Public pay-as-you-go list prices from the Azure Retail Prices API (USD). Excludes taxes, support plans, Reservations, Savings Plans, Spot and enterprise or EA discounts, and data transfer unless a node sets egressGbPerMonth. Free grants are included where the meter has a free tier. Monthly = 730 hours. Not a quote: confirm with the Azure Pricing Calculator.
| Component | Service | Status | $ / month | Line items |
|---|---|---|---|---|
| API Management | API Management Services | estimated | $687 | 1 line
|
| Cosmos DB | Azure Cosmos DB | estimated | $70.90 | 2 lines
Single-region writes, standard provisioned or autoscale throughput. Serverless, multi-region writes, backup and analytical storage are not modelled. |
usage| Component | Assumption | Value | Source |
|---|---|---|---|
| API Management | tier | standard | assumed |
| API Management | units | 1 | assumed |
| Orders Function App | plan | consumption | assumed |
| Orders Function App | requestsPerMonth | 1000000 | assumed |
| Orders Function App | avgDurationMs | 200 | assumed |
| Orders Function App | memoryMb | 512 | assumed |
| Cosmos DB | mode | provisioned | assumed |
| Cosmos DB | ruPerSecond | 1000 | assumed |
| Cosmos DB | storageGb | 50 | assumed |
| Cosmos DB | hoursPerMonth | 730 | assumed |
| Cosmos DB | regions | 1 | assumed |
No what-if options apply to these services.
Retrieved 2026-10-02T10:01:47.868Z from the public Azure Retail Prices API. Latest price effective dates per service:
API Management 2024-12-01 · Functions 2024-12-01 · Azure Cosmos DB 2026-10-01
Only public pay-as-you-go list prices are used. This is not a quote — confirm in the Azure Pricing Calculator.
This Azure Well-Architected Framework review of Imported sequence (standard criticality) assessed the architecture diagram only. 8 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 0 high, 2 medium and 0 low risks. Estimated run cost is $758/month (indicative).
8 of 59 recommendations have diagram evidence (14%); among those, 1 implemented, 1 partial, 6 not implemented. Provisional: scores cover evidenced practices only.
Strengths. Data stores are not placed in public subnets; Design-time cost model.
The reviewed architecture is the Diagram tab (4 components, sequence diagram). Hover a finding to highlight the components involved.
| Pillar | Score (1–5) | Evidenced recommendations | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Reliability | — | 1/10 (10%) | 0 0 1 1 8 | — | No gaps evidenced in the diagram |
| Security | 1.5 | 4/12 (33.3%) | 0 1 3 0 8 | Data stores are not placed in public subnets | Internet-facing entry has no WAF / DDoS protection shown |
| Cost Optimization | — | 1/14 (7.1%) | 1 0 0 0 13 | Design-time cost model | No gaps evidenced in the diagram |
| Operational Excellence | — | 1/11 (9.1%) | 0 0 1 0 10 | — | No monitoring / observability shown |
| Performance Efficiency | — | 1/12 (8.3%) | 0 0 1 0 11 | — | No gaps evidenced in the diagram |
Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| RE:01 | Reliability | Focus your workload design on simplicity and efficiency. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:02 | Reliability | Identify and rate user and system flows. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:03 | Reliability | Use failure mode analysis (FMA) to identify potential failures in your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:04 | Reliability | Define reliability and recovery targets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:05 | Reliability | Add redundancy at different levels, especially for critical flows | Not Applicable | No on-premises or private-link connectivity is drawn. |
| RE:06 | Reliability | Implement a timely and reliable scaling strategy at the application, data, and infrastructure levels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:07 | Reliability | Strengthen the resiliency of your workload by implementing self-preservation and self-healing measures | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:08 | Reliability | Test for resiliency and availability scenarios by applying the principles of chaos engineering. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:09 | Reliability | Implement structured, tested, and documented disaster recovery (DR) plans | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and protect data with Azure Backup, point-in-time restore, geo-replication or Site Recovery, and test restores. |
| RE:10 | Reliability | Continuously measure and track system health using uptime and reliability indicators | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:01 | Security | Establish a security baseline | Cannot Determine | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. |
| SE:02 | Security | Align secure development lifecycle (SDL) throughout the software development lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:03 | Security | Classify and consistently apply sensitivity and information type labels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:04 | Security | Create intentional segmentation and perimeters | Partially Implemented | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. |
| SE:05 | Security | Implement strict, conditional, and auditable identity and access management (IAM) | Cannot Determine | Diagram: No identity / authentication service shown. Authenticate and authorize every request with Microsoft Entra ID (conditional access, RBAC) and use managed identities instead of stored credentials. |
| SE:06 | Security | Isolate, filter, and control network traffic | Not Implemented | Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: A. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. |
| SE:07 | Security | Encrypt data by using modern, industry-standard methods | Cannot Determine | Diagram: No Azure Key Vault shown for data at rest. Encrypt data at rest and in transit; use Azure Key Vault customer-managed keys where you need key rotation, access policy or audit control. |
| SE:08 | Security | Harden all workload components | Not Implemented | Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: A. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. |
| SE:09 | Security | Protect application secrets | Cannot Determine | Diagram: No Key Vault or managed identity shown for database credentials. Store secrets in Azure Key Vault or, better, connect with managed identities and Entra authentication so no credentials are embedded. |
| SE:10 | Security | Implement a holistic monitoring strategy | Not Implemented | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. Diagram: No monitoring / observability shown. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:11 | Security | Establish a comprehensive testing regimen | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:12 | Security | Define and test effective incident response procedures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| CO:01 | Cost Optimization | Create a culture of financial responsibility. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:02 | Cost Optimization | Create and maintain a cost model. | Implemented | A design-time cost model was generated from the Azure Retail Prices API: 3 of 3 billable components priced, $757.61/month pay-as-you-go (indicative; volumes partly assumed). |
| CO:03 | Cost Optimization | Collect and review cost data. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:04 | Cost Optimization | Set spending guardrails. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:05 | Cost Optimization | Get the best rates from providers. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:06 | Cost Optimization | Align usage to billing increments. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:07 | Cost Optimization | Optimize component costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:08 | Cost Optimization | Optimize environment costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:09 | Cost Optimization | Optimize flow costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:10 | Cost Optimization | Optimize data costs. | Cannot Determine | Data transfer (bandwidth) is excluded from the estimate because no node sets egressGbPerMonth; model it before launch. |
| CO:11 | Cost Optimization | Optimize code costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:12 | Cost Optimization | Optimize scaling costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:13 | Cost Optimization | Optimize personnel time. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:14 | Cost Optimization | Consolidate resources and responsibility. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:01 | Operational Excellence | Define your standard practices to develop and operate your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:02 | Operational Excellence | Use standardization as a way to make routine, ad-hoc, and emergency operations consistent and predictable. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:03 | Operational Excellence | Formalize processes across the full software development lifecycle, from ideation to delivery, and make them transparent to the team and stakeholders. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:04 | Operational Excellence | Enhance software development and quality assurance | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:05 | Operational Excellence | Use a standardized infrastructure as code (IaC) approach to prepare resources and configurations. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| OE:06 | Operational Excellence | Build a workload supply chain that drives changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:07 | Operational Excellence | Design a monitoring stack | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| OE:08 | Operational Excellence | Establish a clear, structured incident management process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:09 | Operational Excellence | Enhance the quality of your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:10 | Operational Excellence | Design automation to be reliable, secure, and maintainable | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:11 | Operational Excellence | Clearly define your workload's safe deployment practices. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| PE:01 | Performance Efficiency | Define performance targets. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:02 | Performance Efficiency | Conduct capacity planning. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PE:03 | Performance Efficiency | Select the right services. | Cannot Determine | Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:04 | Performance Efficiency | Establish consistent performance measurement | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| PE:05 | Performance Efficiency | Optimize scaling and partitioning. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:06 | Performance Efficiency | Optimize your workload's performance by regularly testing in a production-like environment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:07 | Performance Efficiency | Optimize code and infrastructure. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:08 | Performance Efficiency | Optimize data usage. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:09 | Performance Efficiency | Prioritize the performance of critical flows. | Cannot Determine | Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:10 | Performance Efficiency | Optimize operational tasks. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:11 | Performance Efficiency | Respond to live performance issues. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:12 | Performance Efficiency | Continuously optimize performance. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
Evidence. Diagram: No monitoring / observability shown. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes.
Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.
Recommendation. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes.
Priority. Delegate · effort Low · owner DevOps / SRE
Evidence. Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: A. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end.
Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.
Recommendation. Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce.
Priority. Delegate · effort Low · owner Security engineering
None
None
None
| ID | Risk | Quadrant | SMART goal | Owner |
|---|---|---|---|---|
| F-001 | Medium | Delegate | By 2026-10-16 (2 weeks): Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Success measure: Dashboards and alerts for every tier; mean time to detect < 5 minutes | DevOps / SRE |
| F-002 | Medium | Delegate | By 2026-10-16 (2 weeks): Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce. Success measure: 100% of public endpoints behind a WAF policy with diagnostic logging enabled | Security engineering |
Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).