Azure Architecture Patterns for AZ-305 (2026)
The Azure Solutions Architect Expert certification evaluates your ability to design enterprise‑grade solutions, not to recite service limits. While you must understand individual Azure services, the exam’s real challenge lies in knowing how to combine them into coherent architectures that satisfy business requirements, align with the Microsoft Azure Well‑Architected Framework, and balance trade‑offs across cost, security, reliability, and operational complexity.
This guide introduces the core architecture patterns you need to master for AZ‑305. For each pattern, you will learn its business goal, the Azure services typically involved, and the design considerations an architect must weigh. Use this as your strategic map through the design decisions that the exam and your career will demand.
Note: This page is not an implementation tutorial. For detailed service configuration and deep technical walkthroughs, visit CloudComputingDevPro.
What Is an Azure Architecture Pattern?
An Azure architecture pattern is a reusable solution to a common design problem within a specific context. Patterns emerge from proven implementations and are shaped by the five pillars of the Azure Well‑Architected Framework: reliability, security, cost optimization, operational excellence, and performance efficiency.
- Definition – A high‑level blueprint that describes the structure of Azure resources, their interactions, and the rationale behind the design.
- Enterprise benefits – Patterns accelerate design decisions, reduce risk, and provide a shared vocabulary for architects and stakeholders.
- Relationship with Well‑Architected Framework – Every pattern is evaluated against the five pillars. For example, the Hub‑and‑Spoke pattern optimizes for security and operational control but may increase cost and complexity compared to a simpler network topology.
- Why architects think in patterns – Patterns let you move from “which service does this” to “how do I construct a solution that will evolve with the business”. In AZ‑305, you will be asked to choose or justify a pattern given a set of business requirements.
Core Azure Architecture Patterns
The table below lists the patterns most frequently referenced in AZ‑305 and enterprise architecture. Later sections explore each in depth.
| Pattern | Business Goal | Primary Azure Services | AZ‑305 Importance |
|---|---|---|---|
| Azure Landing Zone | Enterprise‑scale governance, security, and compliance foundation | Management Groups, Azure Policy, Blueprints, RBAC, Microsoft Entra ID | Very High |
| Hub‑and‑Spoke Networking | Centralized network security and connectivity | VNet Peering, Azure Firewall, VPN Gateway, ExpressRoute, Virtual WAN | Very High |
| Enterprise‑Scale Architecture | Combined landing zone and governance for large portfolios | Management Groups, Policy, Log Analytics, Security Center, Defender for Cloud | High |
| Hybrid Cloud | Extend on‑premises environments to Azure | ExpressRoute, VPN, Azure Arc, Azure Stack HCI, Microsoft Entra Connect | Very High |
| Multi‑Region Deployment | Global resilience and low latency | Azure Front Door, Traffic Manager, Cosmos DB multi‑region, geo‑redundant storage | High |
| High Availability | Workload resilience within a region | Availability Zones, Availability Sets, Load Balancer, VMSS, geo‑redundant storage | Very High |
| Disaster Recovery | Regional failover and business continuity | Azure Site Recovery, Azure Backup, geo‑redundant storage, paired regions | High |
| Event‑Driven Architecture | Decouple components, react to events | Event Grid, Service Bus, Event Hubs, Azure Functions, Logic Apps | Medium |
| Microservices | Independent deployment, scalability, and resilience | Azure Kubernetes Service (AKS), Container Apps, API Management, Service Fabric | Medium |
| Serverless | Reduce server management, automatic scaling | Azure Functions, Logic Apps, API Management, Cosmos DB serverless, Event Grid | Medium |
| Data Platform | Ingest, store, process, and analyze data at scale | Azure Synapse Analytics, Data Lake Storage, Databricks, Data Factory, Cosmos DB | Medium |
| AI Architecture | Build and deploy intelligent applications | Azure OpenAI Service, Azure AI Search, Azure AI Foundry, Azure Machine Learning | Medium |
| Security Architecture | Defense in depth and centralized threat management | Microsoft Entra ID, Key Vault, Azure Firewall, Defender for Cloud, Microsoft Sentinel | High |
| Cost Optimization | Minimize waste without sacrificing requirements | Azure Advisor, Reserved Instances, Spot VMs, autoscaling, storage lifecycle management | Medium |
Azure Landing Zone
The Azure Landing Zone is the enterprise foundation. It provides a governed, secure, and scalable environment into which all workloads are deployed. An effective landing zone prevents “sprawl” and ensures every resource inherits central policies.
- Enterprise subscriptions – Organize workloads into subscriptions grouped under management groups, allowing separate billing, access, and policy enforcement.
- Management Groups – Apply Azure Policy and role‑based access control at scale. For example, a management group for production workloads might enforce specific VM SKUs and deny public IPs.
- Azure Policy – Audit and enforce compliance. Use built‑in policies for encryption, allowed regions, and resource types. Custom policies provide fine‑grained control.
- Azure RBAC – Assign least‑privilege roles. Combine with Privileged Identity Management (PIM) for just‑in‑time access.
- Governance – Centralize logging (Log Analytics workspaces), security monitoring (Defender for Cloud), and cost tracking (Cost Management).
When to adopt: Any enterprise with multiple workloads, teams, or compliance requirements should start with a landing zone. The exam expects you to recognize the need for governance guardrails and centralized operations.
Hub‑and‑Spoke Network Architecture
The hub‑and‑spoke pattern centralizes network security and connectivity in a hub virtual network, while spoke networks contain workload‑specific resources. This is the most common enterprise networking topology on Azure.
- Hub VNet – Hosts shared services: Azure Firewall, VPN Gateway, ExpressRoute Gateway, and DNS resolution. All traffic between spokes and on‑premises passes through the hub for inspection.
- Spoke VNets – Isolate workloads (development, production, business unit). Each spoke can peer to the hub and optionally to other spokes, though direct spoke‑to‑spoke peering reduces transit through the hub and may be used when latency is critical.
- Azure Firewall – A managed, stateful firewall as a service. Filter outbound, inbound, and spoke‑to‑spoke traffic using application and network rules.
- VPN Gateway and ExpressRoute – Terminate hybrid connections in the hub, making them available to all spokes.
- Virtual WAN – An alternative managed hub‑and‑spoke model with built‑in routing and global transit, suitable for very large or globally distributed networks.
Design considerations: Hub‑and‑spoke adds latency and cost (peering charges, firewall throughput). For simple environments, a single VNet with subnets may suffice. However, any enterprise with security requirements that demand traffic inspection will benefit from this pattern.
Hybrid Cloud Architecture
Most enterprises run workloads both on‑premises and in Azure. Hybrid architecture bridges these worlds, enabling unified identity, networking, and management.
- Azure Arc – Extend Azure management and governance to on‑premises, multi‑cloud, and edge servers. Apply Azure Policy, update management, and monitoring to non‑Azure resources.
- ExpressRoute – Dedicated, private connectivity to Azure, providing higher reliability and lower latency than internet‑based VPN.
- VPN Gateway – Use Site‑to‑Site VPN as a backup to ExpressRoute or as the primary connection when cost is a concern.
- Microsoft Entra Connect – Synchronize on‑premises Active Directory with Microsoft Entra ID for hybrid identity. Cloud sync provides a lightweight alternative.
- On‑premises integration – Azure Stack HCI runs Azure services on‑premises. Use Azure File Sync or Storage Gateway for hybrid storage.
Exam relevance: AZ‑305 frequently asks you to design connectivity that meets bandwidth, latency, and security requirements. Know when to recommend ExpressRoute vs. VPN, how to integrate DNS, and how to design for high availability in hybrid scenarios.
Multi‑Region Architecture
For applications that serve a global user base or require regional resilience, multi‑region designs distribute workloads across Azure regions.
- Active‑Active – Both regions serve live traffic. Use Azure Front Door or Traffic Manager to distribute requests to the closest healthy endpoint. Data must be synchronized across regions (e.g., Cosmos DB multi‑region writes, SQL Data Sync). This provides the best latency and highest availability but increases cost and complexity.
- Active‑Passive – One primary region handles all traffic; a secondary region remains on standby. Failover is initiated manually or automatically via Traffic Manager/Front Door health probes. Data is replicated asynchronously (geo‑redundant storage, SQL geo‑replication). RPO is non‑zero.
- Traffic Manager and Front Door – DNS‑based and layer‑7 global load balancers. Front Door offers SSL offloading, caching, and WAF; Traffic Manager is DNS‑only and suitable for non‑HTTP traffic.
- Geo‑redundancy – Storage accounts configured as RA‑GRS (read‑access geo‑redundant storage) replicate data to a paired region and allow read access during an outage.
Trade‑offs: Active‑active is expensive and demands eventual consistency handling; active‑passive is cheaper but introduces failover latency and potential data loss. AZ‑305 expects you to match the architecture to the business’s RTO and RPO targets.
High Availability & Disaster Recovery
High availability (HA) guards against local failures within a region; disaster recovery (DR) prepares for regional outages.
High availability:
- Availability Zones – Physically separate datacenters within an Azure region. Deploy VMs, load balancers, and zone‑redundant services across zones to survive a zone failure.
- Availability Sets – Distribute VMs across fault and update domains within a datacenter. Use for workloads that do not require zone redundancy.
- Azure Load Balancer – Distributes traffic to healthy VMs within a region. Standard SKU supports zone‑redundant frontends.
Disaster recovery strategies:
| Strategy | RTO | RPO | Cost | Complexity |
|---|---|---|---|---|
| Backup & Restore | Hours to days | Hours | Low | Low |
| Pilot Light | Minutes to hours | Minutes | Medium | Medium |
| Warm Standby | Minutes | Seconds to minutes | High | High |
| Multi‑Site Active‑Active | Near zero | Near zero | Very High | Very High |
Azure Site Recovery orchestrates VM replication to another region. Backup provides point‑in‑time restores. For PaaS services, use native geo‑replication (SQL Database, Cosmos DB, Storage). The exam requires you to select the cost‑effective DR approach that satisfies given RTO/RPO targets.
Event‑Driven & Serverless Architecture
These patterns reduce infrastructure management and enable scalable, loosely coupled designs.
- Event Grid – Fully managed event routing service. React to changes in Azure resources (blob creation, resource group changes) or custom events. Use for simple, near‑real‑time event distribution.
- Service Bus – Enterprise‑grade message broker with queues and topics. Supports advanced messaging patterns: sessions, dead‑lettering, duplicate detection. Choose over Event Grid for transactional workloads requiring guaranteed delivery.
- Event Hubs – Big data streaming platform. Ingest millions of events per second for telemetry and log analytics.
- Azure Functions – Serverless compute for event‑driven execution. Scales automatically. Ideal for lightweight processing tasks (image resizing, queue processing).
- Logic Apps – Visual workflow designer for integration and automation. Connect hundreds of services without code. Use for business process orchestration.
When to use: AZ‑305 may present a requirement for decoupling or real‑time processing. You must select the right messaging/event service based on throughput, ordering guarantees, and integration needs.
Enterprise Security Architecture
Security is a cross‑cutting concern, and AZ‑305 expects you to embed it into every design.
- Microsoft Entra ID – Central identity provider. Implement Conditional Access, Privileged Identity Management, and Identity Protection.
- Azure Key Vault – Secure secrets, keys, and certificates. Use Managed HSM for FIPS 140‑2 Level 3 requirements.
- Azure Firewall – Stateful firewall as a service. Centrally inspect all traffic in a hub‑and‑spoke network.
- Microsoft Defender for Cloud – Cloud security posture management (CSPM) and workload protection. Evaluate Secure Score and enforce regulatory compliance.
- Microsoft Sentinel – Cloud‑native SIEM and SOAR. Collect data across the enterprise and automate threat response.
- Azure Policy – Enforce organizational standards and assess compliance at scale.
Architecture lens: A secure design applies defense in depth: identity, network, encryption, and monitoring. For example, a landing zone uses Azure Policy to deny public IPs, Entra ID for RBAC, Key Vault for encryption, and Defender for Cloud for threat detection. The exam will ask you to integrate these services into broader solutions.
AI Architecture
AI workloads are increasingly appearing in AZ‑305 scenarios. Architects must know where AI services fit and how to integrate them securely and cost‑effectively.
- Azure OpenAI Service – Access GPT‑4 and other models via REST APIs. Apply content filtering and private networking. Use for chatbots, content generation, and summarization.
- Azure AI Search – Full‑text search and vector search for retrieval‑augmented generation (RAG) patterns.
- Azure AI Foundry – Unified platform for building, training, and deploying custom models. Integrates with Azure Machine Learning.
- Azure Machine Learning – MLOps platform for end‑to‑end model lifecycle management.
Design considerations: AI solutions require data governance (no training on sensitive data), cost controls (token‑based pricing), and responsible AI practices. The exam may ask how to architect a secure, scalable chatbot that grounds answers in enterprise data.
Cost Optimization Architecture
Cost optimization is a pillar of Well‑Architected, and AZ‑305 tests your ability to design cost‑aware architectures without compromising core requirements.
- Autoscaling – Scale VMSS and App Service plans based on demand. Use Logic Apps or Functions to start/stop non‑production resources on schedule.
- Reserved Capacity – Azure Reservations for VMs, SQL Database, Cosmos DB, and more offer significant discounts for 1‑ or 3‑year commitments.
- Spot Virtual Machines – Run interruptible workloads on unused compute capacity at deep discounts. Suitable for batch processing, dev/test, and stateless workloads.
- Storage tiers – Use Azure Blob lifecycle management to transition data to Cool or Archive tiers based on access patterns. Use Azure Files and Blob reserved capacity for predictable workloads.
- Platform services – Prefer PaaS (App Service, Functions, SQL Database) over IaaS to reduce operational overhead and right‑size automatically.
Trade‑offs: A cost‑optimized design must not undermine reliability. For example, using Spot VMs for production web servers introduces risk unless the application is stateless and multi‑region. The exam often asks for the “most cost‑effective” option that still meets the SLAs.
Pattern Comparison Matrix
| Pattern | Scalability | Availability | Security | Cost | Operational Complexity |
|---|---|---|---|---|---|
| Landing Zone | High (governance scale) | High (isolated workloads) | Very High (central policies) | Medium (management group overhead) | Medium |
| Hub‑and‑Spoke | High (add spokes) | High (central firewalls) | Very High (traffic inspection) | Medium‑High (peering, firewall) | Medium |
| Hybrid Cloud | Medium (bandwidth limited) | Medium (dual‑path connectivity) | High (ExpressRoute, VPN encryption) | High (ExpressRoute, data egress) | High |
| Multi‑Region Active‑Active | Very High | Very High | High (global encryption, identity) | Very High | Very High |
| High Availability | High (zone‑redundant) | Very High (within region) | Medium‑High | Medium | Medium |
| Disaster Recovery | Varies (per strategy) | Varies | High (encrypted replication) | Varies | Varies |
| Event‑Driven | Very High (decoupled) | High (asynchronous, durable) | Medium‑High | Medium (pay‑per‑event) | Medium |
| Serverless | Very High (automatic) | High (managed) | Medium‑High (managed runtime) | Low‑Medium (consumption) | Low |
| Security Architecture | N/A (cross‑cutting) | Very High (defense in depth) | Very High | Medium‑High | High |
| Cost Optimization | Varies | Varies | Varies | Optimized | Medium |
How AZ‑305 Tests Architecture Patterns
The AZ‑305 exam does not ask you to define patterns; it embeds them in case studies and scenario‑based questions. You will encounter narratives describing an organization’s current environment, pain points, and business goals, then be asked to recommend the appropriate architecture or identify the next design step.
Common scenario categories include:
- Enterprise governance – Redesign a flat subscription structure into a managed landing zone with Azure Policy.
- Hybrid cloud – Connect on‑premises datacenters to Azure, integrate identity, and ensure high availability for critical applications.
- Global applications – Reduce latency for worldwide users, implement active‑passive DR, and optimize cost.
- Networking – Select between hub‑and‑spoke and Virtual WAN, implement traffic inspection, and secure private endpoints.
- Disaster recovery – Choose a DR strategy that meets RTO/RPO with minimal cost.
- Identity – Federate identities, implement Conditional Access, and design for B2B collaboration.
- AI workloads – Architect a secure, scalable AI solution using Azure OpenAI and enterprise data sources.
- Cost optimization – Identify waste in an existing design and recommend Reserved Instances, autoscaling, and storage tiering.
How to prepare: For each pattern, practice mapping a business requirement to the pattern name and listing the key Azure services. Then, in the AZ‑305 Scenarios section, apply that skill in integrated, multi‑domain exercises that reflect the exam’s complexity.
Recommended Learning Path
Master patterns in this order to build a solid enterprise foundation first, then layer on more advanced concepts.
- Landing Zone – Establishes the governance and security baseline for all other patterns.
- Hub‑and‑Spoke Networking – The most common enterprise network topology; essential for hybrid and multi‑region designs.
- High Availability – Core resilience concepts that underpin DR and global designs.
- Disaster Recovery – Extends HA to regional resilience; introduces RTO/RPO trade‑offs.
- Hybrid Cloud – Connects on‑premises and Azure; critical for migration and real‑world enterprise.
- Multi‑Region – Global deployment and resilience; builds on HA and DR.
- Event‑Driven and Serverless – Modern decoupled and low‑ops architectures.
- AI Architecture – Rapidly growing importance in enterprise solutions.
- Security Architecture – Cross‑cutting; best understood after you have context from other patterns.
- Cost Optimization – Apply as a lens to refine all previous patterns.
Continue Learning
- AZ‑305 Certification Guide – Complete exam overview and learning framework.
- AZ‑305 Skills – Official exam objectives expanded with architecture guidance.
- AZ‑305 Services – Design‑oriented deep dives into key Azure services.
- AZ‑305 Scenarios – Practice architecture decision‑making in realistic case studies.
- AZ‑305 Resources – Study guides, checklists, and official Microsoft references.
For detailed Azure service tutorials, implementation guides, and architecture deep dives, continue learning on CloudComputingDevPro.
Key Takeaways
- AZ‑305 evaluates your ability to select and combine architecture patterns to solve enterprise business problems. It is not a test of service trivia.
- Prioritize Landing Zone, Hub‑and‑Spoke, High Availability, Disaster Recovery, Hybrid Cloud, and Security patterns—they appear frequently and form the backbone of many design questions.
- Every pattern involves trade‑offs. Know the cost, reliability, and complexity implications of each, and be prepared to justify your choice.
- Use the Pattern Comparison Matrix to quickly assess patterns during study and practice.
- Integrate these patterns with the official AZ‑305 skills and test your application through the CloudCertPro scenarios. Architecture thinking is the skill that will carry you through the exam and your career as a solutions architect.