This portal uses Azure’s own vocabulary, because that is what the Microsoft portal displays: calling a “Resource
Group” anything else would send you looking for a screen that doesn’t exist. So here is what these words mean, in the
order you will run into them.
| The word |
What it is |
| Tenant |
The company directory, which says who exists and who is allowed to do what. Labs have their own tenant, separate from the production one: that is what guarantees a lab can’t reach a client environment. |
| Subscription |
The billing unit. Two are open to you, Qim info Labs and Microsoft Azure Sponsorship; how to choose is explained in The two subscriptions. |
| Resource Group (often RG) |
The folder that holds all of a lab’s resources. It is the lab’s unit of life: one lab = one RG, and deleting it takes everything inside with it in one go. That is why closing a lab takes a single action, and why the administrators can delete it at its expiry date. |
| Region |
The physical datacenter where the resource runs. Four are open to labs, switzerlandnorth by default. You choose it at creation and can’t change it afterwards. |
| Resource |
Any billable object you create in an RG: a machine, a disk, an IP address, a storage account. |
| The word |
What it is |
| Tag |
A key = value label attached to a resource. It changes nothing about how things run; it tells you who owns what and since when. Three are mandatory: see naming and tags. |
| Azure Policy |
A rule the platform applies automatically, before you do. It is what denies creating a resource without its mandatory tags, or in a region that isn’t open. It only checks what can be checked: that a tag is present, never that its value is accurate. |
| Cost analysis |
The portal’s spending screen. Filtered on your Resource Group, it gives the real cost of your lab in seconds. See Monitor costs. |
| Auto-shutdown |
The enforced shutdown of virtual machines at 7 p.m. and over the weekend. It applies only to VMs: a managed service keeps billing through the night. |
| The word |
What it is |
| VM (virtual machine) |
A virtual machine: a full operating system that you administer and install whatever you like on. |
| Storage Account |
A file storage account. It can serve a static website on its own, over HTTPS, with no machine to administer: that is the topic of deploy a static site. Its name must be unique across all of Azure. |
| VNet (virtual network) |
The lab’s private network, where your machines live. The rule is one VNet per lab: the second VM reuses the one created by the first. |
| Subnet |
A subdivision of a VNet. The firewall applies at the subnet level. |
| NSG (network security group) |
Azure’s firewall: a list of rules saying which port is reachable and from which IP address. This is where you allow SSH from the Chancy IP, i.e. 194.148.102.82 — the only allowed source address, and not your workstation’s. Never from 0.0.0.0/0, which means “from the entire Internet”. |
| Public IP |
The address through which your machine can be reached from outside. Static (Standard type), it never changes; dynamic, it changes every time the machine stops — so every evening, because of auto-shutdown. |
| Peering |
A link between two VNets. Allowed between two labs, forbidden between a lab and production. |
| Managed service (PaaS) |
A service Azure administers for you: managed database, AKS, gateway. Handy, but nothing turns it off at night: in a lab, only use one if the lab’s topic is that service. |
| AKS |
Azure’s managed Kubernetes. To simply try Kubernetes, don’t create an AKS: a shared cluster already exists, see the Kubernetes lab. |
| The word |
What it is |
| Entra ID |
The directory itself, formerly Azure Active Directory. Users, groups and app registrations cost nothing there and require no lab: see Entra ID. |
| App registration |
The identity of an application rather than a person. It is what you register to test an OAuth 2.0 / OIDC sign-in, or so that a script can authenticate on its own. |
| Service principal |
The actual account an app registration uses to act. In practice: “my script’s account”. |
Microsoft’s official documentation is authoritative on all these terms, and it is good:
Microsoft Azure glossary.
