Skill: Azure Architecture Patterns

Well-Architected Framework principles, reference architectures, and best practices for cloud-native solutions.

Metadata

Overview

Azure architecture is about trade-offs, not perfection. This skill provides structured guidance for designing, evaluating, and optimizing Azure solutions using the Well-Architected Framework (WAF) pillars.

The Five Pillars

Module 1: Reliability Patterns

Design Principles

1. •Design for failure - Assume components will fail
2. •Observe health - Know when something is wrong
3. •Drive automation - Reduce human error
4. •Design for self-healing - Automatic recovery
5. •Design for scale-out - Horizontal over vertical

Key Patterns

Circuit Breaker

Prevent cascading failures by failing fast when a downstream service is unhealthy.

// Polly implementation
var circuitBreakerPolicy = Policy
    .Handle<HttpRequestException>()
    .CircuitBreakerAsync(
        exceptionsAllowedBeforeBreaking: 3,
        durationOfBreak: TimeSpan.FromSeconds(30)
    );

Retry with Exponential Backoff

Handle transient failures with increasing delays.

var retryPolicy = Policy
    .Handle<HttpRequestException>()
    .WaitAndRetryAsync(3, retryAttempt => 
        TimeSpan.FromSeconds(Math.Pow(2, retryAttempt)));

Availability Zones

Distribute resources across physically separate datacenters.

Reliability Checklist

• • Single points of failure identified and mitigated
• • Health endpoints implemented (/health, /ready)
• • Retry policies with backoff configured
• • Circuit breakers for external dependencies
• • Availability zones utilized (where supported)
• • Disaster recovery plan documented
• • RTO/RPO defined and tested

Module 2: Security Patterns

Zero Trust Principles

Identity Patterns

Managed Identity

Eliminate credential management with Azure AD-backed identity.

{
  "type": "Microsoft.Web/sites",
  "identity": {
    "type": "SystemAssigned"
  }
}

Use cases:

• •App Service → Key Vault secrets
• •Azure Functions → Storage access
• •VMs → Database connections

RBAC Best Practices

Network Security

Private Endpoints

Keep traffic on Azure backbone, off public internet.

resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-05-01' = {
  name: 'pe-storage'
  properties: {
    subnet: { id: subnetId }
    privateLinkServiceConnections: [{
      name: 'plsc-storage'
      properties: {
        privateLinkServiceId: storageAccountId
        groupIds: ['blob']
      }
    }]
  }
}

Network Security Groups (NSG)

Default deny, explicit allow.

Security Checklist

• • Managed identities used (no stored credentials)
• • Key Vault for secrets/certificates
• • Private endpoints for PaaS services
• • NSG/firewall rules explicit deny-by-default
• • TLS 1.2+ enforced
• • Microsoft Defender for Cloud enabled
• • Diagnostic settings → Log Analytics

Module 3: Cost Optimization Patterns

Design for Cost

Cost-Aware Architecture

Compute Selection Matrix

Storage Tiers

Lifecycle management: Auto-tier blobs based on last access.

Cost Monitoring

// Azure Resource Graph - find expensive resources
resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| extend vmSize = properties.hardwareProfile.vmSize
| project name, resourceGroup, vmSize, location
| order by vmSize desc

Cost Checklist

• • Azure Advisor recommendations reviewed
• • Reserved Instances for predictable workloads
• • Auto-shutdown for non-prod
• • Right-sized based on actual utilization
• • Storage lifecycle policies configured
• • Cost alerts and budgets set
• • Orphaned resources cleaned up

Module 4: Operational Excellence Patterns

Infrastructure as Code

Bicep Best Practices

// Use parameters with descriptions and constraints
@description('The environment name')
@allowed(['dev', 'staging', 'prod'])
param environment string

// Use variables for derived values
var resourcePrefix = 'app-${environment}'

// Use modules for reusability
module storage 'modules/storage.bicep' = {
  name: 'storage-${environment}'
  params: {
    prefix: resourcePrefix
    location: location
  }
}

Observability Stack

Essential Diagnostic Settings

resource diagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  scope: appService
  name: 'diag-appservice'
  properties: {
    workspaceId: logAnalyticsId
    logs: [
      { category: 'AppServiceHTTPLogs', enabled: true }
      { category: 'AppServiceConsoleLogs', enabled: true }
    ]
    metrics: [
      { category: 'AllMetrics', enabled: true }
    ]
  }
}

Operational Checklist

• • IaC for all resources (Bicep/Terraform)
• • CI/CD pipelines for deployment
• • Diagnostic settings to Log Analytics
• • Application Insights integrated
• • Alerts for critical metrics
• • Runbooks for common operations
• • Chaos engineering tests scheduled

Module 5: Performance Efficiency Patterns

Scalability Patterns

Horizontal Scaling (Scale Out)

Add more instances, not bigger instances.

Caching Strategy

Performance Patterns

CQRS (Command Query Responsibility Segregation)

Separate read and write models for optimization.

Write Path: Web App → Cosmos DB (write-optimized)
                 ↓ Change Feed
Read Path: Azure Search ← Cosmos DB (indexed, query-optimized)

Event Sourcing

Store events, not state. Rebuild state from event stream.

Benefits:

• •Complete audit trail
• •Temporal queries
• •Easy scaling

Database Performance

Performance Checklist

• • Autoscaling configured and tested
• • CDN for static content
• • Redis cache for hot data
• • Database indexes reviewed
• • Connection pooling enabled
• • Load testing completed
• • Performance baselines established

Reference Architectures

Web Application (Standard)

Internet → Front Door (CDN, WAF) → App Service
                                    ↓
                              Azure SQL + Redis Cache
                                    ↓
                              Key Vault, Storage

Microservices (Azure Kubernetes Service)

Internet → API Management → AKS Ingress
                              ↓
                        Service Mesh (pods)
                              ↓
                        Cosmos DB, Service Bus
                              ↓
                        Azure Monitor, Key Vault

Serverless (Event-Driven)

Event Sources → Event Grid → Azure Functions
                                   ↓
                              Cosmos DB, Storage
                                   ↓
                              Logic Apps (orchestration)

Quick Reference

SKU Selection Guide

Common Anti-Patterns

Module 6: MCP Tool Integration

Required Extensions & MCP Servers

Installation:

# VS Code Extensions
code --install-extension ms-azuretools.vscode-azure-github-copilot
code --install-extension ms-azuretools.vscode-azureresourcegroups
code --install-extension ms-vscode.azure-account

# MCP Server (via VS Code settings.json or mcp.json)
# Enabled via chat.mcp.gallery.enabled = true

Fallback Patterns (When MCP Unavailable)

If Azure MCP tools are not available, use these alternatives:

Manual Architecture Design Process:

1. •Review WAF pillars checklist in Module 1-5
2. •Use Azure Architecture Center reference architectures
3. •Validate with Azure Advisor in portal
4. •Apply patterns from this skill's modules

Available Azure MCP Tools

Alex has access to 40+ Azure MCP tools for real-time architecture assistance:

Cloud Architect Tool

The mcp_azure_mcp_cloudarchitect tool provides interactive guided architecture design:

Invocation → Ask about user/company → 
  Gather requirements → 
    Build architecture by tier → 
      Present with ASCII diagrams

Architecture Tiers:
├── Infrastructure (VNets, VMs, Load Balancers)
├── Platform (App Service, AKS, Functions)
├── Application (Logic Apps, API Management)
├── Data (SQL, Cosmos, Storage)
├── Security (Key Vault, WAF, DDoS)
└── Operations (Monitor, Log Analytics)

The tool tracks:

• •Explicit requirements — Directly stated by user
• •Implicit requirements — Inferred from context
• •Assumed requirements — Industry/domain defaults

Best Practices Tool

Use mcp_azure_mcp_get_bestpractices with these resource/action combinations:

When to Use MCP Tools

Example: Interactive Architecture Session

User: "Design a solution for a retail e-commerce platform"

Alex invokes: mcp_azure_mcp_cloudarchitect with:
  - intent: "Design e-commerce architecture"
  - nextQuestionNeeded: true
  - state: {initial}

Tool asks: "What's your role and company size?"
User: "CTO of a mid-size retailer"

Tool continues gathering:
  - Expected traffic patterns
  - Data residency requirements  
  - Budget constraints
  - Compliance needs (PCI-DSS for payments)

Tool outputs:
  - Component table with SKU recommendations
  - ASCII architecture diagram
  - WAF pillar alignment
  - Cost estimation

Activation Patterns

Skill updated: 2026-02-14 | Category: Cloud/Infrastructure | Status: Active | MCP-Enhanced: Yes

Synapses

• •[.github/skills/observability/SKILL.md] (High, Enables, Bidirectional) - "Monitoring and observability patterns"
• •[.github/skills/project-scaffolding/SKILL.md] (Medium, Uses, Forward) - "Infrastructure-as-code project setup"
• •[.github/instructions/empirical-validation.instructions.md] (Medium, Validates, Forward) - "Architecture decisions require evidence"