Glossary
Plain-language definitions of the Azure logging, identity and attack terms used across the blog.
- Azure Activity Log
- The subscription-level log of control-plane operations in Azure — who created, changed or deleted which resource, when and from where. Kept 90 days.
- Control plane and data plane
- Azure's split between managing resources (control plane, Azure Resource Manager) and using them (data plane: reading secrets, blobs, network traffic).
- Custom Script Extension
- An Azure VM extension that downloads files and runs a command on the VM, installed through Microsoft.Compute/virtualMachines/extensions/write.
- Diagnostic setting
- The Azure Monitor configuration that sends a resource's logs (or the subscription's Activity Log) to Log Analytics, a storage account or Event Hubs.
- Elevate access (elevateAccess)
- A Global Administrator feature that grants User Access Administrator at root scope (/) over every Azure subscription and management group of the tenant.
- NSG and VNet flow logs
- Network Watcher logs of IP flows through network security groups or virtual networks: 5-tuple, direction, decision and byte counts, per minute.
- Instance Metadata Service (IMDS)
- The VM-local endpoint at 169.254.169.254 that exposes instance metadata and issues managed identity tokens to code running on the VM.
- Key Vault access policy
- Key Vault's legacy data-plane permission model. Principals with vaults/write (e.g. Contributor) can grant themselves secret access with it.
- Managed identity
- An Entra ID identity managed by Azure for a resource such as a VM or app, obtained through a local token endpoint without any secret in code.
- Role assignment (Azure RBAC)
- The Azure RBAC binding of a principal, a role definition and a scope. Creating one is the Activity Log operation Microsoft.Authorization/roleAssignments/write.
- Run Command (Azure VM)
- An Azure VM feature that runs a script on the guest through the VM agent — as SYSTEM on Windows — without network access to the VM.
- Service principal
- The identity of an application in a Microsoft Entra tenant, used by automation to call Azure with a client secret, certificate or federated credential.
- Shared access signature (SAS)
- A signed URL token that grants delegated access to Azure Storage. Account and service SAS are signed with the account key; creation cannot be audited.