Cloud sprawl starts as a readability problem. If a resource name does not reveal type, workload, environment, and region, every incident, cleanup, and cost review begins with a manual lookup. CAF-aligned naming converts the name itself into operational metadata.
The matcher game reinforces that pattern by asking players to connect resource types to compliant names. In production, the same matching happens in pull requests, deployment pipelines, inventory exports, and chargeback reviews.
Consistent naming improves ownership, cost attribution, and governance. A resource named func-coredata-prd-usw2-001 immediately reads as an example project code for a production Function App in West US 2. A name like app-final-v2 does not.
The Azure resource convention used by the demo follows a hyphenated Cloud Adoption Framework pattern:
| Component | Purpose | Allowed / Example Values | Governance Notes |
|---|---|---|---|
type | Resource-type abbreviation | rg, func, kv, st, vnet | Comes from the canonical abbreviation table. |
project | Workload or platform short code | project, coremon, coredata, coresec | Real-looking values here are example project codes only. |
env | Deployment environment | dev, stg, prd, sbx | Map subscription names to generic scopes such as Production, Dev, and Sandbox. |
region | Azure location code | usw2 for West US 2, eus for East US | Keep the code short and stable. |
instance | Sequence or purpose suffix | 001, 002, ctl, dat | Use numeric instances for multiples and purpose suffixes for identities. |
The canonical table keeps names predictable across subscriptions. It is grounded in the Microsoft CAF abbreviation guidance and extended with common deployment, identity, data, analytics, network, monitoring, and Fabric-adjacent resource types used by modern Azure platforms.
| Category | Resource | Provider / Scope | Abbreviation | Example Name |
|---|---|---|---|---|
| Management | Resource group | Microsoft.Resources/resourceGroups | rg | rg-coremon-dev |
| Management | Management group | Tenant scope | mg | mg-platform-prd |
| Management | Deployment stack | Microsoft.Resources/deploymentStacks | stack | stack-coredata-prd-usw2-001 |
| Identity | User-assigned managed identity | Microsoft.ManagedIdentity/userAssignedIdentities | umi | umi-coredata-dev-usw2-ctl |
| Identity | Key Vault | Microsoft.KeyVault/vaults | kv | kv-coremon-prd-usw2-001 |
| Identity | Federated credential | Child of managed identity | fc | fc-org-repo-main |
| Compute | Virtual machine | Microsoft.Compute/virtualMachines | vm | vm-build-dev-usw2-001 |
| Compute | Virtual machine scale set | Microsoft.Compute/virtualMachineScaleSets | vmss | vmss-api-prd-usw2-001 |
| Compute | Availability set | Microsoft.Compute/availabilitySets | avail | avail-api-prd-usw2-001 |
| Compute | Managed disk | Microsoft.Compute/disks | disk | disk-api-prd-usw2-001 |
| Web | Function App | Microsoft.Web/sites | func | func-coresec-dev-usw2-001 |
| Web | App Service app | Microsoft.Web/sites | app | app-portal-prd-usw2-001 |
| Web | App Service plan | Microsoft.Web/serverfarms | asp | asp-portal-prd-usw2-001 |
| Web | Static Web App | Microsoft.Web/staticSites | stapp | stapp-portfolio-prd-usw2-001 |
| Containers | Container registry | Microsoft.ContainerRegistry/registries | cr | crplatformdevusw2001 |
| Containers | Azure Kubernetes Service | Microsoft.ContainerService/managedClusters | aks | aks-app-prd-usw2-001 |
| Containers | Container Apps environment | Microsoft.App/managedEnvironments | cae | cae-app-prd-usw2-001 |
| Containers | Container App | Microsoft.App/containerApps | ca | ca-api-prd-usw2-001 |
| Storage | Storage account | Microsoft.Storage/storageAccounts | st | stprojectdevusw2001 |
| Storage | Blob container | Storage child resource | blob | blob-raw-ingest |
| Storage | File share | Storage child resource | share | share-app-prd |
| Database | Azure SQL server | Microsoft.Sql/servers | sql | sql-data-prd-usw2-001 |
| Database | Azure SQL database | Microsoft.Sql/servers/databases | sqldb | sqldb-sales-prd-usw2-001 |
| Database | Cosmos DB account | Microsoft.DocumentDB/databaseAccounts | cosmos | cosmos-app-prd-usw2-001 |
| Database | PostgreSQL flexible server | Microsoft.DBforPostgreSQL/flexibleServers | psql | psql-app-prd-usw2-001 |
| Database | Redis cache | Microsoft.Cache/Redis | redis | redis-app-prd-usw2-001 |
| Network | Virtual network | Microsoft.Network/virtualNetworks | vnet | vnet-hub-prd-usw2-001 |
| Network | Subnet | Microsoft.Network/virtualNetworks/subnets | snet | snet-app-prd-usw2-001 |
| Network | Network security group | Microsoft.Network/networkSecurityGroups | nsg | nsg-app-prd-usw2-001 |
| Network | Route table | Microsoft.Network/routeTables | rt | rt-app-prd-usw2-001 |
| Network | Public IP address | Microsoft.Network/publicIPAddresses | pip | pip-app-prd-usw2-001 |
| Network | Load balancer | Microsoft.Network/loadBalancers | lb | lb-app-prd-usw2-001 |
| Network | Application Gateway | Microsoft.Network/applicationGateways | agw | agw-app-prd-usw2-001 |
| Network | Azure Firewall | Microsoft.Network/azureFirewalls | afw | afw-hub-prd-usw2-001 |
| Network | Private endpoint | Microsoft.Network/privateEndpoints | pep | pep-kv-prd-usw2-001 |
| Integration | Event Hubs namespace | Microsoft.EventHub/namespaces | evhns | evhns-coremon-dev-usw2-001 |
| Integration | Event hub | Microsoft.EventHub/namespaces/eventhubs | evh | activitylogs |
| Integration | Service Bus namespace | Microsoft.ServiceBus/namespaces | sbns | sbns-app-prd-usw2-001 |
| Integration | Service Bus queue | Service Bus child resource | sbq | sbq-orders-prd |
| Integration | Logic App | Microsoft.Logic/workflows | logic | logic-ops-prd-usw2-001 |
| Data | Data Factory | Microsoft.DataFactory/factories | adf | adf-data-prd-usw2-001 |
| Data | Data Explorer cluster | Microsoft.Kusto/clusters | dec | dec-logs-prd-usw2-001 |
| Data | Data Explorer database | Microsoft.Kusto/clusters/databases | dedb | dedb-logs-prd-usw2-001 |
| AI | Azure AI Search | Microsoft.Search/searchServices | srch | srch-docs-prd-usw2-001 |
| AI | Azure OpenAI Service | Microsoft.CognitiveServices/accounts | oai | oai-copilot-prd-usw2-001 |
| AI | Foundry account | Microsoft.CognitiveServices/accounts | aif | aif-agents-prd-usw2-001 |
| AI | Machine Learning workspace | Microsoft.MachineLearningServices/workspaces | mlw | mlw-models-prd-usw2-001 |
| Monitoring | Application Insights | Microsoft.Insights/components | appi | appi-coremon-dev-usw2-001 |
| Monitoring | Log Analytics workspace | Microsoft.OperationalInsights/workspaces | log | log-platform-prd-usw2-001 |
| Monitoring | Action group | Microsoft.Insights/actionGroups | ag | ag-platform-prd-usw2-001 |
| Monitoring | Managed Grafana | Microsoft.Dashboard/grafana | amg | amg-coremon-dev-usw2-001 |
| Analytics | Fabric capacity | Microsoft.Fabric/capacities | cap | cap-data-prd-usw2-001 |
Not every Azure service can use the hyphenated pattern exactly. CAF is a convention, but Azure resource-name rules still win.
| Resource | Rule | Pattern | Example |
|---|---|---|---|
| Storage account | Lowercase letters and numbers only; no hyphens; 3–24 characters; globally unique. | st{project}{env}{region}{instance} | stprojectdevusw2001 |
| Container registry | Usually no hyphens; globally unique; keep compact. | cr{project}{env}{region}{instance} | crplatformdevusw2001 |
| Key Vault | Globally unique DNS name; hyphens allowed; plan for soft-delete and purge protection. | kv-{project}-{env}-{region}-{instance} | kv-project-prd-usw2-001 |
| Resource group | Often uses short form because region and instance are implied by contained resources. | rg-{project}-{env} | rg-coremon-dev |
| Managed identity | Purpose suffix can be clearer than a number. | umi-{project}-{env}-{region}-{purpose} | umi-coredata-dev-usw2-dat |
| Event hub entity | Child resource inside a namespace; descriptive names can be better than repeating CAF. | {stream-name} | activitylogs |
Microsoft Fabric artifacts use a different but complementary convention. Instead of hyphenated Azure resource names, Fabric workspace items use underscore-delimited prefixes that make the artifact type, domain, and medallion layer visible in the workspace list. Common wildcard patterns include lh_*_brz, lh_*_slv, lh_*_gld, and nb_*_dq_*.
| Artifact | Prefix / Pattern | Example | Usage |
|---|---|---|---|
| Workspace | ws_<domain>_<env> | ws_sales_prd | Domain and environment boundary. |
| Lakehouse | lh_<domain>_<layer> | lh_sales_brz | Bronze, Silver, and Gold storage. |
| Pipeline | pl_<function>_<source>_<domain>_<layer> | pl_ing_salesforce_sales_brz | Ingestion, transformation, orchestration. |
| Notebook | nb_<purpose>_<domain>_<desc> | nb_dq_sales_validation | Data quality, analytics, utility. |
| Warehouse | dw_<domain>_<layer> | dw_sales_gld | Gold-layer SQL consumption. |
| Semantic Model | sm_<domain>_<purpose> | sm_sales_performance | Power BI model layer. |
| Report | rpt_<domain>_<purpose> | rpt_sales_dashboard | Published analytical report. |
| Dataflow | df_<purpose>_<domain>_<layer> | df_clean_sales_slv | Low-code transformation artifact. |
| Environment | env_<domain>_spark | env_sales_spark | Runtime and library configuration. |
Naming conventions work when they are checked before resources exist. The PR gate should validate IaC names with the Azure Naming Tool, run the Bicep linter, and fail the build when a resource cannot be traced to the expected pattern.
This is the operational lesson behind the SPA. The game rewards correct matches immediately; the platform should do the same by catching drift in code review rather than after deployment.