URL Shortener & Link Management Service  ·  View 01 of 23  ·  Context and scope

System Context

Everyone who touches the platform, and the asymmetry that shapes everything: one actor arrives 150,000 times a second and has no identity at all.

Editable source SVG draw.io All views
People who own links Campaign owner 40k tenants Customer developer bulk API Trust and safety analyst People who click Link clicker 150k redirects/s Chat unfurler preview bots Mail and security scanner not a human click Systems it depends on Microsoft Entra ID tenant admin sign-in URL reputation feeds malware, phishing Azure DNS and managed TLS 12k branded domains Customer destination site never fetched, only named Link Management Platform short code in, redirect out Downstream consumers Customer BI and CRM click export Billing metered redirects GET /{code} prefetch scan creates links bulk API blocks links OIDC verdicts certificates Link Platform — System Context Person or role External / third party Security / platform synchronous Out of scope: campaign management, email sending, and anything about the destination page itself — the platform names a location and steps out of the way. v 1.0 · owner Platform Architecture · date 2026-09

The boundary

  • In: code allocation, resolution, the redirect path, link lifecycle, branded domains, click analytics, abuse response.
  • Out: campaign management, email sending, and the destination page — the platform names a location and never fetches, renders or proxies it.
  • The clicker is unauthenticated by design and must never need an account; every other actor is scoped to exactly one tenant.

Why these dependencies

  • Reputation feeds are a hard dependency of creation, not a nicety: a link platform that does not screen destinations becomes free phishing infrastructure within weeks.
  • Azure DNS and managed certificates are in scope because 12,000 branded domains make certificate renewal an availability risk owned by the platform, not the customer.
  • Billing consumes metered redirects with bots split out, which is why bot classification is an architectural requirement rather than a reporting nicety.

Assumptions

  • 40,000 tenants, 12,000 branded domains, 12 billion stored links, 1.2 million created per day.
  • 150,000 redirects/s steady, 600,000/s peak for 5 minutes, read-to-write ratio 500:1.
  • All figures are the requirement's stated assumptions for a mid-size commercial link platform, to be replaced by telemetry before build.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records01-system-context