Flow
- 1Users → Azure Front Door (HTTPS)
- 2Azure Front Door → Application Gateway
- 3Application Gateway → VM scale set
- 3Application Gateway → VM scale set
- 4VM scale set → Azure SQL Database (SQL)
- 4VM scale set → Azure SQL Database
Cost estimate eastus · price list as of 2026-10-02 · indicative — some usage is assumed
$1,792per month
$21,498per year
9/11components priced
0not priced (see below)
Public pay-as-you-go list prices from the Azure Retail Prices API (USD). Excludes taxes, support plans, Reservations, Savings Plans, Spot and enterprise or EA discounts, and data transfer unless a node sets egressGbPerMonth. Free grants are included where the meter has a free tier. Monthly = 730 hours. Not a quote: confirm with the Azure Pricing Calculator.
Usage basis. Illustrative: ~2M page views/month, 500 GB edge egress, two D2s v5 web VMs per zone, SQL Database Business Critical 4 vCores (replicas included).
By category
By component click a row to highlight it on the diagram
| Component | Service | Status | $ / month | Line items |
|---|---|---|---|---|
| Azure SQL Database | SQL Database | estimated | $951 | 2 lines
Provisioned vCore, single database. Excludes backup storage beyond the free allocation, licence benefit and serverless auto-pause. |
| Application Gateway | Application Gateways | estimated | $294 | 2 lines
WAF v2 SKU; autoscale capacity units assumed constant. |
| VM scale set | VM Scale Sets | estimated | $140 | 1 line
Linux pay-as-you-go compute only; excludes OS and data disks, public IPs, networking and Windows/SQL licences. |
| VM scale set | VM Scale Sets | estimated | $140 | 1 line
Linux pay-as-you-go compute only; excludes OS and data disks, public IPs, networking and Windows/SQL licences. |
| Azure Monitor | Monitor | estimated | $127 | 1 line
Pay-as-you-go ingestion with the monthly free allowance in the tier; commitment tiers are not modelled. |
| Azure Front Door | Front Door and CDN Profiles | estimated | $126 | 4 lines
Zone 1 (North America and Europe) rates; other zones cost more. Routing-rule overage and WAF custom rules are not modelled. |
| Azure Storage | Storage Accounts | estimated | $6.66 | 3 lines
Excludes data retrieval and early-deletion charges, egress and transactions on other APIs. |
| Azure Key Vault | Key Vaults | estimated | $6.00 | 1 line
Standard tier software-protected keys; HSM keys and certificates are not modelled. |
Not priced
- Web Application Firewall — no-charge: Web Application Firewall Policies(WAF) has no direct charge.
- Azure SQL Database — override: Replica is included in the Business Critical price.
Assumptions 9 defaulted — replace them with your own numbers in each node's usage
| Component | Assumption | Value | Source |
|---|---|---|---|
| Azure Front Door | tier | standard | from spec |
| Azure Front Door | egressGbPerMonth | 500 | from spec |
| Azure Front Door | requestsPerMonth | 20000000 | from spec |
| Azure Storage | accessTier | hot | assumed |
| Azure Storage | redundancy | LRS | assumed |
| Azure Storage | storageGb | 200 | from spec |
| Azure Storage | writeOperationsPerMonth | 100000 | assumed |
| Azure Storage | readOperationsPerMonth | 5000000 | from spec |
| Application Gateway | waf | true | from spec |
| Application Gateway | avgCapacityUnits | 3 | from spec |
| VM scale set | vmSize | Standard_D2s_v5 | from spec |
| VM scale set | count | 2 | from spec |
| VM scale set | hoursPerMonth | 730 | assumed |
| Azure SQL Database | tier | business-critical | from spec |
| Azure SQL Database | vcores | 4 | from spec |
| Azure SQL Database | zoneRedundant | false | assumed |
| Azure SQL Database | storageGb | 250 | from spec |
| Azure SQL Database | hoursPerMonth | 730 | assumed |
| VM scale set | vmSize | Standard_D2s_v5 | from spec |
| VM scale set | count | 2 | from spec |
| VM scale set | hoursPerMonth | 730 | assumed |
| Azure Monitor | ingestGbPerMonth | 60 | from spec |
| Azure Monitor | retentionDays | 31 | assumed |
| Azure Monitor | retainedGb | 10 | assumed |
| Azure Key Vault | operationsPerMonth | 2000000 | from spec |
Sensitivity & what-if
$1,792at 1× traffic
$2,416at 3× traffic
$4,603at 10× traffic
No what-if options apply to these services.
Price list provenance
Retrieved 2026-10-02T10:01:47.868Z from the public Azure Retail Prices API. Latest price effective dates per service:
Bandwidth 2022-05-01 · Azure Front Door Service 2026-05-01 · Storage 2026-09-01 · Application Gateway 2025-12-01 · Virtual Machines 2026-10-01 · SQL Database 2025-10-01 · Log Analytics 2018-02-01 · Key Vault 2022-03-01
Only public pay-as-you-go list prices are used. This is not a quote — confirm in the Azure Pricing Calculator.
Well-Architected review Highly available three-tier web application · 2026-10-02 · mode full
Coverage audit
- Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
- Assessed 59 recommendations: 17 with diagram evidence, 42 cannot be determined.
- Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
- Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.
Executive summary
This Azure Well-Architected Framework review of Highly available three-tier web application (standard criticality) assessed the architecture diagram only. 17 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. No risks are evidenced. Estimated run cost is $1,792/month (indicative).
0Critical
0High
0Medium
0Low
4.7provisional maturity (1–5)
17 of 59 recommendations have diagram evidence (29%); among those, 13 implemented, 4 partial, 0 not implemented. Provisional: scores cover evidenced practices only.
Strengths. Edge protection present; Data stores are not placed in public subnets; Key management shown; Secrets / passwordless access shown; Workload spans multiple availability zones; Backup / recovery shown; Observability shown; Edge delivery shown.
Architecture overview
The reviewed architecture is the Diagram tab (11 components, architecture diagram). Hover a finding to highlight the components involved.
Pillar scorecard
| Pillar | Score (1–5) | Evidenced recommendations | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Reliability | 5.0 | 3/10 (30%) | 3 0 0 0 7 | Workload spans multiple availability zones | No gaps evidenced in the diagram |
| Security | 4.0 | 6/12 (50%) | 3 3 0 0 6 | Edge protection present | No gaps evidenced in the diagram |
| Cost Optimization | — | 2/14 (14.3%) | 1 1 0 0 12 | Design-time cost model | No gaps evidenced in the diagram |
| Operational Excellence | — | 1/11 (9.1%) | 1 0 0 0 10 | Observability shown | No gaps evidenced in the diagram |
| Performance Efficiency | 5.0 | 5/12 (41.7%) | 5 0 0 0 7 | Edge delivery shown | No gaps evidenced in the diagram |
Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.
Recommendation ledger 59 recommendations — nothing truncated
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| RE:01 | Reliability | Focus your workload design on simplicity and efficiency. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:02 | Reliability | Identify and rate user and system flows. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:03 | Reliability | Use failure mode analysis (FMA) to identify potential failures in your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:04 | Reliability | Define reliability and recovery targets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:05 | Reliability | Add redundancy at different levels, especially for critical flows | Implemented | Diagram: Workload spans multiple availability zones. Deploy zone-redundant: spread compute across at least two availability zones and use zone-redundant tiers for databases, storage and gateways. No on-premises or private-link connectivity is drawn. |
| RE:06 | Reliability | Implement a timely and reliable scaling strategy at the application, data, and infrastructure levels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:07 | Reliability | Strengthen the resiliency of your workload by implementing self-preservation and self-healing measures | Cannot Determine | Diagram: No queue / event service shown between tiers. Decouple components with Azure Service Bus, Event Grid or Event Hubs so spikes and downstream failures do not cascade; add retries with backoff, timeouts and circuit breakers. |
| RE:08 | Reliability | Test for resiliency and availability scenarios by applying the principles of chaos engineering. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| RE:09 | Reliability | Implement structured, tested, and documented disaster recovery (DR) plans | Implemented | Diagram: Backup / recovery shown. Define RPO/RTO and protect data with Azure Backup, point-in-time restore, geo-replication or Site Recovery, and test restores. |
| RE:10 | Reliability | Continuously measure and track system health using uptime and reliability indicators | Implemented | Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:01 | Security | Establish a security baseline | Cannot Determine | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. |
| SE:02 | Security | Align secure development lifecycle (SDL) throughout the software development lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:03 | Security | Classify and consistently apply sensitivity and information type labels | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:04 | Security | Create intentional segmentation and perimeters | Partially Implemented | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. Diagram shows 4 subnets; whether the segments follow trust boundaries is not observable. |
| SE:05 | Security | Implement strict, conditional, and auditable identity and access management (IAM) | Cannot Determine | Diagram: No identity / authentication service shown. Authenticate and authorize every request with Microsoft Entra ID (conditional access, RBAC) and use managed identities instead of stored credentials. |
| SE:06 | Security | Isolate, filter, and control network traffic | Partially Implemented | Diagram: Edge protection present. Nodes: waf. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. |
| SE:07 | Security | Encrypt data by using modern, industry-standard methods | Implemented | Diagram: Key management shown. Nodes: kv. Encrypt data at rest and in transit; use Azure Key Vault customer-managed keys where you need key rotation, access policy or audit control. |
| SE:08 | Security | Harden all workload components | Implemented | Diagram: Edge protection present. Nodes: waf. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. |
| SE:09 | Security | Protect application secrets | Implemented | Diagram: Secrets / passwordless access shown. Nodes: kv. Store secrets in Azure Key Vault or, better, connect with managed identities and Entra authentication so no credentials are embedded. |
| SE:10 | Security | Implement a holistic monitoring strategy | Partially Implemented | Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| SE:11 | Security | Establish a comprehensive testing regimen | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SE:12 | Security | Define and test effective incident response procedures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| CO:01 | Cost Optimization | Create a culture of financial responsibility. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:02 | Cost Optimization | Create and maintain a cost model. | Implemented | A design-time cost model was generated from the Azure Retail Prices API: 9 of 9 billable components priced, $1,791.52/month pay-as-you-go (indicative; volumes partly assumed). |
| CO:03 | Cost Optimization | Collect and review cost data. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:04 | Cost Optimization | Set spending guardrails. | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners. |
| CO:05 | Cost Optimization | Get the best rates from providers. | Cannot Determine | Compute and database capacity is $1,512.09/month at pay-as-you-go rates (84% of the estimate); whether Reservations or Savings Plans apply is not shown. Evaluate with Azure Advisor recommendations after 30+ days of steady usage. |
| CO:06 | Cost Optimization | Align usage to billing increments. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:07 | Cost Optimization | Optimize component costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:08 | Cost Optimization | Optimize environment costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:09 | Cost Optimization | Optimize flow costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:10 | Cost Optimization | Optimize data costs. | Partially Implemented | Data transfer out is modelled for at least one component. |
| CO:11 | Cost Optimization | Optimize code costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:12 | Cost Optimization | Optimize scaling costs. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:13 | Cost Optimization | Optimize personnel time. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| CO:14 | Cost Optimization | Consolidate resources and responsibility. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:01 | Operational Excellence | Define your standard practices to develop and operate your workload. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:02 | Operational Excellence | Use standardization as a way to make routine, ad-hoc, and emergency operations consistent and predictable. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:03 | Operational Excellence | Formalize processes across the full software development lifecycle, from ideation to delivery, and make them transparent to the team and stakeholders. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:04 | Operational Excellence | Enhance software development and quality assurance | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:05 | Operational Excellence | Use a standardized infrastructure as code (IaC) approach to prepare resources and configurations. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| OE:06 | Operational Excellence | Build a workload supply chain that drives changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:07 | Operational Excellence | Design a monitoring stack | Implemented | Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| OE:08 | Operational Excellence | Establish a clear, structured incident management process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OE:09 | Operational Excellence | Enhance the quality of your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:10 | Operational Excellence | Design automation to be reliable, secure, and maintainable | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OE:11 | Operational Excellence | Clearly define your workload's safe deployment practices. | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices. |
| PE:01 | Performance Efficiency | Define performance targets. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:02 | Performance Efficiency | Conduct capacity planning. | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PE:03 | Performance Efficiency | Select the right services. | Implemented | Diagram: Edge delivery shown. Nodes: fd. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:04 | Performance Efficiency | Establish consistent performance measurement | Implemented | Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. |
| PE:05 | Performance Efficiency | Optimize scaling and partitioning. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:06 | Performance Efficiency | Optimize your workload's performance by regularly testing in a production-like environment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:07 | Performance Efficiency | Optimize code and infrastructure. | Implemented | Diagram: Caching shown. Add caching (Azure Managed Redis, CDN) or read replicas for read-heavy access, and choose the data store that fits the access pattern. |
| PE:08 | Performance Efficiency | Optimize data usage. | Implemented | Diagram: Caching shown. Add caching (Azure Managed Redis, CDN) or read replicas for read-heavy access, and choose the data store that fits the access pattern. |
| PE:09 | Performance Efficiency | Prioritize the performance of critical flows. | Implemented | Diagram: Edge delivery shown. Nodes: fd. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. |
| PE:10 | Performance Efficiency | Optimize operational tasks. | Cannot Determine | Diagram: No queue / event service shown between tiers. Decouple components with Azure Service Bus, Event Grid or Event Hubs so spikes and downstream failures do not cascade; add retries with backoff, timeouts and circuit breakers. |
| PE:11 | Performance Efficiency | Respond to live performance issues. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PE:12 | Performance Efficiency | Continuously optimize performance. | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
Findings
No gaps are evidenced in the diagram. That is not a clean bill of health: see the coverage audit for what could not be determined.
To confirm not drawn, so not counted as gaps
- No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
- No identity / authentication service shown SE:05 — Authenticate and authorize every request through Microsoft Entra ID with conditional access, MFA and least-privilege RBAC; use managed identities for workload-to-workload access.
- No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
- No queue / event service shown between tiers RE:07, PE:10 — Decouple tiers with Azure Service Bus, Event Grid or Event Hubs so traffic spikes and downstream failures do not cascade; add retries with backoff, timeouts and circuit breakers.
- No infrastructure-as-code or CI/CD shown OE:05, OE:11 — Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline with small, reversible changes, environment promotion and automated rollback.
- No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.
Cross-pillar trade-offs
- Observability volume Operational Excellence ↔ Cost Optimization
Log Analytics is $126.50/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per table (Basic logs for high-volume, low-value data) and keep full-fidelity logs for security and audit sources only.
Eisenhower prioritization
Do First
None
Plan
None
Delegate
None
Defer
None
Next steps
- Add the missing process, configuration and runtime evidence to turn Cannot Determine practices into assessed ones.
- Re-run the review after changes, and when the architecture or documentation changes.
Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).