The identity plane is global, Microsoft-operated and outside every VNet. A regional Azure outage stops our APIs while authentication keeps working, which is why the recovery runbook restores gateways and workloads rather than identity.
API Management runs in internal VNet mode behind Front Door, so the gateway has no public IP and the only ingress is the WAF.
Every data service is reached over a private endpoint with Entra authentication. There are no firewall allowlists standing in for identity, and no SQL logins.
Administrative access is via Bastion from a privileged workstation, gated by PIM. No management port is exposed to the internet anywhere in the estate.
Resilience targets
North Europe is a warm standby with the same gateway configuration and an AKS cluster scaled to zero. RTO 4 hours, RPO 15 minutes for platform configuration held in Git.
Key Vault is regional: the standby vault is restored from backup rather than replicated, which is a documented 40-minute step in the runbook.
The evidence archive is geo-redundant and immutable, so the audit trail survives the loss of the primary region.
Assumptions
EU data residency for directory data and logs. Confirm per client; it changes tenant configuration and Log Analytics placement.
Two AD forests with outbound-only sync agents. No inbound firewall rule exists for identity, and none should be added.
Active-active across regions was rejected on cost: identity is not the availability constraint, the applications are, and they are the ones that would need it.
