Azure Cloud Architecture Design

A public sector web app had to serve customers over the internet and staff from on-premise, without exposing the services and data behind it.

• Customers reach Static Apps through Front Door, then an Application Gateway with WAF policies; Azure AD handles sign-in.
• Staff connect from on-premise over ExpressRoute or site-to-site VPN into a Virtual Network Gateway.
• API Management routes traffic to App Services and Container Instances behind internal load balancers, with an NSG on every subnet.
• Key Vaults, Function Apps, Logic Apps, Service Bus, Event Grid, Cosmos DB, SQL Database and Storage are reached only through private endpoints; outbound traffic leaves through Azure Firewall.
• Governed with Policy, Purview and Azure Arc; deployed with Bicep and Azure DevOps; backed up with Backup Center and Recovery Services Vaults; monitored with Application Insights, Monitor and Log Analytics.

• One reference architecture covering public access, hybrid connectivity, private backends, governance, DevOps, backup and monitoring.
• DDoS protection on the virtual network.