Active-passive disaster recovery landing zone spanning Azure West US and East US with SQL Managed Instance failover groups, Azure Site Recovery replication, and near-zero data loss protection for mission-critical SQL estates. Traffic flows from on-premises and partner sites through Azure Firewall Premium in the hub VNet, routing to production spoke VNets hosting SQL Server 2019, file servers, legacy SQL 2012 instances, and SSIS workloads with private endpoints for storage and Key Vault. The passive East US region maintains async secondary SQL Managed Instances, ASR replica targets for compute workloads, and warm standby infrastructure orchestrated by Recovery Services Vaults with geo-redundant storage and immutable backups. This architecture demonstrates Azure's native DR capabilities including auto-failover groups, cross-region replication, and centralized monitoring via Azure Monitor and Microsoft Defender for Cloud with Entra ID MFA enforcement. Fork this diagram on Diagrams.so to customize spoke VNet ranges, adjust failover group policies, or integrate additional Azure services like Azure Site Recovery for non-SQL workloads. The design prioritizes RPO near-zero for databases while maintaining cost efficiency through warm standby compute in the DR region.