Hub-spoke network topology connecting two on-premises datacenters to Azure via VPN Gateway, with DMZ, Bastion, and managed security services in the hub. Traffic flows from remote users through Edge Firewall and VPN Concentrator into the on-prem core layer, then across WAN to Azure Hub VNet housing Azure Firewall, WAF, and DDoS Protection. Spoke VNets isolate IaaS compute (VMs, VM Scale Sets) and PaaS services (SQL Database, Cosmos DB, Storage) with Entra ID, Defender for Cloud, and Sentinel providing identity and security monitoring. This architecture enforces zero-trust principles, centralizes threat detection, and enables seamless hybrid workload management across on-prem DC1, DC2, and Azure. Fork this diagram to customize subnets, add ExpressRoute, or adjust NSG rules for your compliance requirements.