EXPLODED ARCHITECTURE

The reference architecture, assembled from Azure building blocks

Each plane is one subsystem, separated along the central assembly axis. Icons are the official Microsoft Azure architecture symbols. Read top→bottom: a request enters at the identity/edge tier and descends into the private application, data, and platform tiers, all enclosed by the network fabric.

01 · Identity & usersWho calls the system and how tokens are issued

Usersworkforce + customers

Entra External IDcustomer sign-in

Entra IDworkforce

Managed Identityno secrets

OIDC / OAuth2 · bearer JWT

02 · Global edgePublic entry point, TLS, WAF, caching

Front Door + CDNglobal anycast

WAF policiesOWASP rules

HTTPS · public surface = 2 resources only

03 · Presentation & gatewaySPA host + the browser-facing API facade · optionally a composition shell + slice remotes

Static Web AppsReact SPA (parity)

API Managementvalidate-jwt · rate-limit

private ingress · APIM is the sole caller

04 · Application planeAzure Container Apps (Consumption) — one container per vertical slice

Container Apps EnvironmentVNet-injected · zone redundant · KEDA

EngagementCRUD parent

XYZ Calculationrealization · yield

Approvalssaga workflow

Read Modellist projections

Live Feed / SSEnear real time

Cache for RedisSSE backplane

private endpoints · one datastore per slice

05 · Data (polyglot)Each slice owns its store — no cross-slice reads

Azure SQLEngagement

Azure SQLXYZ + audit

Cosmos DBread model

PostgreSQLrate tables

Blob Storageexports / docs

transactional outbox · domain events

06 · Async backbone & platformMessaging, secrets, observability, images

Service Buscommands · sagas

Event Gridevent fan-out

Event Hubsexternal feeds

Key Vaultsecrets · CMK

Container Registrysigned images

Azure Monitormetrics · alerts

App InsightsOTel traces

Log AnalyticsKQL · logs

everything above sits inside the network fabric

07 · Network fabric (base plate)Private, zone-resilient connectivity that encloses every tier

Virtual Networkisolation

SubnetsACA · PE

Private Endpointsno public data plane

Assembly axis (request flow) Layer separation Icons: official Microsoft Azure architecture symbols

Optional frontend flavor: the Static Web App can be split into a composition shell + independently deployed slice remotes — see section 05B.

Icons are the official Microsoft Azure architecture icons and are Microsoft IP, used per Microsoft's icon terms of use. They are delivered here via a public CDN mirror for convenience. Microsoft, Azure, and the Microsoft logo are trademarks of the Microsoft group of companies.