Resilient Azure Platforms: Sturdy Features, Cosmos DB, and DR by Design

Hiya People!

Working at Azure scale means managing change throughout a number of interconnected techniques. As functions, providers, and dependencies evolve, resilience turns into a foundational design precept quite than an afterthought. On this Microsoft Azure Infra Summit 2026 session, Bhavana Konchada, Principal Software program Engineer at Microsoft and lead architect of the Resilience Management Platform, takes us behind the scenes of a production-grade resilience platform constructed on Azure and explains the engineering decisions that helped convey it to life.

Most of us have shipped a system that labored fantastically on day one after which quietly fell aside the primary time one thing downstream blinked. Bhavana’s session is a brutally sincere tour of the selections you make early that decide whether or not your platform survives actuality. Right here’s what you stroll away with:

• A practical blueprint for service boundaries that you would be able to really function at 2 a.m.
• Concrete Sturdy Features patterns (Monitor, continue-as-new, idempotency) that maintain long-running workflows wholesome.
• A Cosmos DB partitioning technique grounded in actual entry patterns, not intestine really feel.
• A multi-region, fail-and-continue mindset (as an alternative of fail-and-recover) that holds up when a area disappears.
• Actual classes from manufacturing, together with the “non-deterministic orchestration” outages no person warns you about.

Briefly, when you construct, run, or modernize platforms on Azure, this session reshapes how you concentrate on reliability.

Bhavana frames the Resilience Management Platform as 5 chapters: structure and repair boundaries, orchestration with Sturdy Features, the Cosmos DB information layer, identification throughout a number of person realms, and the resilience playbook itself.

The platform has 4 transferring components:

• A portal the place operators outline and monitor eventualities.
• An orchestration engine that executes long-running workflows.
• Cosmos DB as a shared persistence layer.
• Downstream infrastructure APIs the engine acts on.

The large “DR by Design” concept is that resiliency isn’t bolted on later. It’s a property of each alternative from boundaries upward. As Bhavana places it, you cease designing for “fail and get better” and begin designing for “fail and proceed.” Customers don’t know (or care) which area runs their workflow; they simply want it to run reliably, constantly, and with out interruption.

Bhavana’s workforce made a number of deliberate design strikes price borrowing.

Arm’s-length service boundaries. Model one had the portal and orchestration engine tightly coupled with shared dependency injection and a shared database context. It felt clear till they tried to function it. Now the 2 providers speak over REST contracts, every with its personal dependencies. Sure, meaning a little bit of duplicated code. What they gained, unbiased deployments, remoted failures, and clear possession, greater than paid for it.

The proper runtime for the workload. The portal is a session-driven internet app, so it lives on App Service. The orchestration engine bursts on demand and runs workflows for minutes (typically hours), so it’s constructed on Sturdy Features. Forcing each into one mannequin would have appeared less complicated on paper and been worse in observe.

Settle for Quick, Course of Asynchronously. Clicking Execute returns a 202 instantly. The orchestrator does the heavy lifting within the background and updates standing in Cosmos DB. The portal simply displays progress. Customers by no means wait on lengthy workflows.

Sturdy Features patterns that really scale. Three classes stood out:

• The Monitor sample replaces busy polling with sturdy timers. The orchestrator wakes up, checks standing, and goes again to sleep with out holding compute.
• Orchestrators are state machines, not scripts. Calling DateTime.UtcNow inside an orchestrator produces non-deterministic replay and random manufacturing failures. The repair is to make use of the orchestration context for time and IDs.
• Proceed-as-new retains replay historical past bounded. Lengthy-running orchestrations in any other case spend extra time replaying historical past than doing actual work.

Cosmos DB designed round entry, not org charts. Partitioning by tenant feels logical and creates hotspots the second one tenant will get busy. The workforce partitions by entity (every plan owns its partition) and makes use of hierarchical keys combining plan ID and execution ID. Additionally they lean on TTL for information lifecycle so accomplished data expire routinely, no cleanup jobs required.

Identification as an execution boundary. Company customers authenticate by means of Microsoft Entra with OpenID Join. Operations customers are available in by means of a federated WS-Federation system. As an alternative of forking the app, the workforce constructed house realm discovery on the entrance door, normalized every thing right into a single identification mannequin behind it, and added customized middleware within the Azure Features remoted employee mannequin to extract, validate, enrich, and fail-fast on each token. Authorization is config-driven so each endpoint will get the identical remedy.

Multi-region from day one. The complete stack (portal, engine, APIs, supporting providers) runs in parallel throughout areas, fronted by Azure Entrance Door as the worldwide entry level. Well being probes drive automated regional failover with no human within the loop.

Cosmos DB single-write with automated failover. Multi-write seems enticing on a slide and introduces actual conflict-resolution complexity. The workforce selected one major write area plus a duplicate with automated failover. The Cosmos SDK detects area unavailability and routes requests to the promoted area with out software code modifications.

Idempotency from day zero. After getting retries (and Entrance Door, the SDK, and your purchasers all retry), each operation needs to be secure to run greater than as soon as. Consumer-provided IDs, Cosmos battle detection (a 409 means “already succeeded”), and idempotent orchestration occasions be certain that the identical consequence lands irrespective of what number of instances a sign arrives.

What does this purchase you in observe?

• Situation validation underneath stress with out compromising manufacturing. The platform is constructed to proactively validate and govern system conduct at scale.
• Lengthy-running workflows that survive every thing. Host restarts, transient downstream errors, regional failovers, none of them lose work in flight.
• Predictable value. Sturdy timers and continue-as-new imply you cease paying for compute that’s solely ready.
• Operability at scale. Impartial providers, clear contracts, and centralized identification all imply a smaller cognitive load when one thing breaks at 2 a.m.
• Trustworthy tradeoffs. Single-write Cosmos loses theoretical write latency within the second area and positive factors predictable conduct, no battle ambiguity, and much simpler debugging throughout failovers. That’s often the best commerce.

Briefly, the platform behaves the identical on a quiet Tuesday and through a regional outage. That’s the entire level.

You don’t have to construct the Resilience Management Platform tomorrow. You can begin making use of these patterns this week.

1. Map your service boundaries truthfully. If two providers share a DI container or database context, decouple them behind a REST contract.
2. Choose runtimes by workload, not by consistency. Interactive UI on App Service; long-running orchestrations on Sturdy Features.
3. Undertake the 202-Accepted sample for something that would take greater than a few seconds.
4. Audit your Sturdy orchestrators for DateTime.UtcNow, Guid.NewGuid, and direct HTTP calls. Transfer them into actions, use the orchestration context for time and IDs, and apply continue-as-new on lengthy loops.
5. Revisit your Cosmos partition keys in opposition to precise entry patterns and allow TTL for transient information.
6. Get up a second area behind Azure Entrance Door, allow Cosmos DB automated failover, and make each write operation idempotent with client-provided IDs.

Catch the complete Microsoft Azure Infra Summit 2026 session playlist right here

Cheers!

Pierre Roman