Secure App Service architecture with Entra ID authentication and private SQL connectivity via managed identities and private endpoints. Internet traffic flows through WAF Policy and Application Gateway to a Python App Service in a dedicated subnet, which authenticates via Managed Identity to Entra ID and connects to Azure SQL Database through a Private Endpoint in an isolated data subnet. This design enforces network isolation, eliminates public database exposure, and implements zero-trust identity principles across all tiers. Fork this diagram on Diagrams.so to customize subnets, add additional services, or adapt for your compliance requirements. The P1v3 App Service tier supports production workloads with integrated scaling and high availability.