Well-Architected ACAAzure Container Apps · L400

Self-paced or instructor-led · Level 400

Well Architected Azure Container Apps

This is not a demo tour. Across nine hands-on modules you predict, build, break, observe, recover, and defend real Azure Container Apps workloads, then capture evidence for independent assessment against a level-400 rubric. Normative technical claims are grounded in official Microsoft documentation.

Choose your mode → Jump to the lab guide
9
Hands-on modules
100
Assessor-scored points
≥80%
Competency gate
60
Knowledge-check bank

The delivery contract

Predict · Design · Build · Break · Observe · Recover · Defend

Competency is scored across five weighted dimensions, not on whether a container simply started. Every activity produces artifacts a reviewer can verify against live Azure state.

Explain 15%Design 20%

Reason before you run

Justify service selection against AKS, App Service, Functions, ACI, and Jobs. Commit a falsifiable ADR with an exit trigger.

Implement 25%Validate 25%

Build and prove

Ship digest-pinned images, private ingress, managed identity, KEDA scaling, canaries, and telemetry — each with a validation gate.

Operate & defend 15%

Recover and defend

Diagnose injected incidents from evidence, recover within SLO, and defend your design against counterfactual changes.

The scenarios

Two workloads carry the whole workshop

Every module applies to a concrete system so decisions have consequences you can measure.

Greenfield · retail

Contoso order platform

  • Public order API, private internal catalog, a Service Bus worker, and a scheduled reconciliation job
  • PostgreSQL, Key Vault, and an approved Azure Container Registry
  • 100 req/s average, 1,500 req/s peak
  • 99.95% availability · RTO 30 min · RPO 5 min
Brownfield · migration

Fabrikam modernization

  • A .NET web app and a Windows service running on VMs today
  • Local session state and file uploads, SQL polling, config-stored connection strings
  • Decide what ports to ACA, what is retained, and what needs another service
  • Sequence a strangler migration with gates and a time-bounded rollback

Reference topology

What you will build toward

A production-shaped Container Apps environment with private data, controlled edge, and least-privilege identity.

Internet → controlled edge

Azure Front Door Front Door global edge · TLS
Web Application Firewall policy WAF policy OWASP rules

Container Apps environment · VNet-injected · zone-redundant · workload profiles

order-api container app order-api external ingress
MI · 90/10 split
catalog container app catalog internal ingress
worker container app worker no ingress
KEDA scaled
reconcile scheduled job reconcile scheduled job

Backing services

Azure Key Vault Key Vault Secrets User
Azure Database for PostgreSQL PostgreSQL private access
Azure Container Registry Container Registry AcrPull
Azure Service Bus Service Bus KEDA → worker
Azure Managed Identity Managed identity workload auth
Log Analytics workspace Log Analytics logs · KQL · alerts

Enterprise context

Where this workload sits in a platform landing zone

An Azure landing zone has two halves: a platform landing zone (the centralized hub/platform subscriptions that provide connectivity, identity, governance, and shared monitoring) and application landing zones (the workload spoke subscriptions where teams deploy inside the platform's guardrails). This Container Apps workload is an application landing zone that peers into the platform hub — it consumes central services rather than re-creating them.

Internet → controlled edge

Azure Front Door Front Door global edge
Web Application Firewall policy WAF policy OWASP rules
Platform landing zone
Hub / platform subscriptions · platform team
Azure Firewall Azure Firewall central egress
Hub virtual network Hub VNet gateways · DDoS
Private DNS zones Private DNS privatelink.*
Microsoft Entra identity Microsoft Entra tenant identity
Central Log Analytics and Sentinel Log Analytics Sentinel · Defender
Azure Policy Azure Policy governance
Application landing zone
Workload spoke subscription · workload team
Spoke virtual network Spoke VNet delegated subnet
Container Apps environment ACA environment VNet-injected
Azure Key Vault Key Vault Secrets User
Azure Database for PostgreSQL PostgreSQL private access
Azure Container Registry Registry AcrPull
User-assigned managed identity Managed identity workload auth
Platform landing zone

Hub & platform subscriptions

Owned by the platform team · shared by every workload

  • Connectivity: hub VNet, Azure Firewall / egress control, ExpressRoute & VPN gateways, Azure DDoS Protection Central inspection and hybrid connectivity shared across all spokes.
  • Private DNS zones (privatelink.*) Resolved centrally so every spoke reaches private endpoints consistently.
  • Identity: Microsoft Entra, domain services The primary security boundary for the whole tenant.
  • Management & security: central Log Analytics, Microsoft Sentinel, Defender for Cloud, Azure Policy Platform + security telemetry, SIEM, and governance guardrails.
  • Governance: management group hierarchy, subscription vending A repeatable way to hand workload teams a compliant landing zone.
Application landing zone

Workload spoke subscription

Owned by the workload team · deployed within platform guardrails

  • Spoke VNet + delegated subnet, peered to the hub Workload network that routes egress through the platform firewall.
  • Container Apps environment (VNet-injected, zone-redundant) The workload runtime and its network + security boundary.
  • Key Vault, PostgreSQL, storage + private endpoints Workload-owned data and secrets, reached privately over the spoke.
  • User-assigned managed identities and RBAC scope Least-privilege workload identity to its own resources only.
  • App-scoped Log Analytics (can forward to the central workspace) Application diagnostics owned and queried by the team.

Component-by-component placement

Architecture componentLands inWhy
Front Door + WAF (global edge) Hub or workload Shared platform edge with central WAF policy and certs when many workloads share ingress; a single-tenant workload may own its own profile.
Azure Firewall / egress, gateways, DDoS Hub Central egress inspection and hybrid connectivity are shared across every spoke.
Private DNS zones (privatelink.*) Hub Centralized so all spokes resolve private endpoints the same way.
Central Log Analytics, Sentinel, Policy Hub Platform + security monitoring, SIEM, and governance belong to the platform team.
Spoke VNet + ACA delegated subnet Spoke The workload's own network, peered to the hub for shared egress.
Container Apps environment Spoke It is the workload runtime plus its network and security isolation boundary.
Container Registry Spoke or shared Per-workload for strict isolation, or one central Premium ACR consumed by many teams.
Key Vault, PostgreSQL, private endpoints Spoke Workload-owned secrets and data, accessed privately within the spoke.
Managed identities & RBAC Spoke Workload identity scoped least-privilege to its own resources.

Scaling to a multi-ACA fleet

When several business units or workloads run Container Apps side by side, give each its own application landing zone (subscription + environment) and share only what the platform can govern centrally. The Container Apps environment is the isolation, network, and billing boundary — so it follows the trust boundary.

Shared platform
One hub & governance for the whole fleet
Azure Front Door Front Door shared edge
Azure Firewall Azure Firewall central egress
Private DNS zones Private DNS shared zones
Central Azure Container Registry Central ACR Premium · geo-repl
Central Log Analytics and Sentinel Log Analytics Sentinel · Defender
Azure Policy and management groups Policy guardrails · vending
BU A · Payments
own landing zone
Container Apps environment ACA env
Azure Key Vault Key Vault
Azure Database for PostgreSQL PostgreSQL
BU B · Catalog
own landing zone
Container Apps environment ACA env
Azure Key Vault Key Vault
Azure Database for PostgreSQL PostgreSQL
BU C · Analytics
own landing zone
Container Apps environment ACA env
Azure Key Vault Key Vault
Azure Database for PostgreSQL PostgreSQL
Share across the fleet

One set for the whole platform

  • Hub networking, Azure Firewall egress, gateways, DDoS Central inspection and connectivity every spoke peers into.
  • Private DNS zones Consistent private-endpoint resolution across all workloads.
  • Central monitoring & governance: Log Analytics, Sentinel, Defender, Policy, subscription vending Uniform security posture and a repeatable landing-zone pipeline.
  • Optionally one Premium, geo-replicated ACR Per-team scoped tokens/RBAC, private endpoints, and image scanning + signing standardize the supply chain and cut cost.
  • Optionally one Azure Front Door Per-route and per-BU WAF policies behind a single global edge.
Keep per workload / BU

One set per application landing zone

  • Container Apps environment Same team + same trust boundary can co-locate apps via workload profiles; different BUs or compliance scopes get separate environments.
  • Spoke VNet + delegated subnet Network isolation and independent address space per workload.
  • Key Vault, databases, storage Blast-radius and data ownership stay inside the workload.
  • Managed identities and RBAC scope Identity separation so one BU can never reach another's resources.
  • App secrets/config, app-scoped Log Analytics, CI/CD identity Independent release cadence and diagnostics per team.

The curriculum

Nine modules, one competency gate

Each module ends in an evidence gate. The browser tracks readiness; an assessor verifies artifacts and live Azure state.

Loading modules…

Choose how you learn

Same activities. Same gates. Two paces.

Both modes use identical hands-on activities, validation steps, evidence gates, and knowledge checks. Instructor-led mode adds talk tracks, discussion prompts, and demo cues. Your choice is saved in this browser.

✓ Selected
🧭

Self-paced

24 hours across nine modules · plus pre-work

Work through every module on your own schedule. Instructor callouts are hidden so you stay focused on doing the work and capturing evidence.

  • Progress and evidence saved in your browser
  • Full validation gates and knowledge checks
  • Level-400 stretch goals on every activity
Start self-paced →
✓ Selected
🎓

Instructor-led

Three days · 24 hours · plus pre-work

Run the same activities in a facilitated session. Each activity surfaces a talk track, discussion prompt, and demo cue for the instructor.

  • Facilitator talk tracks and calibration notes
  • Group discussion and live demo cues
  • Shared pacing across the cohort
Start instructor-led →

The selected mode is remembered in this browser and applied when you open the lab guide.

Grounded in the Well-Architected Framework

Every gate maps to a WAF pillar

Decisions are judged against Microsoft's Well-Architected Framework, not personal preference.

🛡️

Reliability

SLOs, error budgets, zone failure

🔒

Security

Identity, private paths, no secrets

💵

Cost

Unit economics, right-sizing

⚙️

Operational

Canary, rollback, runbooks

⚡

Performance

KEDA scaling, tail latency