Glossary

Technical terms that show up in the writing, defined in plain language. In posts, dotted underlines mark terms you can hover for a short definition.

Azure platform

ALZ: Azure Landing Zones: Microsoft’s reference architectures and accelerators for building cloud foundations. Defaults are global; they still need your organisation’s context.
Azure Landing Zone (landing zone): A set of cloud foundations — identity, networking, subscriptions, and guardrails — that give teams a ready place to deploy workloads safely.
Cloud Adoption Framework (CAF): Microsoft’s guidance for cloud adoption strategy, readiness, and landing zones. Useful as a checklist, not a substitute for your own discovery.
Management group: A folder in the Azure hierarchy above subscriptions. Used to organise estates and apply policies and access at scale.
PaaS: Platform as a Service: managed cloud services (databases, app hosts, messaging) where the provider runs more of the underlying infrastructure.
Subscription: An Azure billing and isolation boundary. Workloads, quotas, and often cost attribution sit inside a subscription.
Subscription vending: An automated way to request and create subscriptions with the right management group, policies, tags, and budgets already applied.

Networking

ExpressRoute: A private connection between your on-premises network and Azure, usually via a connectivity provider. Used when VPN latency or throughput is not enough.
Forced tunnelling: Routing all internet-bound cloud traffic back through on-premises firewalls. Sometimes required for inspection; often costly in latency and complexity.
Hub and spoke: A network pattern where shared services sit in a central hub and workloads connect through spokes. Common in hybrid and regulated estates.
Network Security Group (NSG): A basic Azure firewall at the subnet or network interface layer. Filters allowed inbound and outbound traffic by rules you define.
Private endpoint: A network interface that brings a PaaS service into your virtual network over a private IP, keeping traffic off the public internet.
User Defined Route (UDR): A custom route table entry that overrides Azure’s default routing — for example sending traffic through a firewall appliance.
Virtual WAN (vWAN): Azure Virtual WAN: a Microsoft-managed hub networking service for large or multi-region connectivity, including branches and spokes.

Governance and security

Audit mode: A policy effect that reports non-compliance without blocking deployments. Useful for learning real behaviour before enforcing denies.
Azure Policy: Rules that audit or enforce how resources are configured — for example requiring tags, blocking public IPs, or limiting regions.
Blast radius: How far damage spreads when something fails. Subscription and network boundaries are tools for limiting blast radius.
Deny policy: A policy effect that blocks non-compliant deployments. Powerful, and easy to overuse — start in audit mode when you can.
RBAC: Role-Based Access Control: who can do what on which Azure resources. Prefer least privilege over shared owner accounts.
Workload identity: A non-human identity used by pipelines or apps to deploy and operate resources, instead of a person’s account. Prefer federation or managed identity.

New Zealand context

All of Government (AoG): New Zealand government procurement and commercial arrangements. AoG cloud agreements can shape commercial terms and data handling expectations.
Azure New Zealand North (NZ North): Microsoft’s Auckland Azure region. Improves local residency and latency options, but does not have full service parity with Australia East.
CPS 234: APRA's information security standard for APRA-regulated entities (Australian banks, insurers, and NFBIs), including NZ operations of those groups. The entity stays accountable even when work runs in a cloud provider. Distinct from RBNZ supervision (NBDTs and related), which uses the Bank's own framework such as BS11.
Health Information Privacy Code (HIPC): New Zealand privacy rules for health information. Stricter handling expectations than general personal information in many cases.
NZISM: New Zealand Information Security Manual: GCSB guidance for government information security. Agencies map controls; vendors supporting agencies often feel it too.
Privacy Act 2020: New Zealand’s primary privacy law. Sets Information Privacy Principles for personal information, including breach notification for serious harm.
Protective Security Requirements (PSR): New Zealand government expectations for protective security across governance, personnel, information, and physical domains.

Ways of working

Bicep: Microsoft’s domain-specific language for Azure Resource Manager templates. Compiles to ARM JSON and is common in ALZ accelerators.
CI/CD: Continuous Integration and Continuous Delivery: automated build, test, and deploy pipelines. For platforms, every change should go through a pipeline.
Configuration drift (drift): When the live environment no longer matches the code that was meant to define it — often after portal “quick fixes” that never made it back to the repo.
FinOps: Cloud financial operations: making cost visible, attributable, and actionable so engineering and finance share ownership of spend.
Golden path: A supported, well-documented way to ship that is also the easiest path. When the compliant route is frictionless, shadow IT shrinks.
Infrastructure as Code (IaC): Defining and deploying infrastructure through versioned files and pipelines instead of one-off portal clicks. The repo becomes the source of truth.
Platform engineering: Treating internal platforms as products for developer teams — self-service, clear interfaces, and feedback loops — rather than ticket queues.
RACI: A responsibility matrix: Responsible, Accountable, Consulted, Informed. Used to name who owns detection, response, and decisions for platform scenarios.
Shadow IT: Systems and cloud accounts created outside official channels because the approved path was too slow or unclear.
Terraform: A popular Infrastructure as Code tool that describes cloud resources in declarative configuration and applies them through a plan and apply workflow.