Glossary

A Microsoft marketing term for personal, dedicated virtual desktops from the cloud. Synonymous with Windows 365.

A modelling language for enterprise architecture, complementary to TOGAF. A graphical description of the business, application and technology layers.

Microsoft’s reference framework for introducing Azure into organisations in a structured way. It covers strategy, plan, ready, adopt, govern, secure and manage.

A network topology with a central hub VNet (shared services) and attached spoke VNets (workloads). The standard pattern in Azure landing zones.

A combination of on-premises infrastructure and public cloud. It protects existing investment while adding cloud scalability.

Information Technology Infrastructure Library. A process framework for IT service management (incidents, changes, problems).

Arabic for 'excellence, perfection'. Used by Sofiane Salmi as a personal quality framework for architecture work — joining craft, method and result.

An architectural pattern in which an application consists of small, independent services. It allows independent deployments and a mix of technologies.

The classic architectural pattern: one single, coherent application. Easier to develop, harder to scale than microservices.

Using several public cloud providers at once (Azure plus AWS plus GCP). It reduces vendor lock-in but increases complexity.

Scaled Agile Framework. A scaling framework for agile working in large organisations. It complements Scrum and Kanban at programme and portfolio level.

The Open Group Architecture Framework — the de facto standard framework for enterprise architecture. Its central core is the Architecture Development Method (ADM).

Microsoft’s architectural guard rails with five pillars: reliability, security, cost optimisation, operational excellence and performance efficiency.

Azure Information Protection. Classifying and protecting sensitive documents through sensitivity labels. Now part of Purview.

Extends Azure management to non-Azure resources (on-premises servers, other clouds, Kubernetes). One unified control plane.

Microsoft’s cloud-hosted mail server. The core of most Microsoft 365 plans and the successor to local Exchange servers.

Multi-factor authentication. An additional security layer alongside the password (an authenticator app, FIDO2 key or biometrics, for example).

The central API for all Microsoft 365 data. It enables programmatic access to users, mail, calendars, files and Teams.

A unified governance and compliance suite. It covers data map, data loss prevention, information protection and insider risk management.

A cloud-native SIEM and SOAR solution in Azure. It collects security events and automates response through playbooks.

A unified communication platform for chat, meetings, calls and collaboration. The central workplace in Microsoft 365.

Microsoft’s cloud storage for personal work files. 1 TB included with most Microsoft 365 plans.

Privileged Identity Management. Time-limited, just-in-time activation of administrator roles in Entra ID. Part of Entra ID P2.

A low-code and no-code suite: Power Apps, Power Automate, Power BI, Power Virtual Agents. It enables citizen development.

A cloud collaboration platform for documents, intranets and team sites. The back end for many Microsoft 365 functions.

Under Article 28 GDPR: the contractual basis between controller and processor. Mandatory when using cloud services.

Supervisory requirements for IT in banking. A BaFin circular on IT governance in credit institutions.

The methodology of the German Federal Office for Information Security. A practical German security standard with its baseline protection compendium.

Control over where data is stored, how it is processed and who may access it. In the European context often tied to requirements for EU hosting and EU jurisdiction.

Digital Operational Resilience Act. An EU regulation on digital resilience in the financial sector. Applicable from January 2025.

The EU General Data Protection Regulation, in force since May 2018. It governs the handling of personal data across all EU member states.

The EU-US Data Privacy Framework (2023). Successor to the Privacy Shield. It sets standards for permissible data transfers to the United States.

An internationally recognised standard for information security management systems (ISMS). The basis for certification.

Critical infrastructure. Legally defined sectors (energy, water, IT, transport, finance, health and others) subject to special security obligations.

The EU cybersecurity directive (2022/2555), to be transposed by October 2024. It obliges critical infrastructure and 'important entities' to take security measures.

A ruling of the European Court of Justice (2020) that struck down the Privacy Shield. It left data transfers to the United States legally uncertain and led to the EU-US Data Privacy Framework.

Service Organization Control 2. An audit standard for service providers, covering security, availability, confidentiality, processing integrity and privacy.

Trusted Information Security Assessment Exchange. The German automotive standard for information security, driven by the VDA.

Bring your own device. Using private devices for work purposes. It calls for MAM (mobile application management) strategies rather than MDM.

A rule set in Intune defining when a device counts as 'compliant' (encryption active, password set, operating system current, for example).

Choose your own device. The user picks from a device catalogue curated by the employer. A compromise between control and user experience.

The process of registering a device in an MDM or UEM platform. It can be manual or automated (through Autopilot, for example).

A device profile in which only one or a few applications may run. Typical for information terminals, production machines and self-service stations.

Mobile application management. Only the business application is controlled (Outlook with an app protection policy, for example); the device stays private.

Mobile device management. Full device management (compliance, policies, wipe). Suitable for company-owned devices.

Unified endpoint management. Unified administration of all devices (Windows, macOS, iOS, Android) from one console. Intune is a UEM.

Windows Update for Business. Microsoft’s service for phased rollout of Windows updates. Configurable through Intune.

A licensing benefit for existing Windows Server and SQL Server licences with Software Assurance. It cuts Azure costs by up to 85%.

Capital expenditure versus operational expenditure. Cloud shifts CapEx to OpEx — which matters for tax and for the balance sheet.

Allocating costs to those who cause them within an organisation. Necessary for cost ownership in the cloud.

The economic view of cloud use. It covers unit economics, turning fixed costs into variable ones, economies of scale and FinOps practices.

Cloud Solution Provider. An indirect licensing model through authorised partners. Monthly billing, flexible scaling.

Enterprise Agreement. A direct contract with Microsoft for large customers (more than 500 users). A three-year commitment, often combined with Software Assurance.

Financial operations. The discipline of cost transparency and optimisation in the cloud. It combines finance, technology and operations.

Enterprise licence bundles. E3 covers productivity plus basic security; E5 adds advanced security (Defender, Purview) and advanced compliance.

Consumption-based billing in the cloud. Maximum flexibility, the highest unit costs. Good for variable or unpredictable workloads.

A cloud pricing model with a one- or three-year reservation in advance. A discount of 40 to 72% against pay-as-you-go, in return for a fixed-term commitment.

Matching VM size to actual need. The most important FinOps lever — many cloud workloads are oversized.

Return on investment. A measure of how profitable an investment is. Often complemented by a TCO analysis.

A flexible cloud discount model. The commitment is to an hourly spend rather than a specific VM, in return for a smaller discount than reserved instances.

Microsoft’s subscription on volume licences. It brings upgrade rights, training and cloud licence mobility (Azure Hybrid Benefit).

The total cost of a technology across its life cycle. It covers acquisition, operation, maintenance, training and decommissioning — not just licence costs.