9. Glossary and Cheatsheet

The 10-second lookup.

Glossary

Accelerated Networking — SR-IOV, bypassing the host's virtual switch for materially lower latency and jitter. Free, supported on most modern sizes with 2+ vCPUs.

Allocation failure — the fabric can't find a physical host with your requested size in the requested region and zone. Distinct from a quota error: a quota increase won't fix it. Happens on start as well as create, because a deallocated VM has released its hardware.

Application Security Group (ASG) — a named group of NICs usable as the source or destination in an NSG rule, so rules read asg-web → asg-app instead of a list of CIDRs.

Availability set — placement across fault domains (racks) and update domains (patching batches) within one datacentre. Protects against rack failure and maintenance reboots; not against a datacentre outage. Fixed at creation.

Availability zone — a physically separate datacentre within a region. Zone numbers are per subscription — your zone 1 may not be another subscription's zone 1. Fixed at creation.

Azure Backup — snapshot-based backup into a Recovery Services vault, with policy-driven schedule and retention. The answer to the fact that disk replication is not backup.

Azure Bastion — a managed jump host in your VNet, requiring a subnet named exactly AzureBastionSubnet. Lets you delete every public IP and inbound 22/3389 rule from your VM estate.

Azure Compute Gallery — formerly Shared Image Gallery. Versioned, region-replicated golden images, shareable across subscriptions.

Azure Disk Encryption (ADE) — the older in-guest encryption approach using BitLocker or dm-crypt. Prefer SSE with customer-managed keys plus encryption at host.

Azure Hybrid Benefit — apply existing Windows Server, SQL Server, RHEL, or SLES licences to cut the VM rate. Routinely left switched off.

Azure Monitor Agent (AMA) — the extension that collects guest metrics and logs. Requires an associated Data Collection Rule; without one it collects nothing while appearing healthy.

Azure Site Recovery (ASR) — cross-region replication with orchestrated, testable failover.

Azure Update Manager — guest OS patching at scale via maintenance configurations. Nothing patches your guest without it.

Boot diagnostics — serial console output and a screenshot. The only diagnostic available when a guest won't boot, and useless if enabled after the failure. Free; enable it on everything.

Capacity Reservation — reserves physical capacity of a size in a region/zone so it's available on demand. Not the same as a Reservation, which is a billing commitment.

cloud-init / custom data — first-boot configuration passed at create time. Good for bootstrap; not a config-management strategy, because nothing reconciles it afterwards.

Confidential computing — sizes (DCasv5/ECasv5) that encrypt memory in use via AMD SEV-SNP, so even the hypervisor can't read it.

Data Collection Rule (DCR) — declares what the Azure Monitor Agent collects and where it goes. The piece people forget.

Deallocate — release the physical hardware and stop the compute charge, keeping disks, NIC, and configuration. Distinct from stop.

Dedicated Host — a physical server allocated to one subscription, billed per host. For compliance forbidding shared tenancy, or licence models tied to physical cores.

Disk Encryption Set — the resource binding a managed disk to a customer-managed key in Key Vault.

Encryption at host — encrypts the temp disk, the host cache, and host-to-storage traffic. Free, covers gaps SSE alone doesn't. Turn it on.

Ephemeral OS disk — the OS disk on local host storage instead of remote managed storage. Free, much faster to boot and reimage, lost on deallocate. Ideal for stateless scale-set instances.

Extension — a child ARM resource (Microsoft.Compute/virtualMachines/extensions) that runs code inside the guest as root or SYSTEM. The mechanism that makes control-plane access equal data-plane access on a VM.

Fault domain — a group of hosts sharing a rack, power source, and network switch.

Flexible orchestration — the recommended scale-set mode. Instances are real, individually addressable virtualMachines resources; supports mixed sizes and explicit zones.

Gen1 / Gen2 — BIOS vs. UEFI boot. Gen2 is required for Trusted Launch and confidential computing, and can't be converted from Gen1 in place.

Host caching — None, ReadOnly, or ReadWrite, using host-local SSD. ReadOnly is close to free performance on read-heavy data disks; ReadWrite on a database log disk can violate write ordering, which is why vendors specify None there.

IMDS (Instance Metadata Service) — the link-local endpoint at 169.254.169.254 serving VM metadata, managed-identity tokens, and Scheduled Events.

Managed disk — a Microsoft.Compute/disks resource, triple-replicated by the platform, billed on provisioned size whether attached or not.

Managed identity — the VM's own Entra ID identity. System-assigned lives and dies with the VM; user-assigned is a standalone resource shareable across VMs. Replaces every connection string.

Microsoft Entra ID — formerly Azure Active Directory (Azure AD). The tenant-level identity provider. Azure AD B2C is now Microsoft Entra External ID.

NAT Gateway — explicit outbound internet connectivity with predictable SNAT ports and no port exhaustion. The recommended replacement for default outbound access, which is being retired.

Network interface (NIC) — Microsoft.Network/networkInterfaces. A first-class resource in Azure, unlike the ENI in EC2, holding IP configuration, DNS settings, and optionally an NSG.

Network Security Group (NSG) — stateful, priority-ordered inbound and outbound rules, attachable to a subnet, a NIC, or both. When both exist, inbound passes the subnet NSG then the NIC NSG.

Premium SSD v2 — decouples IOPS and throughput from capacity, unlike Premium SSD where performance is bought by the gigabyte. ⚠️ Verify regional availability against current Azure docs.

Proximity Placement Group (PPG) — forces VMs onto physically close hardware for low inter-VM latency, at the cost of more allocation failures and conflict with zone spread.

Quota — an accounting limit on your subscription, counted per subscription, per region, both in total vCPUs and per VM family. Usually raised self-service. Not the same as capacity.

Reservation — a 1- or 3-year billing commitment to a specific size and region. Compare with the savings plan, which commits to hourly spend and stays flexible across sizes and regions.

Run Command — executes a script inside the guest through the control plane, with no inbound network path required. Useful for break-glass; a security consideration for the same reason.

Scheduled Events — advance notice via IMDS of an impending reboot, redeploy, or Spot eviction. Polling it is how an application drains gracefully.

Series — the VM family letter: B burstable, D general purpose, E memory optimised, F compute optimised, L storage optimised, M huge memory, N GPU, H HPC.

Size — the SKU string (Standard_D4s_v5) fixing vCPU, memory, max disk IOPS, max NICs, and max network bandwidth. Suffixes: s premium-storage capable, a AMD, d has temp disk, p Arm, i isolated.

Soft delete — a deleted resource (Key Vault, Recovery Services vault items) retained in a recoverable state, still holding its name and blocking recreation. With purge protection on, it can't be purged early at all.

Spot VM — discounted spare capacity, evictable with ~30 seconds' notice, with a deallocate-or- delete eviction policy. For interruptible work only.

SSE (Storage Service Encryption) — always-on at-rest encryption of managed disks. Platform-managed keys by default; customer-managed keys via a Disk Encryption Set.

Stop — shut down the guest while keeping the hardware allocated and still billing compute. az vm stop does this; the portal's Stop button and Stop-AzVM deallocate instead.

Temp disk — local host SSD (/dev/sdb, D:), present on d-suffixed sizes. Fast and free, and wiped on deallocate, resize, or host migration. Page files and tempdb only.

Trusted Launch — secure boot, vTPM, and boot integrity monitoring on Gen2 VMs. Free, default on new Gen2 VMs, and disabling it should require a written reason.

Uniform orchestration — the original scale-set mode: identical instances managed as a fleet, with lower per-instance control and very high scale.

Update domain — a group of hosts patched together, so a maintenance batch never reboots your whole availability set at once.

VM Insights — the packaged Azure Monitor experience: agent, DCR, performance workbook, and a dependency map showing which processes talk to which hosts.

Virtual Machine Scale Set (VMSS) — a VM definition plus a number, with autoscale, rolling upgrades, and automatic instance repair. If you're deploying more than one identical VM, use one.

Cheatsheet

# ── Create and connect ───────────────────────────────────────────────
az group create -n rg-app-dev -l uksouth
az vm create -g rg-app-dev -n vm-app-01 --image Ubuntu2404 --size Standard_D2s_v5 \
  --admin-username azureuser --generate-ssh-keys \
  --os-disk-delete-option Delete --nic-delete-option Delete   # ← avoids orphans
az ssh vm -g rg-app-dev -n vm-app-01                          # Entra-authenticated SSH

# ── Power states — the distinction that costs money ──────────────────
az vm show -d -g rg-app-dev -n vm-app-01 --query powerState -o tsv
az vm stop       -g rg-app-dev -n vm-app-01   # guest down, hardware HELD, STILL BILLED
az vm deallocate -g rg-app-dev -n vm-app-01   # hardware released, compute charge stops
az vm start      -g rg-app-dev -n vm-app-01   # re-placed — allocation can fail here

# ── Resize (requires deallocate if the target isn't in this cluster) ──
az vm list-vm-resize-options -g rg-app-dev -n vm-app-01 -o table
az vm resize -g rg-app-dev -n vm-app-01 --size Standard_D4s_v5

# ── Disks ────────────────────────────────────────────────────────────
az vm disk attach -g rg-app-dev --vm-name vm-app-01 --name disk-data-01 \
  --new --size-gb 128 --sku Premium_LRS --caching ReadOnly
az disk list --query "[?diskState=='Unattached'].{n:name,rg:resourceGroup,gb:diskSizeGb}" -o table

# ── Identity — the keyless pattern ───────────────────────────────────
az vm identity assign -g rg-app-dev -n vm-app-01
PRINCIPAL=$(az vm show -g rg-app-dev -n vm-app-01 --query identity.principalId -o tsv)
az role assignment create --assignee "$PRINCIPAL" \
  --role "Key Vault Secrets User" --scope "$KV_ID"   # data-plane role, not Contributor

# ── Run code in the guest with no inbound network path ───────────────
az vm run-command invoke -g rg-app-dev -n vm-app-01 \
  --command-id RunShellScript --scripts "systemctl status app"

# ── Diagnostics ──────────────────────────────────────────────────────
az vm boot-diagnostics get-boot-log -g rg-app-dev -n vm-app-01
az vm get-instance-view -g rg-app-dev -n vm-app-01 \
  --query "instanceView.extensions[].{name:name,status:statuses[0].displayStatus}" -o table

# ── Quota and capacity ───────────────────────────────────────────────
az vm list-usage -l uksouth --query "[?currentValue>\`0\`].{n:localName,used:currentValue,max:limit}" -o table
az vm list-skus -l uksouth --size Standard_D --all -o table   # what's actually available here

# ── Cost hygiene — run these monthly ─────────────────────────────────
az vm list -d --query "[?powerState=='VM stopped'].{n:name,rg:resourceGroup}" -o table  # billing for nothing
az network public-ip list --query "[?ipConfiguration==null].{n:name,rg:resourceGroup}" -o table
az vm auto-shutdown -g rg-app-dev -n vm-app-01 --time 1900

# ── Before you debug a failed apply ──────────────────────────────────
az lock list -g rg-app-dev -o table            # locks look like permission errors

# ── Teardown ─────────────────────────────────────────────────────────
az group delete -n rg-app-dev --yes --no-wait

Resource ID shapes

# The VM itself
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/{name}

# The rest of the constellation — each is its own resource, with its own ID and bill
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/disks/{name}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/networkInterfaces/{name}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/publicIPAddresses/{name}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/networkSecurityGroups/{name}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachineScaleSets/{name}

# An extension is a child of the VM
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/{vm}/extensions/{name}

Every error message, role-assignment scope, policy assignment, and diagnostic setting is written against one of these. Reading a resource ID left to right tells you the subscription, the resource group, the provider, and the type — which is usually enough to work out what a cryptic error is actually complaining about.

Limits worth memorising — with their scope

A number without a scope is useless in Azure. The scopes below are stable; ⚠️ the numbers vary by region and subscription type — verify against current Azure docs before relying on any of them.

Limit	Scope it's counted at	Note
Total regional vCPUs	Subscription, per region	The one that silently stops autoscale
Per-family vCPUs (e.g. DSv5)	Subscription, per region	Separate from the total; both must have room. GPU families are often 0 by default
Spot vCPUs	Subscription, per region	A third, separate quota
VMs per availability set	Per availability set	—
Fault domains per availability set	Per region	Typically 2 or 3 depending on region
Instances per scale set	Per scale set	Higher for Uniform than Flexible
Data disks per VM	Per VM size	Scales with size; check the size's spec
Disk IOPS / throughput	Per disk SKU and per VM size	The lower of the two wins — this is the one that causes "the disk is slow and the CPU is idle"
NICs per VM	Per VM size	—
Private IPs	Per VNet	Plan address space up front; resizing a VNet in use is painful
Resources per resource group	Per resource group	Rarely hit, but real
Public IPs	Subscription, per region	Standard SKU bills hourly whether attached or not

Quota vs. capacity, one more time, because it's the distinction that wastes the most debugging time: a quota error means your subscription's accounting limit is reached — raise it, usually self-service in minutes. An allocation failure means Azure physically lacks that hardware in that region or zone right now — try another zone, another size in the family, another region, or use a capacity reservation. Same-looking errors; nothing in common between the fixes.

---

← Back to the Virtual Machines overview · ← Previous: Interview Questions