; if 'region', choose region pairs.

Don’t confuse with Availability Zone

A physically separate location within an Azure region made up of one or more datacenters with independent power, cooling and networking. Supported regions have at least three zones.

On the examPicked for protecting an app from a datacenter failure within one region. Zonal services pin to a zone; zone-redundant services replicate across zones automatically.

Don’t confuse with Availability Set

A cloud-hosted desktop and app virtualization service that runs Windows desktops in Azure and streams them to users on any device. It supports multi-session Windows, so several users can share one VM.

On the examCue: remote workers need a secure Windows desktop without company data stored on their personal devices. Distractor answers are plain VMs or a VPN Gateway.

A free service that analyzes your deployed resources and gives personalized recommendations in five categories: reliability, security, performance, operational excellence and cost.

On the examCue: get recommendations to cut cost or improve performance of existing resources. It does not report Azure outages; that is Service Health.

Don’t confuse with Azure Service Health

A PaaS offering for hosting web apps, REST APIs and mobile back ends without managing servers. It supports several languages, deployment slots, autoscale and built-in load balancing.

On the examCue: host a website or API with no OS management and built-in scaling. It is PaaS, so a question asking who patches the OS answers Microsoft.

A service that extends Azure management, governance and security to servers, Kubernetes clusters and data services running on premises or in other clouds, projecting them into Azure Resource Manager.

On the examCue: manage on-premises or AWS servers with Azure Policy and RBAC from one place. Wrong answers usually involve migrating the servers; Arc manages them where they are.

A browser-based command-line environment built into the Azure portal that offers both Bash (with Azure CLI) and PowerShell, already authenticated and with tools preinstalled, so nothing is installed locally.

On the examCue: run commands without installing anything on a local machine. Azure CLI and Azure PowerShell are the command tools; Cloud Shell is where you run them in the browser.

A physical, rugged storage device Microsoft ships to you for moving large amounts of data, often terabytes, into or out of Azure when the network is too slow, expensive or unavailable.

On the examCue: huge dataset, limited bandwidth or no connectivity. Distractors are AzCopy and Azure Migrate; Azure Migrate assesses and moves servers, while Data Box moves bulk data offline.

Azure's event-driven serverless compute service. You write small pieces of code that run in response to triggers such as HTTP requests, timers or queue messages, and pay only while they execute.

On the examPicked when work is short, event-triggered and should cost nothing when idle. Wrong answers: a VM (always running) or App Service when the stem stresses event-driven, per-execution billing.

Don’t confuse with Azure App Service

The platform that collects, analyzes and acts on metrics and logs from Azure, on-premises and other clouds. It includes Log Analytics for queries, alerts for notifications and Application Insights for app performance.

On the examCue: collect telemetry, query logs, alert on a CPU threshold or track web app performance. Application Insights is the answer for application-level monitoring.

Don’t confuse with Azure Service Health

A service that creates, assigns and enforces rules on resource properties, such as allowed regions or required tags, and reports which resources are noncompliant. Related policies can be grouped into initiatives.

On the examCue: resources may only be deployed in certain regions or must carry a tag. The distractor is RBAC, which controls who acts, not what the resource looks like.

Don’t confuse with RBAC

A personalized view of Azure platform issues, planned maintenance and health advisories that affect the services and regions you use, combining Azure status, Service Health and Resource Health.

On the examCue: find out whether a Microsoft outage or planned maintenance is affecting your resources. Azure Monitor watches your own telemetry; Service Health watches Microsoft's platform.

Don’t confuse with Azure Monitor

Up-front spending on physical assets such as servers, storage and datacenter buildings. The cost is paid once and then depreciated over the asset's life. Typical of on-premises and private cloud.

On the examBuying hardware or building a datacenter is CapEx. The exam almost always pairs it against OpEx and expects you to say that moving to public cloud shifts spending from CapEx to OpEx.

Don’t confuse with OpEx

A Microsoft Entra ID feature that evaluates signals such as user, location, device and risk at sign-in, then allows access, blocks it or demands extra steps like MFA based on rules you set.

On the examCue: require MFA only when users sign in from an unfamiliar location or unmanaged device. It is a policy engine that decides when to use MFA, not MFA itself.

Don’t confuse with MFA

Paying only for the cloud resources you actually use, billed by time, volume or transactions, instead of buying capacity in advance. Azure also offers reservations and savings plans as discounted commitment-based pricing models.

On the examLinked to OpEx and 'no upfront costs'. When the stem says 'pay only for what you use' or 'stop paying when resources are deallocated', the answer is the consumption-based model.

Protecting data with multiple layers of security so that if one layer is breached, others still stand. Layers run from physical security through identity, perimeter, network, compute and application to data.

On the examQuestions ask for the layer order or which layer a control belongs to. Data is the innermost layer; physical security is the outermost.

Don’t confuse with Zero Trust

A private, dedicated connection between an on-premises network and Microsoft cloud services, delivered through a connectivity provider. Traffic does not cross the public internet, giving more reliability and predictable speed.

On the examKeywords: private connection, does not use the internet, higher bandwidth, consistent latency. The trap is assuming ExpressRoute encrypts traffic by default; its selling point is privacy, not internet encryption.

Don’t confuse with VPN Gateway

Keeps three copies in one datacenter of the primary region (like LRS) and asynchronously copies the data to a secondary region hundreds of miles away. RA-GRS adds read access to the secondary copy.

On the examCue: data must survive an entire regional disaster. If the stem also needs to read from the secondary region without failover, the answer is the read-access variant.

Don’t confuse with ZRS

Designing a service so it stays accessible with minimal downtime even when individual components fail. Usually expressed as an uptime percentage in a service-level agreement, such as 99.9 or 99.99 percent.

On the examAsked as a benefit of the cloud: keep the app running when hardware fails. Do not confuse with scalability, which is about handling more demand, not surviving failures.

Don’t confuse with Scalability

An environment that connects private (on-premises) and public cloud resources so workloads and data can move between them. Lets an organization keep sensitive systems local while bursting or extending into Azure.

On the examCue words: keep some data on premises for compliance but use Azure for extra capacity or new apps. Azure Arc is the tool answer when the question asks how to manage both from Azure.

Renting raw compute, storage and networking from a provider. You control and maintain the operating system, runtime and applications; the provider manages the physical hardware. Azure Virtual Machines are the standard example.

On the examPick IaaS when the customer needs full OS control, custom software installs or a lift-and-shift migration. It gives the most customer responsibility of the three cloud service types.

Don’t confuse with PaaS

Defining infrastructure in declarative or script files instead of creating it by hand, so deployments are repeatable, version-controlled and consistent. ARM templates and Bicep are Azure's native IaC formats.

On the examCue: deploy the same environment repeatedly and consistently, or keep infrastructure in source control. ARM templates are the most likely named answer.

The cheapest redundancy option: three copies of the data kept within a single datacenter in the primary region. It protects against drive or rack failure but not against the loss of that datacenter.

On the examLowest cost, lowest durability. If the scenario must survive a datacenter outage, LRS is the wrong answer; move to ZRS or a geo option.

Don’t confuse with ZRS

A container above subscriptions used to apply governance, such as Azure Policy and RBAC, across many subscriptions at once. Settings are inherited downward and groups can be nested up to six levels deep.

On the examCue: apply one policy or role to many subscriptions. Know the hierarchy order: management groups, then subscriptions, then resource groups, then resources.

Don’t confuse with Resource Group

Requiring two or more kinds of evidence to sign in: something you know (password), something you have (phone or key) and something you are (fingerprint or face). It stops most password-only attacks.

On the examCue: a stolen password must not be enough to sign in. Distractor: SSO, which reduces the number of sign-ins but adds no extra verification.

Don’t confuse with Conditional Access

The Azure tool that shows and analyzes actual spending, sets budgets and sends alerts when costs approach a threshold. It can break costs down by subscription, resource group or tag.

On the examCue: track, report or alert on current Azure spend, or set a budget. Estimates for future designs belong to the pricing calculator instead.

Don’t confuse with Pricing Calculator

A security posture management and threat protection tool that monitors Azure, on-premises and other clouds, scores your security posture and recommends or enforces hardening steps.

On the examCue: assess security posture, get a secure score, detect threats across hybrid and multicloud resources. Azure Advisor gives broader best-practice tips; Defender is security-focused.

Microsoft's cloud identity and access management service, formerly called Azure Active Directory. It authenticates users and apps, provides single sign-on, and underpins MFA and Conditional Access for Azure and Microsoft 365.

On the examQuestions now say Microsoft Entra ID, but older materials say Azure AD; treat them as the same service. Entra ID handles who you are, RBAC handles what you can do.

A family of data governance, risk and compliance tools that discovers, classifies and maps data across on-premises, multicloud and SaaS sources and helps protect sensitive information.

On the examCue: find and classify sensitive data or see data lineage across the estate. Azure Policy governs resource configuration, while Purview governs the data itself.

Ongoing spending on services or products as they are consumed, billed in the period it is used, with no large up-front purchase. Public cloud subscriptions are the classic example.

On the examMonthly Azure bills, pay-as-you-go and 'no upfront investment' all signal OpEx. Distractor: CapEx, which applies only when the company is buying equipment outright.

Don’t confuse with CapEx

A managed platform for building and running applications. The provider handles the OS, patching and runtime; you manage your code and data. Azure App Service and Azure SQL Database are common examples.

On the examCue: developers want to focus on code, not patch servers. The distractor is IaaS (still patching) or SaaS (no custom code). PaaS sits in the middle of the responsibility split.

Don’t confuse with SaaS

A free web tool that estimates the monthly cost of Azure services before you deploy them, based on the region, tier, size and usage you choose. It does not show actual spend.

On the examCue: estimate cost of a planned solution before building it. If the resources already exist and you need to track actual spend, the answer is Cost Management.

Don’t confuse with Microsoft Cost Management

Cloud resources used exclusively by one organization, either in its own datacenter or hosted by a provider. It gives maximum control over hardware and compliance but the organization carries the cost of buying and maintaining it.

On the examPicked when a scenario stresses full control of hardware, strict data residency or a single tenant. Remember the trade-off: control goes up, but so do CapEx and maintenance.

Don’t confuse with Hybrid Cloud

Computing services owned and run by a third-party provider such as Microsoft and delivered over the internet to many customers who share the underlying hardware. No capital outlay; you pay for what you use.

On the examScenario cues: no upfront hardware cost, fast provisioning, pay only for usage. Wrong answer is usually private cloud when the company wants to avoid buying servers.

Don’t confuse with Private Cloud

Azure's authorization system that grants users, groups or apps a role, such as Owner, Contributor or Reader, at a specific scope. Permissions are inherited down from management groups to resources.

On the examControls what people can do. If the question is about what resources may be created or how they must be configured, the answer is Azure Policy, not RBAC.

Don’t confuse with Azure Policy

A geographic area containing one or more Azure datacenters linked by a low-latency network. You choose a region when deploying most resources, which affects latency, data residency, service availability and price.

On the examAsked when the goal is to place resources close to users or meet data residency laws. Note that not every service or VM size is available in every region.

Two Azure regions in the same geography, usually at least 300 miles apart, paired for disaster recovery. Microsoft staggers platform updates across the pair and prioritizes restoring one region of the pair in a wide outage.

On the examSignals protection against a whole-region disaster. If the question is about surviving a single datacenter failure inside one region, the answer is availability zones instead.

Don’t confuse with Availability Zone

A logical container that holds related Azure resources for an app or project. Each resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it.

On the examClassic true/false items: a resource can be in only one group; groups cannot contain other groups; resources in a group can live in different regions. Deleting the group deletes its resources.

A setting that protects a subscription, resource group or resource from accidental change. CanNotDelete allows edits but blocks deletion; ReadOnly blocks both. Locks apply even to Owners until removed.

On the examCue: prevent accidental deletion, even by administrators. Know both lock types and that locks override RBAC permissions until someone removes the lock.

Complete, ready-to-use software delivered over the internet on a subscription. The provider runs everything; the customer only configures the app and manages its own users and data. Microsoft 365 is the standard example.

On the examEmail, office apps or CRM that users simply sign into point to SaaS. It carries the least customer responsibility, yet data and accounts are still the customer's job.

The ability to adjust resources to meet demand. Scaling up (vertical) adds CPU or memory to an existing resource; scaling out (horizontal) adds more instances. Automatic scaling to demand is often called elasticity.

On the examScenario says traffic spikes during a sale and must be handled, then shrink afterwards. Know vertical means bigger machine and horizontal means more machines; the exam checks that distinction directly.

Don’t confuse with High Availability

A cloud model where the provider runs and scales the servers automatically and you supply only code or configuration. You are billed per execution or per use, and nothing costs money while it sits idle.

On the examCues: event-driven, runs only when triggered, no server management, pay per execution. Azure Functions is the service answer; a VM is the wrong answer because you still manage the OS.

The split of security and operational duties between the cloud provider and the customer. The provider always owns the physical datacenter; the customer always owns its data, devices, accounts and identities. Everything in between shifts with the service type.

On the examQuestions ask who is responsible for OS patching or data. Rule of thumb: the customer patches the OS in IaaS only; data and identities stay with the customer in every model, including SaaS.

An Azure instance isolated from the main public cloud for legal or compliance reasons, such as Azure Government for US agencies or Azure operated by 21Vianet in China. Access is restricted and operated separately.

On the examCue: a government agency or regulated body needing a physically and logically isolated Azure environment. A normal region with a policy is the wrong answer.

The top-level Azure container that holds your data services, such as blobs, files, queues and tables, under a globally unique name. Its type sets which services, performance tier and redundancy options are available.

On the examKnow the four data services (Blob, Files, Queue, Table) and that the account name must be unique across Azure because it forms the endpoint URL.

A billing and access boundary that links an Azure account to the resources it creates. Organizations use separate subscriptions to split costs by department or environment and to apply different limits and access.

On the examScenario asks how to bill departments separately or isolate dev from production: create separate subscriptions. Distractor: resource groups, which organize resources but do not create separate bills.

Don’t confuse with Management Group

Name-value pairs attached to resources, resource groups or subscriptions as metadata, such as Department=Finance. They help organize resources, report costs and drive automation.

On the examCue: group costs by department or project across multiple resource groups. Tags are not inherited automatically; Azure Policy can enforce or copy them.

A software emulation of a physical computer running in Azure. It is IaaS, so you choose the OS and size and remain responsible for configuring, patching and maintaining the software on it.

On the examChosen when a scenario needs total OS control or a lift-and-shift of an existing server. Resources a VM needs: a disk, a network interface and a virtual network.

A group of identical, load-balanced VMs that Azure can add or remove automatically according to demand or a schedule. It lets you run many VMs as one scalable unit.

On the examPick scale sets when the stem says the number of VMs must grow and shrink automatically with load. An availability set does not add VMs; it only spreads existing ones.

A private network in Azure that lets resources communicate with each other, the internet and on-premises networks. It is divided into subnets, and two VNets can be linked through peering.

On the examKnow its jobs: isolation and segmentation, internet and on-premises connectivity, and traffic filtering. Peering connects two VNets; a VPN Gateway connects a VNet to on premises.

An Azure service that sends encrypted traffic between an Azure virtual network and an on-premises location or individual devices over the public internet, using site-to-site or point-to-site connections.

On the examCue: encrypted connection over the internet, lower cost. If the stem says the traffic must not travel over the public internet, the answer switches to ExpressRoute.

Don’t confuse with ExpressRoute

A security model that assumes breach and trusts no request by default, even inside the network. Its principles are verify explicitly, use least-privilege access and assume breach.

On the examCue: never trust based on network location; verify every request. Know the three principles by name, as items often ask which principle a scenario illustrates.

Don’t confuse with Defense in Depth

Copies data synchronously across three availability zones in the primary region, so the data stays available if one zone's datacenter goes down. It does not copy to a second region.

On the examRight answer for surviving a datacenter or zone failure while keeping data in one region. For a full regional outage the answer is GRS or GZRS.

Don’t confuse with GRS