Claims and customer operations: Copilot Studio, Power Automate, Azure AI Foundry and Microsoft Fabric

Well-Architected review Claims operations assistant · 2026-10-02 · mode full

Coverage audit

• Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
• Assessed 59 recommendations: 14 with diagram evidence, 45 cannot be determined.
• Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
• Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.

Executive summary

This Azure Well-Architected Framework (with the guidance for AI workloads) review of Claims operations assistant (high criticality) assessed the architecture diagram only. 14 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 1 high, 1 medium and 0 low risks. Estimated run cost is $7,098/month (indicative).

14 of 59 recommendations have diagram evidence (24%); among those, 7 implemented, 5 partial, 2 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Data stores are not placed in public subnets; Key management shown; Identity service shown; Observability shown; IaC / delivery pipeline shown; Content safety shown; Model telemetry destination shown; Agents and excessive agency.

Architecture overview

The reviewed architecture is the Diagram tab (30 components, architecture diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.

Recommendation ledger 59 recommendations — nothing truncated

Findings

High risk (1)

Medium risk (1)

To confirm not drawn, so not counted as gaps

• No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
• No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
• No CDN / global edge shown for end users PE:03, PE:09 — Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to reduce latency.
• No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.
• Single-region model inference RE:05, RE:06 — Plan for throttling and quota limits (retries, queuing, provisioned throughput units) and consider global or data-zone deployments, a second region or a fallback model.
• Model cost controls CO:07, CO:12 — Select the smallest model that meets quality targets; use prompt caching and batch deployments where possible; track cost per request.

Cross-pillar trade-offs

• Content safety on model traffic Security ↔ Cost Optimization ↔ Performance Efficiency
  Content Safety costs $375.00/month (6% of AI spend) and adds a synchronous screening step to each model call. Resolution: Apply the strictest checks where harm is highest (final responses, PII) and measure per-check value before enabling every check on every call.
• Observability volume Operational Excellence ↔ Cost Optimization
  Log Analytics is $11.50/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per table (Basic logs for high-volume, low-value data) and keep full-fidelity logs for security and audit sources only.

Eisenhower prioritization

Prioritized remediation plan

Next steps

1. F-001 Model inference dominates cost — Validate that the chosen model is the smallest that meets quality targets; use prompt caching, batch deployments and token budgets. (ML platform team)
2. F-002 Internet-facing entry has no WAF / DDoS protection shown — Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce. (Security engineering)
3. Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).