# Azure architecture review checklist

By Prateek Singh, Cloudeval AI. Reviewed 10 September 2026.

Copy this checklist into your infrastructure pull request. It applies to live Azure evidence, ARM JSON, and Bicep compiled to ARM. It is a review aid, not a compliance certificate or a substitute for project-specific evidence.

## Identify the review

- Repository and pull request:
- Exact commit and template entry point:
- Azure subscription/resource group scope (keep private identifiers in your private review):
- Evidence captured at (UTC):
- Reviewer and decision owner:
- Intended change and acceptance criteria:

## Before review

- [ ] Confirm which files and resources belong to the change.
- [ ] Resolve linked ARM templates; compile Bicep before ARM review.
- [ ] Match the imported project snapshot and CI checkout to the same commit.
- [ ] State whether evidence is static IaC or a dated live Azure snapshot.
- [ ] Confirm that the CI review actually ran. A skipped step is not a passed evaluation.

## Inspect the architecture

- [ ] Check public ingress and the intended network access path.
- [ ] Verify private endpoint dependencies and DNS assumptions. Static topology alone does not prove reachability.
- [ ] Review identity, role assignments, and Key Vault access for the intended principals.
- [ ] Review redundancy, failure domains, recovery assumptions, and scaling limits.
- [ ] Separate template validation errors from policy and architecture findings.
- [ ] Record cost assumptions, currency, date, unpriced resources, and the configured budget. Estimates are not invoices.
- [ ] Label unsupported checks and missing evidence as Not assessed or unverified.

## Record a decision for each finding

| Resource / source location | Finding and evidence link | Fix / accept / investigate | Owner | Verification step |
| --- | --- | --- | --- | --- |
| Fill in | Fill in | Fill in | Fill in | Fill in |

- [ ] Attach the evaluated commit, workflow run, and relevant report evidence.
- [ ] Explain accepted risks and who accepted them.
- [ ] Fix blocking findings, rerun the review, and record the new commit and result.
- [ ] Keep gate success separate from posture: passing configured thresholds does not prove every architecture concern is resolved.

## Inspect an example or run your own

- Public Azure review: https://github.com/ganakailabs/cloudeval-azure-arm-review-example/pull/8
- GitHub Actions setup: https://docs.cloudeval.ai/guides/review/github-actions
- Scope and limitations: https://docs.cloudeval.ai/trust/supported-clouds-and-iac

CloudFormation users should follow the separate static AWS CloudFormation beta workflow. Azure controls and live evidence do not transfer automatically to AWS.