TopolearnReal outages hit zones, regions and dependencies; resilience must be designed, configured and rehearsed.
Start with targets per workload: RTO (how long you may be down) and RPO (how much data you may lose). They decide the design and the cost.
Layers of protection:
- Zone redundancy first: zone-redundant App Service plans, Container Apps environments, AKS node pools across zones, ZRS/GZRS storage, zone-redundant SQL and Cosmos DB, Standard load balancers and gateways. This covers datacenter failures with RPO near zero and no failover logic.
- Multi-region for regional outages: active-passive (warm standby, lower cost, RTO minutes) or active-active (both serve traffic, highest cost and complexity). Front Door or Traffic Manager routes users; data replicates asynchronously: SQL failover groups, Cosmos DB multi-region with service-managed failover, GZRS storage, geo-replicated Container Registry and Key Vault per region.
The traps experts plan for:
- Asynchronous replication means RPO is greater than zero; know your replication lag.
- Capacity: the secondary region may lack quota or VM capacity during a regional event. Pre-provision or use capacity reservations.
- Hidden single-region dependencies: a hub firewall, private DNS zones, a CI/CD pipeline, a secrets vault, or a third-party API.
- Untested failover doesn't work. Rehearse with planned failovers and Azure Chaos Studio experiments, and practice failback.
Use the Well-Architected Reliability pillar and the per-service reliability guides as the checklist.
Example
# SQL: failover group with a stable listener name across regions
az sql failover-group create -g rg-data --name fg-orders \
--server sql-orders-weu --partner-server sql-orders-neu \
--add-db ordersdb --failover-policy Automatic --grace-period 1
# App connects to: fg-orders.database.windows.net (follows the primary)
# Cosmos DB: zone-redundant in two regions with service-managed failover
az cosmosdb update -g rg-data -n cosmos-orders \
--locations regionName=westeurope failoverPriority=0 isZoneRedundant=true \
--locations regionName=northeurope failoverPriority=1 isZoneRedundant=true
az cosmosdb update -g rg-data -n cosmos-orders --enable-automatic-failover true
# Rehearse: planned failover of the SQL group to the secondary
az sql failover-group set-primary -g rg-data --server sql-orders-neu --name fg-ordersRemember
- Define RTO and RPO first; they drive cost and design
- Zone redundancy is the cheap first layer; regions handle regional outages
- Replication across regions is asynchronous: RPO is not zero
- Find single-region dependencies and rehearse failover and failback
Watch out for
- Building a passive region but never testing it, then discovering missing quota, secrets or DNS during the outage.