A global architecture serves users from several regions and tolerates regional failure only when every critical dependency has an aligned regional strategy. Global traffic routing is the visible layer; data consistency, identity, keys, DNS, model/search quota, deployment, observability, and operational decision-making determine whether failover works.
Method note: Regional topology, consistency, failover authority, and recovery objectives form one architecture decision. Deploy its resources with the Portal or IaC methods in the networking, data, backup, and delivery chapters; a method switch here would hide dependencies that must be designed together.
Each stamp has app compute, regional cache/queue as needed, search/model deployments, private networking, and observability. A minimal global control plane manages placement/configuration without becoming a synchronous dependency for every request.
Front Door health probes must reflect the service's ability to serve the critical journey. Origin failover can move traffic faster than data can safely accept writes; coordinate them.
Ask which invariants cannot be violated. Options include:
Document behavior during partition: reject writes, queue them, or accept conflicts. “Eventually consistent” is not a full business rule.
Model availability, versions, quotas, content-safety configuration, and search features can differ by region. Provision and evaluate the fallback deployment before disaster. Keep embeddings compatible with indexes or maintain regional index versions. Cap fallback traffic so a failed region does not overwhelm the survivor.
If a model changes during failover, record it and apply the same safety/evaluation requirements. A silent quality regression is an incident.
Entra is globally operated, but workload identities, role assignments, private endpoints, DNS, Key Vault access, keys, and certificates must exist in each regional design. Decide whether secrets/keys are replicated, independently generated, or fetched from a surviving control. Test certificate renewal and revocation during regional loss.
Deploy one canary region/stamp, run synthetic and business-journey tests, then roll to the next. Maintain version skew compatibility. Avoid changing every region and the global route simultaneously. Use feature flags and stop on SLO burn.
Measure actual RTO/RPO and customer error, not just route status.
Active-active pays for duplicate capacity, data replication, inter-region transfer, global edge, logs, and operations. Warm standby can be a better value for moderate RTO. Tie the pattern to business impact and error budget.