Azure architecture template
Azure 3-tier web app
Edge -> application -> data tier inside a VNet: Application Gateway, App Service, SQL Database and Blob Storage.
Free to start. Updated .
When to use it
Use this template for a conventional web application or API on Azure where one team owns the whole stack and the traffic pattern is request and response. Application Gateway terminates TLS and applies Web Application Firewall rules at the edge, App Service runs the web and API code without you managing virtual machines, Azure SQL Database holds relational data, and Blob Storage keeps uploads and static assets out of the database.
The main trade-off is simplicity against isolation. App Service needs VNet integration and private endpoints for the database and storage account before traffic really stays inside the network, and both cost extra. If you serve users in several regions, swap Application Gateway for Front Door. If the app is mostly static content, a CDN in front of Blob Storage is cheaper than scaling out App Service instances.
What's in this template
Application GatewayWeb traffic load balancer / WAF (edge tier)
App ServiceWeb apps and APIs (application tier)
SQL DatabaseManaged relational database (data tier)
Blob StorageObject storage for static assets and uploads
How it connects
- Application Gateway → App Service (network): HTTPS
- App Service → SQL Database (data): SQL
- App Service → Blob Storage (data): Blob I/O
More Azure templates
Azure landing zone (starter)
Starter platform landing zone: management-group scope with identity, hub networking, secrets and centralised logging.
Azure hub-spoke network
Hub VNet with VPN Gateway, Azure Firewall and Bastion, peered to two workload spokes, with on-premises connectivity.
Azure AKS baseline cluster
Private AKS cluster behind Application Gateway WAF, with egress through Azure Firewall, Container Registry and Key Vault.
Make it your own
Open a copy in the editor, then rename, rearrange and extend it.