Azure comparison boundaries

This note is a decision map, not a glossary list. Each comparison names the handoff between concepts and the failure that reveals a wrong choice. The linked canonical notes provide the detailed mechanics.

Identity, scope, and governance

Authentication identifies; authorization permits. A user or workload authenticates through Microsoft Entra ID, then Azure RBAC authorizes control-plane actions at a scope. Entra roles authorize directory operations; Azure RBAC roles authorize Azure resource operations. A successful sign-in with the wrong RBAC role produces an authorization failure, not an authentication failure. A service principal is an application identity, a managed identity is an Azure-managed application identity, and workload identity federation exchanges a trusted external token without storing a client secret. A service account is the broader non-human-identity idea; it is not a fourth Azure credential type. See identity and authorization boundary.

Tenant, subscription, management group, and resource group are different boundaries. A tenant owns the directory. A subscription is a resource, billing, quota, and authorization boundary that trusts a tenant. A management group organizes subscriptions and can inherit governance; a resource group organizes resources in one subscription and is also a deployment and lifecycle boundary. A policy assignment or RBAC assignment at the wrong level can either miss the target or affect too much. Resource locks protect management operations; Azure Policy evaluates whether a resource or operation complies; RBAC decides who may act. A lock does not grant access, and Policy does not replace least-privilege authorization.

Control plane and data plane are separate handoffs. ARM and Azure RBAC govern management requests such as creating a storage account. The service’s data plane governs reading a blob or sending a queue message. A principal can create a storage account yet be unable to read its data; inspect data-plane role, credential, and network controls at that boundary.

Network names, paths, and security controls

A service connection is delivery configuration; a service endpoint is a network feature; a private endpoint is a private interface. A pipeline uses a service connection to authenticate to Azure. A VNet service endpoint extends selected subnet identity to a supported public service endpoint. A private endpoint places a private IP interface in the VNet and depends on DNS resolving the service name to that address. A pipeline can hold a valid service connection and still fail because DNS or the network path blocks the target.

NSG, ASG, and Azure Firewall operate at different scopes. An NSG filters permitted traffic on subnet or network-interface boundaries. An application security group groups interfaces for readable NSG rules; it does not filter packets by itself. Azure Firewall is a centralized, stateful network control for traffic crossing its designed path. If an ASG rule appears correct but traffic still crosses an unfiltered route, the ASG was treated as a firewall rather than an NSG rule operand.

Public IP, Load Balancer, Application Gateway, and Front Door are not interchangeable. A public IP is an address. Load Balancer distributes network-level flows within a region. Application Gateway is a regional application-layer HTTP(S) gateway with features such as listener, routing, and WAF controls. Front Door is a global HTTP(S) edge entry point. Choosing an address does not create distribution, and choosing a regional gateway does not create global edge routing. A failed request should be traced as DNS resolution, route, listener, backend health, and application response.

Availability, protection, and recovery

Availability set, availability zone, and VM scale set solve different problems. An availability set spreads VMs across fault and update domains in a datacenter grouping. Availability zones place instances in physically separate zones within a region. A VM scale set manages a group of similar VMs and can use an availability strategy plus autoscale. These improve placement and recovery from different failures; none is a backup. A capacity or platform failure exposes the placement decision, while rising load exposes the scale decision.

Backup, replication, and Site Recovery have different recovery boundaries. Backup creates recoverable points for restore. Replication maintains a copy or synchronized state for a separate recovery target. Azure Site Recovery orchestrates replication-based disaster recovery and failover/failback. Replication without a usable recovery plan is not a tested disaster recovery capability; backup is not an instant failover mechanism.

Storage and integration choices

Blob Storage, Azure Files, and managed disks expose different storage abstractions. Blob Storage is object storage accessed through an API. Azure Files presents managed file shares over file protocols. Managed disks are block volumes attached to compute. A workload that needs a mounted shared filesystem should not be given an object URL, and a VM boot volume should not be designed as a blob container.

Keys, SAS, and Entra authorization differ in delegation and lifecycle. Storage account keys are broad shared secrets. A SAS delegates bounded operations and time, but the token must still be protected. Entra authorization uses a principal and role assignment and is usually the clearest identity trail. A SAS that outlives its need or a leaked account key turns a narrow access requirement into a credential-rotation incident.

Queue Storage, Service Bus, Event Grid, and Event Hubs describe different messaging contracts. Queue Storage holds simple work items. Service Bus provides richer enterprise messaging features such as competing consumers, dead-lettering, and transactional patterns. Event Grid announces discrete events to subscribers. Event Hubs ingests a high-volume partitioned event stream whose consumers track position. A notification delivery failure, dead letter, or consumer lag identifies which boundary was misunderstood.

Compute and application lifecycle

App Service, Functions, Container Apps, ACI, and AKS differ in the unit being operated. App Service hosts managed web applications; Functions runs event-triggered code; Container Apps runs containerized applications with a managed application environment; ACI runs individual containers or tasks; AKS exposes Kubernetes cluster control. More control brings more platform responsibility. Selecting AKS for one short-lived task or Functions for a continuously managed web process is a lifecycle mismatch.

A deployment slot is a runtime version boundary; an environment is an operational boundary. Slots or revisions let a service warm and test a version before traffic changes. An environment usually represents a separately governed target such as test or production. Swapping a slot does not replace approvals, configuration ownership, data migration planning, or environment isolation.

A package, build artifact, and container image are related but not identical. A package is a distributable format; a build artifact is the immutable output selected for promotion; a container image packages application layers and runtime expectations. The build produces the artifact, a registry stores it, and deployment promotes it into a runtime. Rebuilding during deployment breaks traceability and can make rollback point at different bytes.

Delivery, secrets, and feedback

A CI trigger starts work; an approval or gate controls promotion. A push, pull request, schedule, or webhook can trigger a build. An environment approval or automated gate pauses deployment until a human or signal allows it. Triggering a pipeline is not approving production. A GitHub Actions runner executes GitHub workflow jobs; an Azure Pipelines agent executes Azure Pipelines jobs. They are execution workers in different delivery systems, not interchangeable permission objects.

A secret, certificate, and key have different jobs. A secret is confidential data, a certificate binds an identity to a public key, and a cryptographic key encrypts, signs, or decrypts. Key Vault stores and controls access to these objects; it does not make an application authorized merely because the object exists. A certificate-expiry failure and a missing RBAC data-plane role require different repairs.

Metrics, logs, and traces answer different questions. Metrics summarize numeric behavior over time, logs record events and context, and traces follow a request across components. Azure Monitor collects and analyzes signals; an alert rule evaluates a signal and condition; an action group routes notification or automation. An action group does not detect a problem, and a metric alert cannot explain a missing per-request dependency without logs or traces.

Rollback, roll-forward, and hotfix are response choices. Rollback returns traffic or code to a known-good version. Roll-forward fixes the current line and promotes a new version. A hotfix is an urgent narrowly scoped change, usually still subject to review and traceability. A database schema that cannot safely move backward is a common reason to roll forward rather than blindly roll back. Availability is a current service outcome; resilience is the ability to withstand disruption; disaster recovery is the planned restoration of service after a serious failure. Monitoring reports the condition, while recovery design changes the outcome.

Route and sources

Read this after the prerequisite bridge and revisit it at the identity, networking, storage, runtime, and delivery handoffs in the four course MOCs. The cross-course maps show the same relationships spatially.

• Azure architecture fundamentals and Azure resource hierarchy, checked 2026-08-31.
• Azure RBAC overview, Azure Policy overview, and resource locks, checked 2026-08-31.
• Private endpoints, Azure networking services, and Azure Front Door, checked 2026-08-31.
• Azure messaging services, Azure compute options, and Azure Monitor overview, checked 2026-08-31.

Re-audit when a service changes its identity, networking, lifecycle, reliability, messaging, monitoring, or retirement behavior, or when the four official course/study-guide baselines change.

Related

identity and authorization boundary · azure-management-hierarchy · service-connection · service-endpoint · private-endpoint · event-grid · event-hubs · service-bus · deployment-slots · build-artifact · telemetry · alert-rule · action-group