Concept Index — Azure and DevOps mental model
Use this as the vocabulary entry point, not as a list to memorize. Start with a workload, then follow the relationships it needs: an owner, identity, authorization, runtime, data, network, delivery path, observability, recovery, and cost control.
How to read the graph
Identity authenticates as a principal → principal receives permission at a scope → pipeline uses a service connection → workload uses a runtime and data service → monitoring observes the workload → recovery protects it.
If the same term occurs in multiple planes, start at the disambiguation note rather than selecting a result by name alone.
Foundation and management plane
cloud-computing · azure-region · availability-zones · zone-redundant · azure-management-hierarchy · tenant · management-groups · subscription · resource-group · arm · workload
Shared beginner example
Northwind Traders is the fictional online grocery business used in core glossary examples. Read it once, then use its people and ordering application to make scope, resilience, identity, and cost terms concrete.
Find a term by the name you know
Use this table when a product has been renamed, or when the same word names several Azure services.
| Search term | Canonical concept | Read this when |
|---|---|---|
| Active Directory, AD, Azure AD, or Entra | active-directory | You need to distinguish Windows Server AD DS, Microsoft Entra ID, and Microsoft Entra Domain Services. |
| Microsoft Entra or Azure Active Directory | entraid | You mean the cloud identity product formerly called Azure AD. |
| Service account | service-account | You need to choose a non-human identity for a service, workload, or pipeline. |
| Azure Blob Storage, blob, or container | blob-storage | You need object storage, rather than a file share, queue, table, or VM disk. |
| Gateway | gateway | You need to identify whether the requirement is web routing, hybrid connectivity, or outbound internet access. |
Identity and authorization plane
active-directory · entraid · active-directory-domain-services · entra-domain-services · user-account · groups · service-account · service-principal · managed-identity · workload-identity-federation · rbac · role-assignment · scope · security-group · azure-devops-security-groups · azure-devops-access-levels
Network and access path
vnet · subnet · nsg · asg · service-endpoint · private-endpoint · private-dns · vnet-peering · gateway · load-balancer · application-gateway · vpn-gateway · nat-gateway · web-application-firewall · health-probe
Data, runtime, and recovery
storage-account · blob-storage · azure-files · key-vault · azure-vm · app-service · azure-app-container-apps · acr · azure-backup · azure-site-recovery
Delivery and collaboration plane
git · github · azure-repos · azure-boards · github-issues-projects · pull-request · branch-protection · service-connection · azure-pipelines · github-actions · azure-pipelines-secure-files · pipeline-yaml · deployment-environment
Quality, security, and feedback plane
test-coverage · secret-scanning · github-advanced-security · azure-monitor · application-insights · kql · alerting · github-project-insights · devops-flow-metrics
High-confusion comparisons
| If you are deciding between | Begin here |
|---|---|
| Entra group, Azure DevOps permission group, or network grouping | security-group |
| Service account, service principal, managed identity, or workload federation | service-account |
| Azure DevOps service connection, service endpoint, or private endpoint | service-connection |
| Azure RBAC role, Entra directory role, Azure Policy, or resource lock | rbac |
| Azure DevOps access level and Azure DevOps permission | azure-devops-access-levels |
| Key Vault secret, pipeline variable group, and secure file | azure-pipelines-secure-files |
| GitHub Project chart, Azure Boards query, and Azure Monitor dashboard | github-project-insights |
| Application Gateway, VPN Gateway, ExpressRoute gateway, and NAT Gateway | gateway |
| Blob Storage, Azure Files, Azure Queue Storage, and Azure Table Storage | blob-storage |
| Windows Server AD DS, Microsoft Entra ID, and Microsoft Entra Domain Services | active-directory |
A rule for adding concepts
Add an atomic concept only when it has a distinct decision, configuration boundary, or failure mode. Use aliases for spelling and product-name variants. Add a disambiguation note when one label means materially different things across Entra, Azure, Azure DevOps, and GitHub. This index is the vocabulary control point: add a learner-facing synonym here and to the canonical note, rather than adding a duplicate definition. Link every new concept to the workload and permission/delivery/observability plane it affects.
Related
workload · security-group · service-account · service-connection · Source-to-Vault Audit