Compute
Container Apps in a zone-redundant environment, App Service for simple apps.
Why. PaaS removes cluster management.
Trade-off. Less control than AKS, and fewer networking options.
Cloud platforms · Azure
Web application on Azure Front Door, Container Apps and Azure SQL
The Azure equivalent of the three-tier pattern: Front Door with WAF, Container Apps or App Service on a private network, Azure SQL, Entra ID for identity and Key Vault for secrets.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- ACSC Essential Eight
- SA ISMF and ACSC ISM alignment
- Australian Privacy Principles (APP 11)
- Australia East (primary), Australia Southeast (secondary)
Architecture
- People and clients
- Security and identity
- Network and edge
- Compute and containers
- Databases and data
- Object and file storage
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Users reach Front Door, which terminates TLS, applies the WAF policy (Microsoft default rule set and bot protection) and caches static assets.
The application redirects to Microsoft Entra ID for sign-in. Conditional Access enforces MFA and device or location policy, and the app receives OIDC tokens.
Front Door reaches the origin over Private Link, so Container Apps has no public ingress.
The app queries Azure SQL through a private endpoint. It authenticates with its managed identity, not a SQL password.
Secrets and encryption keys come from Key Vault using the same managed identity and Azure RBAC.
Files are stored in a private Blob container reached through a private endpoint, with SAS tokens issued by the app for time-limited download.
Metrics, logs and traces flow to a central Log Analytics workspace and Application Insights.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Azure Front Door Premium | Global entry, WAF, TLS, routing and Private Link to origins. | Premium is needed for Private Link origins and the managed bot protection rule set. |
| Azure Container Apps | Serverless containers with KEDA scaling and revisions for blue/green. | Less to run than AKS. App Service is a good alternative for simple web apps and teams that prefer PaaS. |
| Azure SQL Database | Managed SQL Server engine, zone-redundant, geo-replication available. | Matches Microsoft-stack skills, with built-in TDE, auditing and Entra authentication. |
| Microsoft Entra ID | Workforce and external identities, MFA and Conditional Access. | One identity plane across Microsoft 365, Azure and the app. |
| Azure Key Vault | Secrets, keys and certificates with RBAC and purge protection. | Customer-managed keys for SQL TDE and Storage when policy requires them. |
| Azure Storage (Blob) | Object storage for uploads, with versioning and soft delete. | Cheap and durable, with private endpoints and Defender for Storage. |
| Log Analytics and Application Insights | Central logs, metrics, traces and alerts. | Native integration and workbooks without extra tooling. |
| Azure Policy and Defender for Cloud | Guardrails and posture management. | Enforces the baseline and surfaces misconfiguration. |
Design decisions and trade-offs
Origin exposure
Private Link from Front Door to the app.
Why. Prevents bypassing WAF by hitting the origin directly.
Trade-off. Front Door Premium cost and an approval step for each private endpoint.
Database authentication
Managed identity and Entra-only auth.
Why. No password to leak or rotate.
Trade-off. Legacy tools and some ORMs need extra setup.
Resilience
Zone redundancy first, region pair second.
Why. Zones cover most failures cheaply.
Trade-off. Cross-region failover is a separate design and cost.
Well-architected pillars
Security
WAF, private origins, Entra with Conditional Access, managed identities, Key Vault with purge protection, Defender for Cloud.
Reliability
Zone-redundant ingress, compute and database. Geo-replication or failover groups for regional events.
Performance
Front Door caching and anycast routing, KEDA autoscale, and SQL tier sized from measured DTU or vCore use.
Cost optimisation
Front Door Premium base fee, Container Apps consumption, SQL vCores and log ingestion. Reservations cover the baseline.
Operational excellence
Bicep or Terraform, GitHub Actions with federated credentials, revisions for safe rollouts, Azure Monitor alerts.
Sustainability
Scale to zero, right-size SQL, shorten log retention to the policy minimum and use the Australian regions' mix wisely.
Network, identity and data
Networking
Spoke VNet with a delegated subnet for the Container Apps environment and a subnet for private endpoints. Private DNS zones resolve privatelink names. Egress goes through the hub firewall where the organisation runs one.
Identity and least privilege
Workforce users sign in with Entra ID and groups map to app roles. The app uses a user-assigned managed identity with specific roles on SQL, Key Vault and Storage. Privileged access uses PIM with approval.
Data and encryption
TDE on by default, with a customer-managed key in Key Vault if required. Always Encrypted or column-level controls for the most sensitive fields. Sensitivity labels and Purview if the tenant uses them.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Conditional Access requires MFA. Essential Eight multi-factor authentication. |
| Restrict administrative privileges | PIM just-in-time roles and no standing owners. Essential Eight. |
| Regular backups | SQL automated backups with long-term retention, soft delete on storage. Essential Eight. |
| Logging | Diagnostic settings on every resource to a central workspace. Supports ISM event logging guidance. |
| Australian data location | Primary Australia East with Australia Southeast as the pair. Confirm service availability per region. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone loss; 1 to 4 hours for a regional rebuild without a standing secondary
- Target RPONear zero in-zone; seconds to minutes with geo-replication
- Scaling and limitsContainer Apps replica and environment limits and SQL tier maximums apply; check current quotas.
| Failure mode | Mitigation |
|---|---|
| Zone outage | Zone-redundant services continue automatically. Test with fault injection. |
| Region outage | SQL failover group and a second Container Apps environment behind Front Door, only if the RTO requires it. |
| Misconfigured private DNS | Private DNS zones in code and a connectivity test in the pipeline. |
| Secret or key deleted | Soft delete and purge protection on Key Vault. |
Observability and runbooks
- Application Insights distributed tracing and availability tests from multiple locations.
- Alerts on failed requests, SQL DTU or CPU, replica restarts and Front Door origin health.
- Workbooks for service health and a runbook for failover group testing.
Cost drivers and levers
Front Door Premium, Container Apps vCPU and memory, SQL compute and storage, Log Analytics ingestion.
- Azure reservations for SQL.
- Reduce log verbosity and use basic logs for noisy tables.
- Scale non-production to zero.
- Use serverless SQL tier for intermittent databases.
Implementation and fit
Phased approach
- Landing zone and policies first.
- Platform: VNet, private DNS, Front Door and the pipeline.
- Deploy the application and run a security review and load test.
- Cut over with weighted routing in Front Door.
Anti-patterns to avoid
- Leaving the origin publicly reachable.
- SQL authentication with shared passwords.
- Owner role for the pipeline service principal.
- No private DNS testing before go-live.
When to use it
- Organisations standardised on Microsoft 365 and Entra.
- SQL Server skills and apps.
- Public web apps needing WAF and global entry.
When not to
- Small static sites (Static Web Apps is cheaper).
- Workloads needing Kubernetes-specific tooling.
- Teams without a landing zone yet.
More in cloud platforms
AWS and Azure
Multi-account landing zone: AWS Organizations and Azure management groups
The foundation every other pattern sits on: separate accounts or subscriptions for blast-radius control, preventive guardrails, central identity, central logging and a security account that workloads cannot switch off.
AWS and Azure
CI/CD and infrastructure as code with GitHub Actions, Terraform, ECR and blue/green
A delivery pipeline with no long-lived credentials: pull requests plan, merges apply, images are scanned and signed, and releases shift traffic gradually with automatic rollback.
AWS and Microsoft
Data lake and BI with S3, Glue, Athena, Redshift and Power BI or QuickSight
A governed analytics platform: raw, curated and consumption layers on object storage, a catalogue with column-level access control and a semantic layer that business users can trust.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.