The Scenario: NovaTech SaaS
Product: Project management platform (Jira/Asana competitor)
Tenants: 200 enterprise customers, 50,000 total users — growing 3× in 2 years
SLA: 99.99% availability
Performance: <200 ms API latency globally
Compliance: SOC 2 Type II, GDPR (EU data residency)
Features: Real-time collaboration, file storage, notifications, reporting/analytics
Budget: Optimize cost — but reliability is the #1 priority
Pillar 1 — Identity & Governance
- Entra ID multi-tenant app: Each enterprise tenant federates via SAML/OIDC; service principal provisioned on admin consent.
- Management Groups: Root → Platform (Hub networking, shared services) → Workloads (Prod, Staging, Dev).
- Azure Policy: Deny public IPs, enforce tagging, require encryption, allowed regions (East US, West Europe).
- RBAC: Custom roles — TenantAdmin, PlatformEngineer, SRE — scoped to resource groups. No standing Owner; PIM for just-in-time elevation.
Pillar 2 — Networking
- Front Door Premium: Global HTTP routing, built-in WAF, TLS termination, origin health probes.
- Hub-Spoke per region: Azure Firewall in hub; UDRs force all egress through firewall.
- Private Endpoints: Cosmos DB, SQL, Storage, Redis, Key Vault — no public ingress.
- Zero Trust: NSG micro-segmentation, no implicit trust between spokes, conditional access for operators.
Pillar 3 — Compute
- AKS (API tier): 2 clusters (East US + West Europe), system + user node pools, Kubernetes RBAC + Workload Identity, KEDA autoscaler.
- Container Apps (Workers): Background jobs — email, PDF generation, webhook delivery. Scale-to-zero for cost savings.
- Azure Functions (Events): Event Grid triggers for file-upload processing, audit log pipeline, Cosmos DB change-feed consumers.
- Compute right-sizing: Standard_D4s_v5 nodes, spot pools for batch analytics, cluster autoscaler min 3 / max 20 nodes per pool.
Pillar 4 — Data
| Store | Purpose | Partition Key / Strategy | Replication |
|---|---|---|---|
| Cosmos DB (NoSQL) | Tasks, comments, real-time boards | tenantId | Multi-region write (East US + West Europe) |
| Azure SQL Hyperscale | Reporting, billing, RBAC metadata | Tenant-per-schema | Auto-failover group |
| Redis Enterprise | Session tokens, rate-limit counters, caching | — | Active geo-replication |
| Blob Storage (RA-GRS) | File attachments, avatars, exports | tenant/year/month prefix | Read-access geo-redundant |
Pillar 5 — Security
- Key Vault: Per-region vault, RBAC-based access, auto-rotation of secrets every 90 days.
- Defender for Cloud: CSPM enabled, Defender for Containers + SQL + Storage; Secure Score >90%.
- WAF: Front Door WAF in Prevention mode, OWASP 3.2 ruleset, custom rate-limit rules per tenant.
- Encryption: TLS 1.3 in transit; CMK for Cosmos DB + SQL + Storage at rest.
- PIM: No standing admin access; 4-hour max activation, MFA + justification required.
- SOC 2 / GDPR: Purview for data classification, EU tenant data pinned to West Europe via Cosmos DB region affinity, Data Subject Request API.
Pillar 6 — Reliability
- Active-Active: Both regions serve traffic simultaneously; Front Door routes by latency.
- SLA Math: Front Door (99.99%) × AKS (99.95%) × Cosmos DB multi-write (99.999%) = composite ≈ 99.94% per path. With active-active: 1 − (1−0.9994)² ≈ 99.99996%.
- Chaos Testing: Azure Chaos Studio — monthly drills: kill a region, degrade Cosmos, spike CPU on AKS.
- Backup: Cosmos continuous backup (7-day PITR), SQL long-term retention (weekly/monthly/yearly), Blob soft-delete 30 days + immutable legal hold.
- Health Model: Layered health endpoints per service; Front Door removes unhealthy origin in <30 s.
Pillar 7 — Operations
- Monitoring: Azure Monitor workspace (centralized), Application Insights per service, Log Analytics with 90-day hot / 2-year archive.
- Alerting: Action Groups → PagerDuty; burn-rate SLO alerts (error budget <10% remaining).
- CI/CD: GitHub Actions → Bicep (IaC) + Helm charts; blue-green deployments on AKS with Argo Rollouts; canary 5% → 25% → 100%.
- IaC: Bicep modules in a mono-repo; environment promotion via parameter files; What-If validation in PR gates.
- Autoscaling: KEDA (queue length, HTTP concurrency), VMSS cluster autoscaler, Cosmos autoscale RU (400–40,000), SQL Hyperscale read replicas on-demand.
Pillar 8 — Cost Estimate
| Service | SKU / Config | Monthly Cost (est.) |
|---|---|---|
| AKS (2 clusters, 6 nodes each) | D4s_v5 + managed disks | $8,400 |
| Cosmos DB (multi-region write) | Autoscale 40K RU × 2 regions | $9,200 |
| Azure SQL Hyperscale | 8 vCores + 2 read replicas | $3,800 |
| Redis Enterprise | E10 × 2 regions | $2,400 |
| Front Door Premium | + WAF policies | $1,200 |
| Blob Storage (RA-GRS) | 10 TB | $600 |
| Azure Firewall (2 hubs) | Premium SKU | $3,500 |
| Monitoring + Log Analytics | 50 GB/day ingestion | $3,600 |
| Container Apps + Functions | Consumption + Dedicated | $1,800 |
| Key Vault, Defender, misc | — | $1,500 |
| Total Estimated | ~$36,000/month | |
Optimization Strategies
- 3-year Reserved Instances for AKS nodes (−62%) and Cosmos DB reserved capacity (−20%).
- Spot node pools for batch analytics workloads.
- Commitment-based discounts for Log Analytics (−30%).
- Lifecycle management → cool/archive blob tiers after 30/90 days.
- Scale-to-zero on Container Apps during off-peak hours.
Full Architecture Overview
WAF Assessment Checklist
| Pillar | Key Question | NovaTech Answer |
|---|---|---|
| Reliability | Can we survive a full region failure? | Yes — active-active, Cosmos multi-write, SQL failover group, Front Door auto-reroute. |
| Security | Is all data encrypted and access zero-trust? | Yes — CMK at rest, TLS 1.3 in transit, private endpoints, PIM, WAF. |
| Cost | Are we optimizing without sacrificing SLA? | Reserved capacity, spot pools, scale-to-zero, lifecycle policies. |
| Operational Excellence | Can we deploy safely and observe everything? | Blue-green + canary, centralized monitoring, SLO-based alerts, IaC. |
| Performance | Can we hit <200 ms globally? | Front Door edge PoPs, regional compute, Cosmos local reads, Redis caching. |
Challenge Questions
🎉 Congratulations!
You've completed the entire AZ-305 study curriculum. You've designed a production-grade, multi-region, multi-tenant SaaS platform covering identity, networking, compute, data, security, reliability, operations, and cost optimization. You're ready to ace the exam — and architect real systems on Azure.