Azure Well-Architected Framework for Enterprise Cloud Architecture

Overview

Azure Well-Architected Framework is Microsoft's decision framework for designing, reviewing, and improving production workloads on Azure. It gives enterprise teams a structured way to align architecture with five pillars: Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency.

Enterprises use it to standardize cloud design reviews, reduce architectural drift, and connect platform engineering with governance and security teams. In practice, it is most effective when paired with Azure Landing Zones, Azure Policy, Microsoft Defender for Cloud, and continuous workload assessments through the Azure Well-Architected Review.

Architecture

A typical enterprise implementation combines a governed platform foundation with workload-specific subscriptions and policy-driven controls.

Core components

• Management groups for hierarchy and policy inheritance
• Subscriptions separated by environment or business unit
• Resource groups for workload lifecycle boundaries
• Azure Policy for guardrails and compliance enforcement
• Microsoft Defender for Cloud for posture management and recommendations
• Azure Monitor, Log Analytics, and Application Insights for observability
• Key Vault for secrets, keys, and certificate management
• Hub-spoke networking with centralized connectivity and inspection

Deployment model

• Platform subscription: shared services, hub network, logging, policy
• Workload subscriptions: app, data, integration, sandbox
• Identity plane: Microsoft Entra ID with RBAC and PIM
• Operations plane: CI/CD, monitoring, backup, incident response

[Users] ---- 1. access ----> [App Gateway/WAF] ---- 2. route ----> [App Service/AKS]
[App Service/AKS] ---- 3. auth ----> [Microsoft Entra ID]
[App Service/AKS] ---- 4. secrets ----> [Key Vault]
[App Service/AKS] ---- 5. telemetry ----> [Azure Monitor]
[App Service/AKS] ---- 6. data ----> [Azure SQL/Storage]
[Management Groups] |
v
[Azure Policy] ---- 7. enforce ----> [Subscriptions]
[Defender for Cloud] <---- 8. assess ---- [Subscriptions]

Data flow

1. Users enter through Application Gateway with WAF.
2. Workloads authenticate with Microsoft Entra ID using managed identities where possible.
3. Applications retrieve secrets from Key Vault.
4. Telemetry is sent to Log Analytics and Application Insights.
5. Policy and Defender continuously evaluate deployed resources.

Implementation Guide

1. Create a resource group and Log Analytics workspace

az group create --name rg-waf-prod --location westeurope
az monitor log-analytics workspace create --resource-group rg-waf-prod --workspace-name law-waf-prod --location westeurope

2. Enable Defender for Cloud pricing plans

SUB_ID=$(az account show --query id -o tsv)
az security pricing create -n VirtualMachines --tier Standard
az security pricing create -n AppServices --tier Standard
az security pricing create -n SqlServers --tier Standard

3. Assign a built-in policy initiative

POLICY_SET_ID=$(az policy set-definition list --query "[?displayName=='Azure Security Benchmark'].id | [0]" -o tsv)
az policy assignment create --name asb-baseline --display-name "Azure Security Benchmark Baseline" --scope /subscriptions/$SUB_ID --policy-set-definition $POLICY_SET_ID

4. Create Key Vault with RBAC authorization

az keyvault create --name kvwafprod01 --resource-group rg-waf-prod --location westeurope --enable-rbac-authorization true --sku standard
az role assignment create --assignee-object-id <managed-identity-object-id> --role "Key Vault Secrets User" --scope $(az keyvault show -n kvwafprod01 --query id -o tsv)

5. Configure diagnostic settings

LAW_ID=$(az monitor log-analytics workspace show -g rg-waf-prod -n law-waf-prod --query id -o tsv)
KV_ID=$(az keyvault show -n kvwafprod01 --query id -o tsv)
az monitor diagnostic-settings create --name send-to-law --resource $KV_ID --workspace $LAW_ID --logs '[{"category":"AuditEvent","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'

6. Run a Well-Architected review cadence

• Review every production workload quarterly.
• Track recommendations in Azure Boards, Jira, or GitHub Issues.
• Map findings to owners: platform, security, app, and operations.

Code Examples

Example 1: Azure Policy assignment parameters

{
  "location": {
    "value": "westeurope"
  },
  "effect": {
    "value": "Deny"
  }
}

Example 2: Bicep-style YAML pipeline stage for governance checks

stages:
  - stage: validate
    jobs:
      - job: policy_scan
        steps:
          - script: az policy state summarize --management-group mg-platform
            displayName: "Summarize policy compliance"
          - script: az security assessment list --query "[?status.code!='Healthy']"
            displayName: "List unhealthy assessments"

Example 3: Python query against Log Analytics

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient

client = LogsQueryClient(DefaultAzureCredential())
query = "AzureDiagnostics | where Category == 'AuditEvent' | take 10"
result = client.query_workspace("<workspace-id>", query, timespan=None)
for table in result.tables:
    for row in table.rows:
        print(row)

Security Hardening

• Use management group-scoped policies to deny public IPs, unapproved regions, and noncompliant SKUs.
• Enforce private endpoints for PaaS services such as Storage, SQL, and Key Vault.
• Prefer managed identities over client secrets.
• Enable customer-managed keys where regulatory requirements demand stronger key control.
• Turn on Defender for Cloud, Defender for Servers, and Defender for SQL for threat detection.
• Apply least privilege RBAC and use Privileged Identity Management for elevation.
• Send all diagnostics to centralized logging with immutable retention where required.

Comparison

Troubleshooting

Error 1: Policy assignment denied deployment

Log sample:

{"error":{"code":"RequestDisallowedByPolicy","message":"Resource 'pip-app-prod' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"deny-public-ip","id":"/subscriptions/xxxx/providers/Microsoft.Authorization/policyAssignments/deny-public-ip"}}]'"}}

Fix: Review the assigned initiative, use a private endpoint or internal load balancer, and redeploy with a compliant network design.

Error 2: Key Vault access failure

Log sample:

Azure.RequestFailedException: Status: 403 (Forbidden)
Code: Forbidden
Message: Caller is not authorized to perform action on resource.

Fix: Confirm RBAC or access policy assignment for the workload identity, and verify the app is using the expected managed identity.

Error 3: Missing diagnostics in Log Analytics

Log sample:

OperationName: Microsoft.Insights/diagnosticSettings/write
Status: Failed
Message: Category 'AuditEvent' is not supported for resource type.

Fix: Check supported log categories for the resource with az monitor diagnostic-settings categories list --resource <id> and update the setting.

Best Practices

Do

• Standardize landing zones before onboarding workloads.
• Tag resources with owner, cost center, data classification, and environment.
• Automate compliance checks in CI/CD before production deployment.
• Review architecture decisions against all five pillars, not security alone.

Don't

• Don't allow teams to create subscriptions without inherited policy and logging.
• Don't store secrets in app settings when Key Vault references are available.
• Don't treat Well-Architected reviews as one-time audits; repeat them after major changes.
• Don't optimize cost by weakening resilience, such as removing zone redundancy from critical services.