1

So our company wants to move forward of moving servers to the cloud. They are planning to provide some Web App services to our clients, so my idea was to create a Resource Group for each client, keeping tabs on cost and such. We already have two Web Apps running for testing, and they are only running with a stateless Firewall as we want this traffic to go through the Fortigate for extra security. I have two questions about the design of each idea I have. Would the best method to take this project on?

  1. Create a resource group with a much more powerful Firewall and create peering networks from each source to the Firewall?

  2. Create small Firewalls for each resource group and manage it that way?

If this project grows, the option1 would require creating a load balancer with two firewalls and redundancy. Option 2 will be a mess managing multiple Firewalls, but it would only be around a dozen of them at most.

7 Spice ups
2

That is a terrible idea. Each customer should have their own subscription. If you’re a VAR, you would be setting each customer up with their own Azure Plan sub (formerly CSP).

Both of these are terrible ideas, but the first is less terrible. The second would be a management nightmare, and your costs would be much higher.

3

The best solution would be each customer with their own subscription/tenant, otherwise you’re creating a shady vendor lock-in for absolutely no reason. Aside from that, if you do need security filtering beyond basic means such as NSGs, you could put other things in front of apps such as a WAF/Front Door/etc.