AI Executive Office — CXO Assistant Platform  ·  View 21 of 30  ·  6 · Operations

Deployment Topology

Where it runs, what the failure domains are, and why a second region is a tier option rather than a default.

Editable source SVG draw.io All views
Azure — Meridia Central (primary, in country) Application tier — zone redundant across 3 zones Front Door Premium global · anycast APIM Premium zone redundant Container Apps 3–30 replicas Durable Functions EP1 · zone redundant AI tier Azure OpenAI PTU + overflow AI Search 3 replicas · 3 partitions Azure ML endpoints 2 nodes minimum Data tier Azure SQL Business Critical · ZR Fabric capacity F64 · OneLake ZRS Cosmos DB zone redundant Redis Enterprise zone redundant Evidence blob ZRS · immutable Hub network Azure Firewall Premium egress control Private DNS zones all PaaS Bastion no public admin ExpressRoute to the ministry Secondary region — only where the tenant's tier permits it SQL geo-replica RPO 5 min Evidence GZRS paired region Redeploy from Bicep RTO 4 h · cold Sovereign tenants: no second region RTO is a restore, in country Ministry data centre ExpressRoute Microsoft 365 tenant home region Model availability in region is the binding constraint confirm SKUs before contract private geo-replication Deployment Topology — Regions and Failure Domains Interface / broker Application we own Data store Security / platform Risk / gap External / third party synchronous event / async Availability is bought inside one region with zones. Cross-region failover is a tier option, because for a sovereign tenant a second region may be a contract breach rather than a resilience feature. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Availability is bought inside one region using availability zones. For a sovereign tenant, a second region may be a contract breach rather than a resilience feature, so cross-region failover is opt-in per tenant
  • Where there is no second region, recovery is a restore in country: infrastructure redeployed from Bicep, data restored from in-region backups. RTO is measured in hours and is stated in the contract rather than implied
  • No public endpoint on any data or AI service. Private endpoints with private DNS throughout, administrative access through Bastion with just-in-time elevation

Numbers

  • Platform availability target 99.9% monthly, measured on the ability to answer a KPI question — not on resource health
  • Zone failure: no data loss, degraded capacity. Region loss with the DR option: RPO 5 minutes, RTO 4 hours, cold
  • Region loss without it: RTO governed by restore time, target 8 hours, tested quarterly

The open risk

  • Model and service SKU availability in the target sovereign region is the binding constraint on this entire design, and it changes. It must be verified against the region's current service list before contract, not assumed from this diagram — see the decision record for the three fallbacks
◀  Governed Execution All views Delivery — Code and Configuration  ▶
Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0921-deployment-topology