Omnichannel banking on Microsoft Azure, private by default

The client is a banking and finance organisation building a modern, cloud-native application structure to serve its channels from a single platform. The platform had to carry complex business logic and high transaction volumes, and the rollout had to be smooth, with minimal downtime for services that customers and staff already depend on every day.

The engagement covered application architecture design, automated deployment and application performance optimisation. In practice that meant designing the application and network architecture together, because in a bank the questions of where a service runs and who is allowed to reach it are, for most purposes, the same question.

Channels that grow independently end up as separate systems behind one brand, each with its own entry point, its own identity model and its own route to the core. For a bank that is a security problem before it is an engineering one: every additional public endpoint is another place where traffic can reach data without passing a control.

The platform also had to reach systems that stay on premises, including directory services, internal APIs and databases, for both customer-facing applications and internal staff. The design question was how to give internet, mobile and staff traffic one governed path each, while keeping every data service off the public network entirely.

The platform is split across four subscriptions on Microsoft Azure. The connectivity subscription owns the edge: Azure Front Door receives internet and mobile users and forwards them to an Application Gateway through its private endpoint. Internal staff and on-premises data centre services arrive over an ExpressRoute circuit and a Virtual Network Gateway, on HTTP(S) and non-HTTP(S) paths that include LDAP, API and SQL connections. Azure Firewall inspects both routes, and an Azure Private DNS Zone resolves private endpoint names.

Operator access is kept apart from customer traffic. Azure Bastion fronts the jump servers in the connectivity subscription, which also holds its own Key Vaults. Nothing in the application tier is administered directly from the internet, and every administrative session starts at Bastion, which gives one place to control and review privileged access.

In the omnichannel subscription, an internal load balancer receives HTTPS from the firewall and passes it to the application subnet. Azure Kubernetes Service (AKS) hosts the channel applications and a group of shared platform applications the diagram labels Fabric apps, and a Keycloak virtual machine provides application identity over LDAP to the on-premises directory. Azure Functions, Event Hub, a Storage account, PostgreSQL, MySQL, Key Vault and Container Registry are reached only through connection strings that resolve to private endpoints.

Two further subscriptions hold the shared controls. The management subscription runs Log Analytics, Azure Monitor, Microsoft Defender for Cloud and Network Watcher, so telemetry and posture live outside the workload they observe. The identity subscription holds Azure AD (now Microsoft Entra ID), Conditional Access, Azure Policy and its own Key Vaults. The connectivity VNet vnet-hk-connectivity-prod-001 peers to vnet-hk-omni-prod-001 for applications and to vnet-hk-omni-managedservice-prod-001 for managed services, each with a separate, non-overlapping address range.

We delivered a scalable, secure and efficient application architecture on Microsoft Azure. Every channel enters through one controlled edge and every data service is reachable only through a private endpoint, which gave the bank a platform it can explain to auditors as clearly as to engineers. The new structure improved performance, reduced deployment times and improved the experience for users across channels.

The modular design separates channel applications, shared platform applications and managed data services, so each can be maintained, scaled or extended without reopening the network design. That leaves the organisation positioned for continued growth and future expansion on the same foundation rather than a new one.