Flow
- 1Mobile app → API Management (HTTPS + JWT)
- 2API Management → Azure Functions
- 3Azure Functions → Azure Cosmos DB (read/write)
- 4Azure Functions → Azure Service Bus (enqueue job)
- 5Azure Service Bus → Azure Functions (trigger)
- 6Azure Functions → Azure Storage (export)
Cost estimate eastus · price list as of 2026-10-02 · indicative — some usage is assumed
$474per month
$5,691per year
8/11components priced
1not priced (see below)
Public pay-as-you-go list prices from the Azure Retail Prices API (USD). Excludes taxes, support plans, Reservations, Savings Plans, Spot and enterprise or EA discounts, and data transfer unless a node sets egressGbPerMonth. Free grants are included where the meter has a free tier. Monthly = 730 hours. Not a quote: confirm with the Azure Pricing Calculator.
Usage basis. Illustrative: 3M API calls/month on the Consumption plan, 20,000 monthly active users, 500,000 background jobs.
By category
By component click a row to highlight it on the diagram
| Component | Service | Status | $ / month | Line items |
|---|---|---|---|---|
| Azure Cosmos DB | Azure Cosmos DB | estimated | $370 | 2 lines
Single-region writes, standard provisioned or autoscale throughput. Serverless, multi-region writes, backup and analytical storage are not modelled. |
| Application Insights | Application Insights | estimated | $80.50 | 1 line
Pay-as-you-go ingestion with the monthly free allowance in the tier; commitment tiers are not modelled. |
| Azure Service Bus | Azure Service Bus | estimated | $10.00 | 2 lines
|
| API Management | API Management Services | estimated | $7.00 | 1 line
|
| Azure Storage | Storage Accounts | estimated | $4.42 | 3 lines
Excludes data retrieval and early-deletion charges, egress and transactions on other APIs. |
| Azure Key Vault | Key Vaults | estimated | $1.50 | 1 line
Standard tier software-protected keys; HSM keys and certificates are not modelled. |
| Azure Functions | Function Apps | estimated | $0.40 | 2 lines
Consumption plan; the monthly free grant is included in the tiered meters. |
Not priced
- Entra External ID — not-estimated: No cost model for External Identities yet. Supply `usage.monthlyUsd` on the node to include it.
- Front Door WAF — no-charge: Web Application Firewall Policies(WAF) has no direct charge.
- Azure Functions — estimated: Consumption plan; the monthly free grant is included in the tiered meters.
Assumptions 9 defaulted — replace them with your own numbers in each node's usage
| Component | Assumption | Value | Source |
|---|---|---|---|
| API Management | tier | consumption | from spec |
| API Management | callsPerMonth | 3000000 | from spec |
| Azure Functions | plan | consumption | assumed |
| Azure Functions | requestsPerMonth | 3000000 | from spec |
| Azure Functions | avgDurationMs | 120 | from spec |
| Azure Functions | memoryMb | 512 | from spec |
| Azure Cosmos DB | mode | autoscale | from spec |
| Azure Cosmos DB | ruPerSecond | 4000 | from spec |
| Azure Cosmos DB | storageGb | 80 | from spec |
| Azure Cosmos DB | hoursPerMonth | 730 | assumed |
| Azure Cosmos DB | regions | 1 | assumed |
| Azure Service Bus | tier | standard | from spec |
| Azure Service Bus | operationsPerMonth | 3000000 | from spec |
| Azure Functions | plan | consumption | assumed |
| Azure Functions | requestsPerMonth | 500000 | from spec |
| Azure Functions | avgDurationMs | 800 | from spec |
| Azure Functions | memoryMb | 1024 | from spec |
| Azure Storage | accessTier | hot | assumed |
| Azure Storage | redundancy | LRS | assumed |
| Azure Storage | storageGb | 150 | from spec |
| Azure Storage | writeOperationsPerMonth | 100000 | assumed |
| Azure Storage | readOperationsPerMonth | 2000000 | from spec |
| Application Insights | ingestGbPerMonth | 40 | from spec |
| Application Insights | retentionDays | 31 | assumed |
| Application Insights | retainedGb | 10 | assumed |
| Azure Key Vault | operationsPerMonth | 500000 | from spec |
Sensitivity & what-if
$474at 1× traffic
$747at 3× traffic
$1,730at 10× traffic
No what-if options apply to these services.
Price list provenance
Retrieved 2026-10-02T10:01:47.868Z from the public Azure Retail Prices API. Latest price effective dates per service:
API Management 2024-12-01 · Functions 2024-12-01 · Azure Cosmos DB 2026-10-01 · Service Bus 2024-10-01 · Storage 2026-09-01 · Log Analytics 2018-02-01 · Key Vault 2022-03-01
Only public pay-as-you-go list prices are used. This is not a quote — confirm in the Azure Pricing Calculator.
Well-Architected review Serverless API with asynchronous processing · 2026-10-02 · mode full
Coverage audit
- Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
- Assessed 59 recommendations: 13 with diagram evidence, 45 cannot be determined.
- Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
- Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.
Executive summary
This Azure Well-Architected Framework review of Serverless API with asynchronous processing (standard criticality) assessed the architecture diagram only. 13 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. No risks are evidenced. Estimated run cost is $474/month (indicative).
0Critical
0High
0Medium
0Low
4.1provisional maturity (1–5)
13 of 59 recommendations have diagram evidence (22%); among those, 8 implemented, 5 partial, 0 not implemented. Provisional: scores cover evidenced practices only.
Strengths. Edge protection present; Data stores are not placed in public subnets; Key management shown; Identity service shown; Secrets / passwordless access shown; Asynchronous decoupling shown; Observability shown; Distributed tracing.
Architecture overview
The reviewed architecture is the Diagram tab (11 components, architecture diagram). Hover a finding to highlight the components involved.
Pillar scorecard
| Pillar | Score (1–5) | Evidenced recommendations | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Reliability | — | 2/10 (20%) | 2 0 0 1 7 | Asynchronous decoupling shown | No gaps evidenced in the diagram |
| Security | 4.1 | 7/12 (58.3%) | 4 3 0 0 5 | Edge protection present | No gaps evidenced in the diagram |
| Cost Optimization | — | 1/14 (7.1%) | 0 1 0 0 13 | — | No gaps evidenced in the diagram |
| Operational Excellence | — | 1/11 (9.1%) | 1 0 0 0 10 | Observability shown | No gaps evidenced in the diagram |
| Performance Efficiency | — | 2/12 (16.7%) | 1 1 0 0 10 | — | No gaps evidenced in the diagram |
Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.
Recommendation ledger 59 recommendations — nothing truncated
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| RE:01 | Reliability | Focus your workload design on simplicity and efficiency. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:02 | Reliability | Identify and rate user and system flows. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:03 | Reliability | Use failure mode analysis (FMA) to identify potential failures in your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:04 | Reliability | Define reliability and recovery targets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:05 | Reliability | Add redundancy at different levels, especially for critical flows | Not Applicable | No on-premises or private-link connectivity is drawn. |
| RE:06 | Reliability | Implement a timely and reliable scaling strategy at the application, data, and infrastructure levels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:07 | Reliability | Strengthen the resiliency of your workload by implementing self-preservation and self-healing measures | Implemented | Diagram: Asynchronous decoupling shown. Nodes: bus. Decouple components with Azure Service Bus, Event Grid or Event Hubs so spikes and downstream failures do not cascade; add retries with backoff, timeouts and circuit breakers. |
| RE:08 | Reliability | Test for resiliency and availability scenarios by applying the principles of chaos engineering. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:09 | Reliability | Implement structured, tested, and documented disaster recovery (DR) plans | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and protect data with Azure Backup, point-in-time restore, geo-replication or Site Recovery, and test restores. |
| RE:10 | Reliability | Continuously measure and track system health using uptime and reliability indicators | Implemented | Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:01 | Security | Establish a security baseline | Cannot Determine | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. |
| SE:02 | Security | Align secure development lifecycle (SDL) throughout the software development lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:03 | Security | Classify and consistently apply sensitivity and information type labels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:04 | Security | Create intentional segmentation and perimeters | Partially Implemented | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. |
| SE:05 | Security | Implement strict, conditional, and auditable identity and access management (IAM) | Implemented | Diagram: Identity service shown. Authenticate and authorize every request with Microsoft Entra ID (conditional access, RBAC) and use managed identities instead of stored credentials. |
| SE:06 | Security | Isolate, filter, and control network traffic | Partially Implemented | Diagram: Edge protection present. Nodes: waf. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. |
| SE:07 | Security | Encrypt data by using modern, industry-standard methods | Implemented | Diagram: Key management shown. Nodes: kv. Encrypt data at rest and in transit; use Azure Key Vault customer-managed keys where you need key rotation, access policy or audit control. |
| SE:08 | Security | Harden all workload components | Implemented | Diagram: Edge protection present. Nodes: waf. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. |
| SE:09 | Security | Protect application secrets | Implemented | Diagram: Secrets / passwordless access shown. Nodes: kv. Store secrets in Azure Key Vault or, better, connect with managed identities and Entra authentication so no credentials are embedded. |
| SE:10 | Security | Implement a holistic monitoring strategy | Partially Implemented | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:11 | Security | Establish a comprehensive testing regimen | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:12 | Security | Define and test effective incident response procedures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| CO:01 | Cost Optimization | Create a culture of financial responsibility. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:02 | Cost Optimization | Create and maintain a cost model. | Partially Implemented | A design-time cost model was generated from the Azure Retail Prices API: 8 of 9 billable components priced, $474.22/month pay-as-you-go (indicative; volumes partly assumed). |
| CO:03 | Cost Optimization | Collect and review cost data. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:04 | Cost Optimization | Set spending guardrails. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:05 | Cost Optimization | Get the best rates from providers. | Cannot Determine | Compute and database capacity is $370.80/month at pay-as-you-go rates (78% of the estimate); whether Reservations or Savings Plans apply is not shown. Evaluate with Azure Advisor recommendations after 30+ days of steady usage. |
| CO:06 | Cost Optimization | Align usage to billing increments. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:07 | Cost Optimization | Optimize component costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:08 | Cost Optimization | Optimize environment costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:09 | Cost Optimization | Optimize flow costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:10 | Cost Optimization | Optimize data costs. | Cannot Determine | Data transfer (bandwidth) is excluded from the estimate because no node sets egressGbPerMonth; model it before launch. |
| CO:11 | Cost Optimization | Optimize code costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:12 | Cost Optimization | Optimize scaling costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:13 | Cost Optimization | Optimize personnel time. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:14 | Cost Optimization | Consolidate resources and responsibility. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:01 | Operational Excellence | Define your standard practices to develop and operate your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:02 | Operational Excellence | Use standardization as a way to make routine, ad-hoc, and emergency operations consistent and predictable. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:03 | Operational Excellence | Formalize processes across the full software development lifecycle, from ideation to delivery, and make them transparent to the team and stakeholders. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:04 | Operational Excellence | Enhance software development and quality assurance | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:05 | Operational Excellence | Use a standardized infrastructure as code (IaC) approach to prepare resources and configurations. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| OE:06 | Operational Excellence | Build a workload supply chain that drives changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:07 | Operational Excellence | Design a monitoring stack | Implemented | Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Application tracing/telemetry is drawn (ai). |
| OE:08 | Operational Excellence | Establish a clear, structured incident management process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:09 | Operational Excellence | Enhance the quality of your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:10 | Operational Excellence | Design automation to be reliable, secure, and maintainable | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:11 | Operational Excellence | Clearly define your workload's safe deployment practices. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| PE:01 | Performance Efficiency | Define performance targets. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:02 | Performance Efficiency | Conduct capacity planning. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PE:03 | Performance Efficiency | Select the right services. | Cannot Determine | Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:04 | Performance Efficiency | Establish consistent performance measurement | Partially Implemented | Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Application tracing/telemetry is drawn (ai). |
| PE:05 | Performance Efficiency | Optimize scaling and partitioning. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:06 | Performance Efficiency | Optimize your workload's performance by regularly testing in a production-like environment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:07 | Performance Efficiency | Optimize code and infrastructure. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:08 | Performance Efficiency | Optimize data usage. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:09 | Performance Efficiency | Prioritize the performance of critical flows. | Cannot Determine | Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:10 | Performance Efficiency | Optimize operational tasks. | Implemented | Diagram: Asynchronous decoupling shown. Nodes: bus. Decouple components with Azure Service Bus, Event Grid or Event Hubs so spikes and downstream failures do not cascade; add retries with backoff, timeouts and circuit breakers. |
| PE:11 | Performance Efficiency | Respond to live performance issues. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:12 | Performance Efficiency | Continuously optimize performance. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
Findings
No gaps are evidenced in the diagram. That is not a clean bill of health: see the coverage audit for what could not be determined.
To confirm not drawn, so not counted as gaps
- No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
- No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
- No backup or recovery capability shown RE:09 — Protect data with Azure Backup (vault with soft delete and cross-region restore where required) or database point-in-time restore, and test restores against your RPO/RTO.
- No infrastructure-as-code or CI/CD shown OE:05, OE:11 — Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline with small, reversible changes, environment promotion and automated rollback.
- No CDN / global edge shown for end users PE:03, PE:09 — Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to reduce latency.
- No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.
Cross-pillar trade-offs
- Observability volume Operational Excellence ↔ Cost Optimization
Log Analytics is $80.50/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per table (Basic logs for high-volume, low-value data) and keep full-fidelity logs for security and audit sources only.
Eisenhower prioritization
Do First
None
Plan
None
Delegate
None
Defer
None
Next steps
- Add the missing process, configuration and runtime evidence to turn Cannot Determine practices into assessed ones.
- Re-run the review after changes, and when the architecture or documentation changes.
Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).