Glossary

Term	Meaning
MCP	Managed Cloud Platform. The Azure landing zone product of XMMS. Also the name of the container image (mcp) the pipelines run in, and the prefix of the PowerShell module (Xebia.Mcp).
XMMS	Xebia Microsoft Managed Services. Builds and releases the platform, and runs it for customers with a managed-service contract.
Platform team	The team that runs the platform for a customer: XMMS (managed service) or the customer's own team (self-managed). See Operating models.
Managed service	An operating model in which XMMS runs the platform under a contract.
Self-managed	An operating model in which the customer maintains the platform itself.
Consumer	A workload or DevOps team that uses a spoke.
Hub	The shared part of the platform: management groups, Virtual WAN and hub, Azure Firewall, DNS, gateways, policies, monitoring. Also called cloud platform.
Spoke	One Azure subscription for one workload in one spoke environment, connected to the hub. Also called spoke canvas, application landing zone or workload landing zone.
Spoke canvas	The baseline the platform deploys into a spoke: network, identity groups, PIM, service principal, Key Vault, storage, Log Analytics. Historically a separate product with its own version (v2.x); now part of the code repository. Also called workload environment. See Spoke canvas.
Platform environment	A complete copy of the hub with its own mcp.json: canary or prod.
Spoke environment	The environment value in a spoke JSON file: dev, tst, acc, prd, shared. One platform environment hosts spokes of every spoke environment.
Canary	The platform environment where every hub change and every new code version is tested first.
Layer	One Terraform root module of the hub (foundation, connectivity, firewall, identity, management, postdeployment), with its own state.
Level	The order in which layers run (1 to 4). Layers in the same level can run in parallel.
Primary region	The region in primary_region. Resources that exist once per platform environment (management groups, policies) are deployed only here.
Code repository	xms-cloud-platform-code. Terraform, the Xebia.Mcp module, schemas and pipeline templates. One repository for all customers.
Configuration repository	One per customer, for example xms-cloud-platform-config. Values only, plus the entry pipelines.
Entry pipeline	A thin pipeline or workflow in the configuration repository (hub.yaml, spoke.yaml, …) that calls a template in the code repository.
Job runners	The self-hosted build infrastructure (Managed DevOps Pool, Container Apps, ACR) the pipelines run on, deployed by the infrastructure pipeline.
Standard change	A pre-approved, low-risk change with a known procedure, such as a firewall rule or a new spoke. See Common requests.
Feature flag	A boolean tfvars variable that switches an existing platform feature on or off.
Config test	Pester tests that validate the JSON files of a configuration repository before Terraform runs.
Drift	A difference between Azure and the code, usually caused by a change made by hand.
Workload	A business solution that the platform isolates and gives an owner. The top of a hierarchy: team groups, an optional Azure DevOps project and one spoke per environment.
Hub-and-spoke	A network design in which a central hub connects the spokes. Traffic between spokes, to on-premises and to the internet passes the hub.
Secured virtual hub	A Virtual WAN hub that has Azure Firewall with security and routing policies attached, so that routing through the firewall is automatic.
Core / direct / additional service	The three service types: foundation services, services a team can request, and services with a separate agreement.
Sandbox	A subscription for experiments, placed in the sandbox management group, with no connection to the hub.
Managed spoke	A spoke for which the platform team also builds and maintains the workload resources, under a separate agreement.
Rule collection group (RCG)	The first unit of an Azure Firewall policy. It holds rule collections, which hold rules. One RCG is one JSON file in the configuration repository.
IP group	A named set of IP addresses and ranges that firewall rules refer to.
Guardrail	A rule that workload teams must follow, preferably enforced by technology. See Design principles.
Consent	A decision method in which a proposal is adopted when nobody has a valid objection. See Governance.
Technology board	A small group that decides on architectural changes and exceptions for the platform. See Governance.
Standard / normal / emergency change	The three categories of change.
Break-glass account	An emergency access account that is not tied to a person, used when normal administrative access fails.
PIM	Privileged Identity Management. Gives roles and group memberships just in time, with an optional approval.
Managed VM module	Optional module that deploys VMs with a fixed baseline (access groups, monitoring, backup, patching). See Managed virtual machines.
Private DNS Resolver	The Azure service that resolves private DNS zones for on-premises and forwards selected domains to other DNS servers. See DNS design.
RPO / RTO / MTPD	Recovery point objective (how much data loss is acceptable), recovery time objective (how long recovery may take) and maximum tolerable period of disruption. See Security classification.
AMBA	Azure Monitor Baseline Alerts. The set of alert initiatives that the platform assigns. See How alerting works.
Secret watcher	A scheduled check that warns about app registration secrets and certificates that are about to expire. See Secret watcher.
Administrative unit	An Entra ID container that limits which groups the spoke deployment identity can manage. The identity is Groups Administrator on it, not on the whole tenant. See Spoke canvas.
Spoke deployment identity	The service principal that creates and updates spokes: it moves subscriptions, creates groups, service principals and PIM settings. Separate for canary and prod.
Spoke service principal	The identity that a spoke creates for its workload team to deploy with. Owner on the subscription. Uses federated credentials, or a secret stored in the spoke Key Vault. See Service principal and credentials.
PIM role map	The built-in list of Azure roles (for example for Key Vault and storage) that the spoke assigns to its groups, standing or PIM-eligible, at subscription scope. Can be overridden per role. See Data-plane access through PIM.
IPAM pool	A pool of address space in Azure Virtual Network Manager that a spoke file can allocate its address space from instead of using a fixed prefix.
AKS Arc (AKS on Azure Local)	A Kubernetes cluster that runs on Azure Local hardware and is managed through Azure Arc. See AKS Platform.
Agentic Developer Portal	An optional Backstage-based portal on top of the platform. See Agentic Developer Portal.
Drift report	The scheduled report of spokes whose plan shows changes. See Configuration drift detection.