Get started with web app architecture design

Many web apps need to be always available from anywhere in the world and usable from any device or screen size. Web apps must be secure, flexible, and scalable to meet spikes in demand.

To help you choose an Azure web app hosting option, see Choose an Azure compute service.

Azure services for web apps

Azure provides a range of services for creating, hosting, and monitoring web apps:

• Azure App Service: Create enterprise-ready web and mobile apps for any platform or device and deploy them on a scalable cloud infrastructure.

• Azure Web Application Firewall: Provides powerful protection for web apps.

• Azure Monitor: Provides full observability into your applications, infrastructure, and network. Azure Monitor includes Application Insights, which provides application performance management and monitoring for live web apps.

• Azure SignalR Service: Add real-time web functionality.

• Web App for Containers: Run containerized web apps on Windows and Linux.

• Azure Service Bus: Integrate with other web apps by using loosely coupled event-driven patterns.

Architecture

The diagram shows a virtual network that has three subnets. One subnet contains Azure Application Gateway with Azure Web Application Firewall. A user points to this subnet. The second subnet contains private endpoints for Azure platform as a service (PaaS) solutions. The third subnet contains a virtual interface for Azure App Service network integration. Azure Application Gateway communicates with Azure App Service via a private endpoint. Azure App Service shows a zone-redundant configuration. Azure App Service uses virtual network integration and private endpoints to communicate with Azure SQL Database, Azure Key Vault, and Azure Storage. Private DNS zones link to the virtual network. Azure DDoS Protection secures the virtual network. Microsoft Entra ID provides identity and access control. Application Insights and Azure Monitor serve monitoring purposes.

Download a Visio file of this architecture.

The previous diagram demonstrates a typical baseline web app implementation. For real-world solutions that you can build in Azure, see Web app architectures.

Explore web app architectures and guides

The articles in this section include guides and fully developed architectures that you can deploy in Azure and expand to production-grade solutions. Solution ideas demonstrate implementation patterns and possibilities to consider as you plan your web app proof-of-concept (POC) development. These articles can help you decide how to use web app technologies in Azure.

Web app guides

The following articles help you evaluate and select the best web app technologies for your workload requirements.

Networking

• Improved-security access to Azure App Service web apps from an on-premises network: An architecture for setting up private connectivity to Azure App Service from on-premises networks by using Azure Private Link, virtual network integration, and private endpoints.

Security

• Use Azure API Management to protect access tokens in single-page applications: An architecture that uses Azure API Management to implement a stateless Backends for Frontends pattern that protects OAuth2 access tokens from cross-site scripting attacks.

Disaster recovery

• Multiple-region Azure App Service app approaches for disaster recovery (DR): Approaches for deploying multiple-region Azure App Service architectures, including active-active, active-passive, and passive-cold configurations.

Web app architectures

The following production-ready architectures demonstrate end-to-end web app solutions that you can deploy and customize.

Host web apps with App Service

• Basic web app: An introductory architecture for learning how to run web apps on Azure App Service in a single region.

• Baseline highly available zone-redundant web app: A secure, zone-redundant, and highly available web app that uses Azure Application Gateway, Azure Web Application Firewall, and Azure App Service with Azure Private Link.

Host web apps with App Service Environment

• Enterprise deployment that uses App Service Environment: A standard enterprise workload that uses App Service Environment v3 with enhanced security, including Azure Application Gateway and Azure Firewall.

• High availability (HA) enterprise deployment that uses App Service Environment: A zone-redundant App Service Environment deployment that improves resiliency by distributing resources across availability zones.

• Securely managed web apps: A secure App Service Environment deployment with Azure Application Gateway and Azure Web Application Firewall, integrated with Azure DevOps for continuous integration and continuous deployment (CI/CD).

Manage APIs with Azure API Management

• Protect APIs by using Azure Application Gateway and Azure API Management: An architecture that uses Azure Application Gateway and Azure API Management to protect API access with Azure Web Application Firewall and URL-based routing.

• Migrate a web app by using Azure API Management: A migration scenario that uses Azure API Management as a facade for both legacy on-premises services and new Azure-hosted APIs.

Host WordPress on Azure

• WordPress on Azure: An overview of WordPress deployments on Azure that covers security, scalability, and hosting options.

• WordPress on Azure Kubernetes Service (AKS): A container-based WordPress solution that uses Azure Kubernetes Service (AKS) and Azure NetApp Files for large, storage-intensive installations.

• WordPress on Azure App Service: A managed WordPress hosting solution that uses Azure App Service for small to medium-sized installations.

Multitier web apps

• Multitier web app built for HA and DR: A multiple-region architecture for multitier ASP.NET applications that uses Azure Site Recovery and Azure Public Traffic Manager for DR.

Web app solution ideas

The following web app solution idea demonstrates implementation patterns and possibilities to explore:

• Highly available SharePoint farm: A highly available deployment of SharePoint that uses load-balanced Microsoft Entra ID, SQL Server Always On availability groups, and highly available SharePoint resources.

Organizational readiness

Organizations at the beginning of the cloud adoption process can use the Cloud Adoption Framework for Azure to access proven guidance that accelerates cloud adoption.

To help ensure the quality of your web app solution on Azure, follow the guidance in the Azure Well-Architected Framework. The Azure Well-Architected Framework provides prescriptive guidance for organizations that seek architectural excellence and describes how to design, provision, and monitor cost-optimized Azure solutions. For web app-specific guidance, see the following Azure Well-Architected Framework service guides:

• Azure App Service
• Azure API Management
• Azure Functions

Best practices

Follow these best practices to improve the reliability, security, cost effectiveness, performance, and operational quality of your web app workloads on Azure.

• Characteristics of modern web apps: An overview of the expectations and design principles for modern web apps, including scalability, modularity, and cloud-hosted architecture.

• Architecture best practices for Azure App Service: Azure Well-Architected Framework guidance for Azure App Service that covers reliability, security, cost optimization, operational excellence, and performance efficiency.

• Azure App Service deployment best practices: Guidance for deployment sources, build pipelines, deployment mechanisms, and deployment slot strategies for Azure App Service.

• Security baseline for Azure App Service: Security controls and recommendations for Azure App Service based on the Microsoft cloud security benchmark. It covers network security, identity management, and data protection.

Stay current with web apps

Azure web app services evolve to address modern application challenges. Stay informed about the latest updates and features.

To stay current with key web app services, see the following resource:

• Azure updates for web app products and features

Other resources

The following resources can help you discover more about web app architecture design:

• Azure App Service networking features: An overview of inbound and outbound networking features available in Azure App Service. It includes access restrictions, private endpoints, virtual network integration, hybrid connections, and App Service Environment networking.

• Migrate a web app by using Azure API Management: An example scenario for using Azure API Management to migrate a legacy web application.

Amazon Web Services (AWS) or Google Cloud professionals

To help you get started quickly, the following articles compare Azure web app options to other cloud services and provide migration guidance.

Service comparison

• AWS to Azure services comparison - Web apps
• Google Cloud to Azure services comparison - Application services

Migration guidance

If you're migrating from another cloud platform, see the following articles:

• Migrate a workload from AWS to Azure
• Migrate from AWS Application Load Balancer to Azure Application Gateway