Azure Public-Private VNet Peering Architecture implements a secure two-tier network design with public and private virtual networks (10.0.0.0/16 and 10.1.0.0/16) connected via VNet peering. External users and partner networks route through Application Gateway WAF in the public VNet, which forwards traffic to App Service instances in the app subnet, while outbound traffic flows through a NAT Gateway for egress control. The private VNet isolates Azure SQL databases (primary and standby replicas) behind NSGs and route tables, with ExpressRoute Gateway enabling on-premises connectivity. This architecture enforces network segmentation, least-privilege access, and high availability across presentation, application, and data tiers. Fork this diagram on Diagrams.so to customize subnets, NSG rules, or add additional peered networks for your organization. The design demonstrates Azure best practices for hybrid connectivity and defense-in-depth security postures.