Power Platform VNet injection across Azure paired regions (Australia East and Australia Southeast) with delegated subnets, private endpoints, and Entra ID integration. Traffic flows through dedicated Power Platform injection subnets, Function App VNet-integrated subnets, and private endpoint subnets for Storage, Key Vault, and Function Apps, with all DNS resolution routed through Private DNS Zones linked to both VNets. Network Security Groups enforce allow-list policies for cross-subnet and cross-region traffic, while Managed Identity provides zero-secret authentication between Function Apps and backend services. This architecture eliminates public IP exposure, enforces least-privilege network access, and ensures compliance-ready isolation for enterprise Power Platform workloads. Fork this diagram on Diagrams.so to customize subnet ranges, add hub-spoke peering, or extend to additional Azure regions.