Azure architecture diagram

Azure's structure is hierarchical in a way that matters for diagrams: management group, subscription, resource group, resource. Reflecting that hierarchy visually is most of what makes an Azure diagram readable.

The official icon set is available in the draw.io editor.

#When to reach for one

• Architecture reviews and design documents.

• Governance and cost work, where the grouping is the subject.

• Landing zone documentation.

#How to draw it in Capable

#A worked example

Subscription, resource group and resources as nested containers:

The source, which you can paste into a new diagram and edit:

sub: Production subscription {
  rg_net: rg-network {
    fw: Azure Firewall
    vnet: Virtual network
  }
  rg_app: rg-app {
    plan: App Service plan
    app: App Service
    fn: Function App
  }
  rg_data: rg-data {
    sql: Azure SQL {
      shape: cylinder
    }
    blob: Blob storage {
      shape: cylinder
    }
  }
}

sub.rg_app.app -> sub.rg_data.sql: private endpoint
sub.rg_app.fn -> sub.rg_data.blob
sub.rg_net.fw -> sub.rg_app.app

#A few things that catch people out

• Resource groups are a lifecycle boundary, not just a folder. Draw them where that matters.

• Private endpoints change the picture completely; show them rather than implying public access.

• Name resources as they are actually named. Generic labels defeat the purpose.

#Related

Draw the trust boundary.