About This Architecture

Enterprise Azure hub-spoke-hub topology for the AI Citadel Governance Hub, featuring Azure Firewall Premium, API Management, and AI Foundry with environment-specific SKU configurations. Traffic flows from workload agents through the firewall to APIM, then to AI safety/PII services and Azure OpenAI Foundry via private endpoints, with all diagnostics routed to Log Analytics and Sentinel. This architecture demonstrates zero-trust principles, private endpoint enforcement, and centralized governance across development, test, and production environments. Fork this diagram on Diagrams.so to customize DNS zones, firewall rules, or add your own workload spokes. The design leverages Bicep infrastructure-as-code and Entra ID for identity management across all tiers.

People also ask

How do I design a secure hub-spoke Azure network for enterprise AI deployments with API Management and private endpoints?

This diagram shows a hub-spoke-hub topology where a shared hub VNet hosts Azure Firewall Premium, APIM, and Private DNS Resolver, with development, test, and production spokes connected via VNet peering. Workload agents route through the firewall to APIM, which enforces AI safety and PII checks before forwarding to Azure OpenAI Foundry via private endpoints, with all traffic logged to Log Analytic