Commonly Confused Pairs

Azure Policy vs RBAC: Policy controls WHAT can be deployed/configured; RBAC controls WHO can do it.

Failover group vs Active geo-replication: Failover group: unchanged listener, auto failover, many DBs, MI support. Geo-replication: per DB, readable secondaries (Microsoft's 2016 announcement says up to 4), manual failover, new connection string.

Azure Site Recovery vs Azure Backup: ASR replicates for failover (minutes RPO). Backup restores data after deletion/corruption.

Private Endpoint vs Service Endpoint: Private Endpoint = private IP, works from on-prem, needs Private DNS. Service Endpoint = free, VNet only, public endpoint remains.

Front Door vs Traffic Manager: Front Door: global L7 HTTP(S), WAF, caching, fast failover. Traffic Manager: DNS-based, any protocol, no WAF.

Application Gateway vs Load Balancer: App Gateway: regional L7, path routing, WAF, TLS offload. Load Balancer: regional L4 TCP/UDP.

Event Grid vs Event Hubs: Event Grid: discrete reactive events (push). Event Hubs: high-volume streams/telemetry, Kafka.

Service Bus vs Storage Queues: Service Bus: ordering (sessions), transactions, dead-letter, duplicate detection, topics. Storage Queues: simple, cheap.

Container Apps vs AKS: Container Apps: serverless microservices, scale to zero, no K8s API. AKS: full Kubernetes control.

ACI vs Container Apps: ACI: single container group, no scaling/LB. Container Apps: scaling, revisions, Dapr/KEDA.

Flex Consumption vs Premium (Functions): Flex: serverless, Linux, VNet, always-ready option. Premium: prewarmed, no cold start, Windows or Linux, multiple apps per plan.

SQL Database vs SQL Managed Instance: MI for SQL Agent, cross-DB queries, CLR, Service Broker, near-100% compatibility; SQL DB for cloud-native single DBs.

General Purpose vs Business Critical: GP: remote storage, cheaper. BC: local SSD, 4 replicas, free read replica, faster failover.

Business Critical vs Hyperscale: BC: low-latency OLTP. Hyperscale: very large/fast-growing DBs, fast restores, named replicas.

Serverless (SQL) vs Provisioned (SQL): Serverless: auto-pause, per-second billing, no AHB/reservations. Provisioned: steady load, AHB + reservations.

Elastic pool vs Single database: Pool: many DBs with varying peaks share resources. Single: one predictable DB.

Always Encrypted vs Dynamic data masking: Always Encrypted hides data even from DBAs. Masking only hides values from non-privileged users.

TDE vs Always Encrypted: TDE encrypts files at rest (DBA still sees data). Always Encrypted encrypts columns client-side.

Cosmos Session vs Cosmos Strong: Session (default): read-your-own-writes. Strong: always latest write, single write region only.

Cosmos serverless vs Cosmos autoscale: Serverless: single region, pay per RU consumed. Autoscale: multi-region, SLA, scales 10–100% of max.

Table Storage vs Cosmos DB for Table: Table Storage: cheap, key-only index, single region. Cosmos Table: all-property indexes, global, latency SLA.

GRS vs RA-GRS: RA- lets you READ the secondary before failover; plain GRS doesn't.

ZRS vs GZRS: ZRS: zones in one region. GZRS: zones + async copy to secondary region.

Cool / Cold vs Archive: Cool/Cold are online (instant). Archive is offline: rehydration takes hours.

Blob soft delete vs Immutable storage: Soft delete recovers deletions (admins can still purge). Immutability blocks change/delete for everyone.

Recovery Services vault vs Backup vault: RSV: VMs, SQL/SAP in VMs, Files, on-prem, ASR. Backup vault: disks, blobs, PostgreSQL flexible, AKS.

Standard backup policy vs Enhanced backup policy: Enhanced: every 4 h, ZRS snapshots, Premium SSD v2/Ultra/Trusted Launch.

Availability set vs Availability zones: Set: racks in one datacenter, 99.95%. Zones: separate datacenters, 99.99%.

VMSS Flexible vs VMSS Uniform: Flexible: recommended, mixed sizes, Spot+on-demand, Backup/ASR support. Uniform: identical instances only.

Password hash sync vs Pass-through auth: PHS: cloud auth, works if on-prem down, leaked-credential detection. PTA: enforces on-prem policies at sign-in.

Entra ID P1 vs Entra ID P2: P1: Conditional Access, dynamic groups, App Proxy. P2: + Identity Protection (risk), PIM, access reviews.

System-assigned MI vs User-assigned MI: System: tied to one resource lifecycle. User: shared, pre-provisioned, independent lifecycle.

PIM eligible vs PIM active: Eligible: activate just-in-time with MFA/approval. Active: standing access, bypasses controls.

App Proxy vs Entra Private Access: App Proxy: web apps only. Private Access: any protocol (RDP, SMB, SSH) zero-trust.

B2B collaboration vs External ID (external tenant): B2B: partners in your workforce tenant. External tenant: consumer/customer sign-up (replaces B2C).

CanNotDelete lock vs ReadOnly lock: CanNotDelete: modify OK, no delete. ReadOnly: no modify/delete; can break POST operations like listing keys.

audit / deny vs auditIfNotExists / deployIfNotExists: First pair checks the resource itself; IfNotExists checks a related resource; deploy/modify need a managed identity + remediation for existing.

Metric alert vs Log search alert: Metric: precomputed metrics, near real time. Log search: KQL logic across logs.

Activity log alert vs Service Health alert: Activity log: control-plane events on your resources. Service Health: Azure platform incidents.

Diagnostic setting → Event Hubs vs Diagnostic setting → Storage: Event Hubs to stream to SIEM; Storage for cheap long-term archive.

Key Vault Premium vs Managed HSM: Premium: HSM-backed keys, multitenant. Managed HSM: single-tenant, FIPS 140 Level 3, customer security domain.

VPN Gateway vs ExpressRoute: VPN: encrypted over internet, cheap. ExpressRoute: private, predictable, not encrypted by default.

ExpressRoute Standard vs ExpressRoute Premium: Premium needed for cross-geopolitical regions and higher route/VNet limits.

Hub-spoke vs Virtual WAN: Hub-spoke: 1–2 regions, full control, lowest cost. vWAN: many regions/branches, managed transit, routing intent.

Azure Firewall Standard vs Azure Firewall Premium: Premium adds TLS inspection, IDPS, full URL filtering.

DDoS IP Protection vs DDoS Network Protection: Network adds rapid response, cost protection, WAF discount.

Data Box Disk vs Data Box: Disk: a few TB (8 TB SSDs). Data Box: tens–hundreds of TB.

Rehost vs Replatform: Rehost: lift-and-shift, no changes. Replatform: move to PaaS with minimal changes.

Self-hosted IR vs Azure IR: Self-hosted: on-prem/private sources, custom drivers. Azure IR: cloud copy + mapping data flows.

Operational blob backup vs Vaulted blob backup: Operational: local and continuous, restores to the source account (can overwrite), up to 360 days. Vaulted: offsite copy in a Backup vault, up to 10 years, restores only to a different storage account.

Planned storage failover vs Unplanned storage failover: Planned: swaps regions with no data loss and restores the original redundancy on failback. Unplanned: writes after the Last Sync Time can be lost and the account becomes LRS.

Container-level WORM vs Version-level WORM: Container-level: one immutability policy per container. Version-level: policies at account, container or blob-version level.

Time-based retention vs Legal hold: Time-based retention locks data for a fixed interval. A legal hold has no expiry until cleared. Both can be set together.

Key Vault soft delete vs Key Vault purge protection: Soft delete keeps deleted items recoverable 7 to 90 days (they can still be purged). Purge protection blocks purging until retention ends and can't be turned off.

Alert rule vs Alert processing rule: An alert rule creates alerts. An alert processing rule changes alerts after they fire, for example adding or suppressing action groups (same subscription only).

Service Bus Geo-Replication vs Service Bus Geo-Disaster Recovery: Geo-Replication copies data and metadata and needs Premium. Geo-DR copies metadata only. They can't be combined.

Entra Connect Sync vs Entra Cloud Sync: Connect: on-prem server, large domains over 250K objects, resource-forest mailboxes. Cloud Sync: lightweight agents, multi-agent failover, disconnected forests, group provisioning to AD.

Hyperscale HA replica vs Hyperscale named replica: HA replicas share the primary's name and service objective, are hidden and fail over automatically. Named replicas are independent resources with their own size and access.

Resource-context access vs Workspace-context access: Resource-context shows only logs for resources you can access. Workspace-context shows all tables you have permission for in the workspace.

Deployment Stacks vs Template Specs: Stacks manage deployed resources as a unit and can deny changes. Template Specs store and version templates for sharing.

Column encryption key vs Column master key: The column encryption key encrypts data. The column master key (in a trusted key store) encrypts the column encryption key.

Azure Dedicated HSM vs Azure Cloud HSM: Dedicated HSM is retiring (support until Jul 31, 2028, no new onboardings). Cloud HSM is its FIPS 140-3 Level 3 successor.

Ultra Disk vs Premium SSD v2: Ultra: up to 400,000 IOPS. Premium SSD v2: up to 80,000. Both are data disks only and can't be OS disks.

Standard rehydration vs High-priority rehydration: Standard: up to 15 hours for objects under 10 GB. High: possibly under an hour, higher cost, 10 GiB per account per hour.

Savings plan vs Reservation: Savings plan: hourly spend commitment that applies across eligible compute services and regions. Reservation: a specific resource, size and region for a deeper discount.

Standard NAT Gateway vs StandardV2 NAT Gateway: Standard: zonal, up to 50 Gbps. StandardV2: zone redundant, up to 100 Gbps, IPv6, flow logs; needs StandardV2 public IPs and can't be upgraded in place.

ExpressRoute Metro vs ExpressRoute Direct: Metro: one circuit dual-homed to two peering locations in a city. Direct: your own 10, 100 or 400 Gbps ports straight into Microsoft with no provider.

MACsec vs IPsec on ExpressRoute: MACsec: layer 2, ExpressRoute Direct only, you bring the key. IPsec: layer 3 end to end.

Gateway Load Balancer vs HA ports rule: Gateway LB chains NVAs transparently to a Standard LB frontend. An HA ports rule on an internal Standard LB balances all ports across NVAs but needs UDRs.

Container Apps app vs Container Apps job: App: runs continuously and restarts on failure. Job: runs to completion on a manual, schedule or event trigger.

AKS Free tier vs AKS Standard tier: Free: no financially backed SLA, up to 1,000 nodes. Standard: uptime SLA (99.95% with zones, 99.9% without), up to 5,000 nodes.

Security defaults vs Conditional Access: Security defaults: free preconfigured protections for free-tier orgs. Conditional Access: policy engine that needs P1, risk conditions need P2.

Quick Access vs Per-app access (Private Access): Quick Access: the primary group of private FQDNs and IPs. Per-app: a separate Global Secure Access app with its own Conditional Access policies.

Blob versioning vs Blob snapshot: A version is automatic on every write or delete. A snapshot is a manual, application-driven point-in-time copy.

Point-in-time restore vs Object replication: PITR rolls block blobs back inside the account (needs soft delete, versioning, change feed). Object replication asynchronously copies blobs to another account.

Container soft delete vs Blob soft delete: Container soft delete restores a deleted container. Blob soft delete restores a blob, snapshot or version.

Eligible assignment vs Active assignment (PIM): Eligible must be activated with MFA, justification or approval. Active is standing access with no checks.

Entitlement management vs Lifecycle workflows: Entitlement management: access packages, approval and expiry. Lifecycle workflows: automated joiner, mover and leaver tasks.

Front Door Standard vs Front Door Premium: Standard: custom WAF rules only, no Private Link origins. Premium: managed WAF rule sets and Private Link origins at no extra fee. Both bill a base fee per profile; neither supports mTLS to origins.

OSS clustering policy vs Enterprise clustering policy: OSS: clients use the Redis Cluster API and reach shards directly (higher throughput). Enterprise: one endpoint, a proxy routes to shards.