Applying the Framework: A Practical Assessment

In the previous lessons, we explored each pillar of the Azure Well-Architected Framework, the tools available for assessment, and common anti-patterns. This final lesson brings everything together with a practical, step-by-step approach to assessing and improving a real workload.

---

The Assessment Process

Applying the Well-Architected Framework to a workload follows a structured process:

Step 1: Define the Workload Scope

Clearly define what you are assessing. A workload is a collection of Azure resources that work together to deliver a business capability. Examples:

• An e-commerce platform (App Service, SQL Database, Redis Cache, Blob Storage, CDN)
• A data processing pipeline (Event Hubs, Azure Functions, Cosmos DB, Data Lake Storage)
• An internal business application (VMs, SQL Managed Instance, VPN Gateway)

Define the boundary — what is included and what is not. Include all dependent services, data stores, networking components, and identity infrastructure.

Step 2: Gather Your Team

An effective assessment requires input from multiple perspectives:

Role	Contribution
Solution Architect	Overall design decisions and tradeoffs
Developers	Application code patterns, error handling, testing
Operations / SRE	Monitoring, alerting, incident response, deployment
Security	Identity, access control, data protection, threat detection
Product / Business	Business requirements, SLA needs, budget constraints

Step 3: Assess Each Pillar

Work through each pillar systematically. For each pillar, ask the key questions and document your current state.

---

Pillar-by-Pillar Assessment Template

Reliability Assessment

Question	Current State	Gap	Priority
Have you defined SLA, RTO, and RPO targets?
Are production resources deployed across Availability Zones?
Do you have automated backups with tested restores?
Is retry logic with exponential backoff implemented for all external calls?
Do you have a multi-region failover strategy for critical workloads?
Do health probes verify end-to-end application health?
Have you conducted a failure mode analysis?
Have you performed disaster recovery drills in the last 6 months?

Security Assessment

Question	Current State	Gap	Priority
Is MFA enabled for all users?
Are managed identities used instead of credentials in code?
Are secrets stored in Azure Key Vault?
Are PaaS services accessed through Private Endpoints?
Is RBAC applied with least privilege at the narrowest scope?
Is Microsoft Defender for Cloud enabled with a good Secure Score?
Is network traffic segmented with NSGs and firewall rules?
Are data encrypted at rest and in transit?

Cost Optimisation Assessment

Question	Current State	Gap	Priority
Have you right-sized all compute resources based on usage data?
Are Reserved Instances or Savings Plans used for stable workloads?
Are development environments shut down outside business hours?
Are orphaned resources (unattached disks, unused IPs) cleaned up?
Are budgets and alerts configured in Azure Cost Management?
Is a tagging strategy enforced with Azure Policy?
Are storage lifecycle policies configured for blob data?
Do you review Azure Advisor cost recommendations weekly?

Operational Excellence Assessment

Question	Current State	Gap	Priority
Is all infrastructure defined as code (Bicep, Terraform, ARM)?
Are deployments automated through CI/CD pipelines?
Is monitoring configured with metrics, logs, and traces?
Are alerts actionable with runbooks for common scenarios?
Do you conduct blameless post-incident reviews?
Are secrets and configuration centralised (Key Vault, App Configuration)?
Are safe deployment strategies used (blue-green, canary, feature flags)?
Is there an incident response plan with defined roles?

Performance Efficiency Assessment