File Upload & Scanning Pipeline  ·  View 17 of 21  ·  Operations

Deployment Architecture

Two regions inside one residency boundary, and the arrow that is deliberately absent.

Editable source SVG draw.io All views
Residency boundary — tenant's declared geography Primary region — active Zone-redundant control Control services Container Apps, 3 zones Metadata Cosmos, strong, zone-redundant Scan capacity Interactive workers reserved Bulk workers spot / interruptible Storage Untrusted ZRS Serving ZRS + GRS Secondary region — warm, same geography Control, scaled to zero Control services RTO 15 min Metadata replica ≤ 60 s lag Scan, on demand Workers RTO 60 min Storage replica Serving replica read-access GRS Verdict replica no re-scan on failover Other residency boundaries Independent stacks Boundary B same shape, no arrow to A Boundary C same shape, no arrow to A Front Door global, routes within boundary Entra ID global identity Signature feed pulled per boundary GRS, async ≤ 60 s Deployment — Two Regions Inside One Residency Boundary Application we own Data store Security / platform Interface / broker External / third party event / async The absent arrow is the design: nothing replicates between residency boundaries, so a failover can never move an object's bytes out of the geography its tenant declared. Verdicts replicate with the bytes — a failover that re-scanned 12 PB would not be a failover. v 1.0 · rto 15 min read path, 60 min scan

The absent arrow

  • Nothing replicates between residency boundaries. A failover can therefore never move an object's bytes out of the geography its tenant declared.
  • Each boundary is the same shape, deployed independently, and scanning never transfers bytes outside it — including to a cheaper region with spare capacity
  • A boundary enforced only by correct configuration is a boundary crossed by accident, so it is enforced by there being no replication relationship to misconfigure

Decisions

  • Verdicts replicate with the bytes: a failover that re-scanned 12 PB would not be a failover
  • Interactive scan capacity is reserved; bulk-lane capacity is interruptible, which is where the cost model earns its margin
  • The secondary region runs control scaled to zero — RTO 15 minutes for the read path, 60 minutes for full scan capacity

Stated assumptions

  • Zone-redundant storage in region, geo-redundant within the boundary
  • Metadata replica lag ≤ 60 s; RPO 0 for finalised bytes, metadata and verdicts
  • Three residency boundaries assumed
◀  Download Path All views Observability  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1017-deployment