Sections

9. Glossary and Cheatsheet

9 min read

The 10-second lookup.

Glossary

Activity function — An ordinary function invoked by a Durable orchestrator; where all real side effects belong.

Always On — A Dedicated-plan setting that stops the site being unloaded when idle. Required for timer triggers on Dedicated plans; a classic missing-setting bug.

Always-ready instances — Flex Consumption's pre-provisioned baseline that removes cold start for the first N concurrent executions. Billed even when idle.

App setting — An environment variable on the function app. Encrypted at rest, but readable by anyone with control-plane access. Not a secret store.

authLevel — Per-HTTP-function authorisation setting: anonymous, function (the default), or admin.

AzureWebJobsStorage — The app setting naming the storage account the host requires for trigger metadata, timer schedules, leases, Durable state, function keys, and usually the deployment package. Not optional.

Binding — A declarative connection to another service, resolved by the host. Input bindings are read before your code runs; output bindings are written after it returns successfully.

Binding expression — A placeholder resolved at binding time from the trigger payload ({queueTrigger}) or from an app setting (%SettingName%).

Cold start — The latency added when a request is served by an instance that wasn't already running. Four distinct stages: worker allocation, host start, language worker + dependency load, and your own first-call initialisation.

Consumption plan — The original serverless plan. Scales to zero, cheapest idle, no VNet integration, shortest timeout ceiling.

Custom handler — A lightweight HTTP server in any language that the host forwards events to. The escape hatch for unsupported runtimes.

Dedicated plan — An ordinary App Service Plan hosting functions. Bills hourly regardless of activity; free at the margin if you already run one.

Deployment slot — A parallel instance of the site with its own code and (unless sticky) its own settings, swappable with production near-atomically. The best rollback mechanism available here.

Durable Functions — An extension adding stateful orchestration — fan-out/fan-in, human approval waits, sagas — on top of ordinary functions, with state in a storage task hub.

Easy Auth — Informal name for App Service Authentication: platform-level identity validation on inbound requests, before your code runs.

Entity function — A small piece of addressable durable state with operations, for counters and aggregations.

Extension bundle — A versioned set of binding extensions declared in host.json, so non-.NET apps don't install binding packages by hand.

Flex Consumption — The modern serverless plan: scale-to-zero economics plus VNet integration, always-ready instances, and a longer configurable timeout. A distinct Terraform resource type, not a plan SKU.

Function — A named handler with exactly one trigger. Not an ARM resource: no resource ID, no RBAC, no independent scaling, no own identity.

Function app — The Microsoft.Web/sites resource with kind = functionapp. The deployment, scaling, configuration, and identity unit containing many functions.

Function key — A shared secret scoped to one HTTP function, passed as ?code= or the x-functions-key header. The default HTTP authorisation, and not an authentication strategy.

Functions runtime version — The major version of the host, currently v4, set by FUNCTIONS_EXTENSION_VERSION.

GB-second — Memory observed on an instance × execution duration. The Consumption/Flex compute meter. You don't set memory; it's measured.

host.json — App-wide host configuration: timeouts, concurrency, retry policy, logging sampling, extension settings.

Host key — A shared secret valid for every function in the app.

In-process model (.NET) — The legacy execution model where your assembly loads into the host process. Being retired ⚠️ verify the date against current Azure docs; new work should be isolated.

Isolated worker model (.NET) — The current .NET model: your code runs in its own process with its own DI container and .NET version, talking to the host over gRPC.

Language worker — The per-language process (Node, Python, Java, PowerShell, isolated .NET) that runs your code alongside the host.

local.settings.json — Local-development settings. Never deployed; its values must exist as app settings in Azure.

Managed identity — An Entra ID identity attached to the app, system-assigned or user-assigned. The correct way for the function to authenticate outbound.

Master key — A host key with administrative reach including the admin API. The most dangerous secret in the app.

Per-instance concurrency — How many invocations one instance handles simultaneously, configured per trigger type in host.json. Your primary throttle.

Poison queue — Where a Storage-queue message lands after exceeding its retry count. Monitor it; the equivalent for Service Bus is the dead-letter queue.

Premium plan (EP1–EP3) — Pre-warmed instances, VNet integration, long timeouts — and a minimum instance count that never reaches zero. The main cost trap.

Pre-warmed instance — A Premium-plan spare held ready so the next scale-out doesn't pay a cold start.

Run from package — Deploying a read-only mounted zip (WEBSITE_RUN_FROM_PACKAGE=1), giving faster cold starts and atomic content swaps.

Scale controller — The Azure-managed component that watches your trigger sources and decides the app's instance count. Invisible and unconfigurable; it reads your trigger source directly, which is why locking that source down can silently stop scaling.

SCM / Kudu — The *.scm.azurewebsites.net deployment and diagnostics endpoint. A separate front door with separate access rules, and a commonly forgotten exposure.

Target-based scaling — The scaling algorithm that computes a target instance count from backlog ÷ per-instance concurrency and jumps there, rather than adding one instance per interval.

Task hub — The set of storage queues, tables, and blobs holding Durable orchestration state. Two apps sharing a task hub name will corrupt each other's state.

Trigger — The single event source that causes a function to run, and the source of its payload.

VNet integration — Outbound access from the app into a virtual network. Flex Consumption, Premium, or Dedicated only — not Consumption.

WebJobs SDK — The predecessor Functions is built on. Don't start anything new on it.

Cheatsheet

# --- Create ---
az group create -n rg-demo -l uksouth
az storage account create -n stdemouniquename -g rg-demo -l uksouth --sku Standard_LRS
az functionapp create -n func-demo -g rg-demo --storage-account stdemouniquename \
  --consumption-plan-location uksouth --runtime node --functions-version 4 --os-type Linux

# --- Inspect ---
az functionapp list -g rg-demo -o table
az functionapp show -n func-demo -g rg-demo --query "{state:state, plan:appServicePlanId, https:httpsOnly}"
az functionapp function list -n func-demo -g rg-demo -o table
az functionapp list-runtimes --os linux -o table          # authoritative supported-runtime list

# --- Settings (control plane) ---
az functionapp config appsettings list -n func-demo -g rg-demo -o table
az functionapp config appsettings set -n func-demo -g rg-demo --settings KEY=value
az functionapp config appsettings delete -n func-demo -g rg-demo --setting-names KEY

# --- Keys (control-plane call returning a data-plane secret) ---
az functionapp keys list -g rg-demo -n func-demo
az functionapp function keys list -g rg-demo -n func-demo --function-name hello

# --- Identity + a data-plane role assignment ---
az functionapp identity assign -g rg-demo -n func-demo
PRINCIPAL=$(az functionapp identity show -g rg-demo -n func-demo --query principalId -o tsv)
az role assignment create --assignee-object-id $PRINCIPAL --assignee-principal-type ServicePrincipal \
  --role "Storage Blob Data Contributor" --scope <storage-account-resource-id>

# --- Deploy code ---
func azure functionapp publish func-demo                  # Core Tools
az functionapp deployment source config-zip -g rg-demo -n func-demo --src ./app.zip

# --- Slots and rollback ---
az functionapp deployment slot create -g rg-demo -n func-demo --slot staging
az functionapp deployment slot swap  -g rg-demo -n func-demo --slot staging --target-slot production

# --- Operate ---
az functionapp restart -n func-demo -g rg-demo
az functionapp log tail -n func-demo -g rg-demo
az functionapp plan show -g rg-demo -n plan-demo --query "{sku:sku.name, capacity:sku.capacity}"

# --- Teardown ---
az group delete -n rg-demo --yes --no-wait

# Local development
func init myapp --javascript              # or --python, --dotnet-isolated, --powershell
func new --name hello --template "HTTP trigger" --authlevel function
func start                                # run locally

Resource ID shape

# The function app
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{appName}

# The hosting plan
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/serverfarms/{planName}

# A deployment slot
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{appName}/slots/{slotName}

There is deliberately no resource ID for an individual function — which is why RBAC, scaling, and identity are all app-level concerns.

Limits worth memorising — with their scope

A number without a scope is useless in Azure. The scopes below are the durable part; the figures are not.

Limit	Scope counted at	Note
Maximum scale-out instances	Per function app	Varies by plan and OS ⚠️ verify
Total instance capacity	Per subscription, per region	Shared with other App Service workloads; soft, raisable ⚠️ verify
App Service Plan instance count	Per plan	Structural — change the plan, not the quota
Execution timeout	Per invocation	Ceiling set by plan; shortest on Consumption ⚠️ verify
Deployment slots	Per app	Varies sharply by plan; Consumption is limited ⚠️ verify
Storage transaction rate	Per storage account	Shared by every app pointed at it
Event-driven parallelism	Per partition (Event Hubs, Cosmos DB) or per session (Service Bus)	Your real parallelism ceiling
SNAT ports for outbound connections	Per instance	Exhausted by per-invocation client creation ⚠️ verify

⚠️ Quotas and SKU limits vary by region and subscription type — verify every figure against current Azure docs before designing to it. Raise soft limits via a quota request or support ticket, well before you need the headroom.

The five-line summary

The plan is the service — Consumption, Flex, Premium, or Dedicated decides cold start, networking, timeout, and cost far more than your code does.
There's a storage account underneath, and it isn't optional — triggers, timers, leases, Durable state, and keys all live there.
Scaling is per app, invocation is at-least-once — split apps by scaling characteristic, and make handlers idempotent.
Keys govern who calls you; managed identity governs what you call — and control-plane Contributor can list the keys.
The ceiling is usually downstream — the database, the partition count, or the rate limit, not the plan.

← Back to the Azure Functions overview · ← Previous: Interview Questions