Edit

Common Azure networking workload patterns

Most Azure deployments don't use every networking service. This article shows five common workload patterns and the Azure networking design guide articles that apply to each one. These combinations aren't prescriptive. They're starting points to help you scope your reading.

Use these patterns to identify the articles most relevant to your situation. If your workload doesn't match any of them exactly, combine elements from multiple patterns as needed. For a structured way to map your own requirements to articles, use the requirements assessment. For a quick phase-based summary, see Design phases at a glance. For guided, sequenced reading paths, use the scenario guides.

Web application with public users and a database backend

A typical web application serves internet traffic with a backend database. This pattern requires internet ingress, application delivery for global performance, private connectivity to PaaS data services, and web-layer security.

Area Articles
Foundation Virtual networks and subnets, IP address planning, Network security groups
Connectivity Internet ingress, Application delivery, PaaS private access
Security Web Application Firewall, DDoS protection, DNS security

Internal line-of-business application connected to on-premises

An internal application that doesn't serve public internet traffic but needs connectivity back to an on-premises datacenter. Users access the application from the corporate network or through a secure remote access solution.

Area Articles
Foundation Virtual networks and subnets, IP address planning, Network security groups
Connectivity Hybrid connectivity, Developer and admin access
Topology Hub-and-spoke topology
Security DNS security

Multi-workload Azure estate with shared services

A larger environment that hosts multiple workloads and shares centralized services like a firewall, monitoring, and network management across subscriptions.

Area Articles
Foundation Virtual networks and subnets, IP address planning, Network security groups
Topology Hub-and-spoke topology
Security Azure Firewall
Operations Network monitoring, Centralized network management

Microservices on Azure Kubernetes Service (AKS), internet-facing

A containerized application running on AKS that serves internet traffic and needs outbound control, private access to backing PaaS services, and layered security.

Area Articles
Foundation Virtual networks and subnets, IP address planning, Network security groups
Connectivity Internet ingress, Application delivery, Outbound internet access, PaaS private access
Security Azure Firewall, Web Application Firewall

Global enterprise with branch offices and multiple regions

A large organization with branch offices, multiple Azure regions, ExpressRoute circuits, and centralized security and management requirements.

Area Articles
Foundation Virtual networks and subnets, IP address planning, Network security groups
Connectivity Hybrid connectivity, Application delivery, Cross-region and multicloud
Topology Azure Virtual WAN, Multi-region networking
Security Azure Firewall
Operations Centralized network management

Next steps

  • Last updated on