Azure CAF hub-spoke architecture with centralized security, identity, and connectivity across multiple application subscriptions. The hub VNet (10.0.0.0/16) hosts Azure Firewall, Application Gateway, VPN Gateway, and ExpressRoute for hybrid connectivity, while identity services via Entra ID and Azure AD B2C enforce zero-trust access. Spoke VNets (App1 10.1.0.0/16, App2 10.2.0.0/16) isolate workloads with three-tier subnets, load balancers, and Azure SQL databases, all monitored by Log Analytics and Microsoft Sentinel. This topology implements Azure Cloud Adoption Framework best practices for governance, security, and scalability across enterprise environments. Fork this diagram on Diagrams.so to customize subscriptions, IP ranges, or add additional spokes for your organization's growth.