Azure Well-Architected Framework Explained: The Five Pillars And How To Use Them
Dominic Tarn
Head Writer - ReVerb
10.23.2026
Meta description: Azure well architected framework explained: the five pillars, the Well-Architected Review, Azure Advisor scores, and how to run a review in-house or with a partner.
The Azure Well-Architected Framework is Microsoft’s free set of design principles, checklists and review tools for building individual Azure workloads that are reliable, secure, cost-efficient, operable and fast. It is organized into five pillars: Reliability, Security, Cost Optimization, Operational Excellence and Performance Efficiency. You use it by scoring a workload with the Well-Architected Review, comparing the results with Azure Advisor recommendations, and then fixing the highest-risk gaps in a prioritized backlog.
This guide, Azure Well-Architected Framework Explained: The Five Pillars And How To Use Them, covers what each pillar actually asks of you, how the workload guides and service guides fit in, how the assessment and Advisor scores work, where the framework sits next to the Cloud Adoption Framework and landing zones, and how to run a review yourself or with a partner. All framework details were checked against Microsoft Learn in October 2026.
What The Azure Well-Architected Framework Is
Microsoft describes the framework as a set of quality-driven tenets, architectural decision points and review tools for solution architects. The unit it cares about is the workload: a collection of Azure resources, code, data, AI models and infrastructure that together deliver a defined business outcome. A customer portal, a data platform or an internal line-of-business app are each a workload.
The framework has several layers, all published on Microsoft Learn:
Pillars: five quality areas, each with design principles, a design review checklist, key design strategies and a page of trade-offs.
Workload guidance: how the pillars apply to specific workload types, such as AI, SaaS, mission-critical, high-performance computing and sustainability.
Service guides: per-service advice on configuring individual Azure services the well-architected way.
Review tools: the Azure Well-Architected Review questionnaire, a maturity model, and Azure Advisor recommendations and scores.
Reference examples: example workloads in the Azure Architecture Center that apply the framework’s tenets.
Microsoft’s suggested path is to start with the pillars, build a foundation using the technical design areas, then use the review tools to check production readiness. The framework is guidance, not a certification. Nobody “passes” it, and the point is a steadily improving workload rather than a perfect score.
The Five Pillars At A Glance
Each of the five pillars covers one quality concern. Microsoft is explicit that they pull against each other: more redundancy raises cost, tighter security can slow delivery, and aggressive cost cutting can hurt performance. The framework labels these trade-offs throughout so teams can make the compromise on purpose.
Pillar
Core Concern
Key Design Principles
Typical Azure Tools
Main Trade-Off
Reliability
Resiliency, availability and recovery
Design for business requirements, resilience, recovery and operations; keep it simple
Availability zones, Azure Site Recovery, Azure Backup, Azure Chaos Studio
Redundancy adds cost and complexity
Security
Confidentiality, integrity and availability
Plan readiness; protect confidentiality, integrity and availability; sustain and evolve posture
Microsoft Entra ID, Microsoft Defender for Cloud, Azure Key Vault, Microsoft Sentinel
Extra capacity costs money; tuning takes engineering time
The Five Pillars Explained
Reliability
Reliability is about meeting uptime and recovery targets. Its five design principles start with business requirements: define what the workload must deliver, agree recovery time and recovery point objectives with stakeholders, and design to those numbers rather than to an abstract ideal. The remaining principles cover resilience (keep running, perhaps in a degraded mode, when parts fail), recovery (tested plans, data repair, self-healing), operations (find failures early through testing, observability and fault simulation) and simplicity.
The “keep it simple” principle is worth noting. Microsoft warns against overengineering the critical path, and also against simplifying so far that you create a single point of failure. In practice, reliability work usually means mapping critical flows, deciding where zone or region redundancy is justified, and actually rehearsing failover instead of assuming it works.
Security
The Security pillar is built around the classic confidentiality, integrity and availability model and the Zero Trust principles of verify explicitly, use least-privilege access and assume breach. Its design principles ask you to plan security readiness (including segmentation, training and an incident response plan), protect confidentiality with classification, encryption and access controls, protect integrity across code, deployments and data, protect availability during an attack, and keep improving through threat modeling, testing and post-incident reviews.
For most Azure teams the practical work lands in identity (Microsoft Entra ID, managed identities, privileged access), network exposure (private endpoints, firewalls, public access settings), secrets management in Azure Key Vault, and posture management through Microsoft Defender for Cloud.
Cost Optimization
Cost Optimization keeps spending within budget while still meeting requirements. Its principles split into culture (cost-management discipline, a cost-efficient design mindset), usage optimization (get the most out of what you run, shut down what you do not need), rate optimization (pay less for the same thing through commitments and pricing models, without redesigning) and continuous monitoring as the workload changes.
The usage versus rate split is useful when planning work. Rightsizing, autoscaling and deleting orphaned resources are usage changes that engineers own. Reservations, savings plans and licensing benefits are rate changes that finance and procurement usually own. Our Azure cost optimization guide goes deeper on both.
Operational Excellence
Operational Excellence aims to reduce production issues through observability and automation. Its principles are to embrace a DevOps culture with shared ownership, establish development standards and quality gates, evolve operations with monitoring and telemetry, automate repetitive tasks, and adopt safe deployment practices such as incremental rollouts and tested rollback plans.
This pillar often decides whether the other four stick. A workload deployed by hand will drift away from whatever the review recommended within months. Infrastructure as code, pipeline-based deployment and meaningful alerts are what keep reliability, security and cost settings from eroding. Microsoft also points teams toward the Operational Excellence maturity model as the starting place for using AI in operations.
Performance Efficiency
Performance Efficiency is about adjusting to changing demand. Its four principles are to negotiate realistic performance targets with the business, design to meet capacity requirements from measured baselines, achieve and sustain performance through testing and quality gates, and optimize over the long term using real production data. Microsoft’s short version: scale horizontally, test early and often, and monitor the health of the solution.
A common gap here is that targets were never written down. Without an agreed response time or throughput figure, load testing has nothing to pass or fail against, so the first practical step is usually to define targets for the few user flows that matter most.
Workload Guidance And Service Guides
The pillars are generic on purpose. Two other layers make them specific.
Workload Guidance
Workload guides apply the five pillars to a class of workload. Microsoft Learn currently lists guidance for AI workloads, SaaS, mission-critical workloads, high-performance computing, sustainability and Microsoft Fabric. Each guide follows a similar shape: get started, design principles, design areas and a production-readiness assessment. You only need the guides that match your scenario. A team building a retrieval-augmented chatbot on Azure should read the AI workload guidance; a team running a multitenant product should read the SaaS guidance.
Service Guides
Service guides explain how to configure individual Azure services against the pillars. They cover roughly 30 services, including Azure Virtual Machines, Azure App Service, Azure Functions, Azure Kubernetes Service, Azure SQL Database, Azure Cosmos DB, Azure Blob Storage, Azure Front Door, Azure Firewall, Azure API Management, Azure Service Bus and Azure Databricks. They are not exhaustive feature lists; they focus on the settings that matter most for a solid baseline. Some are split by pillar, such as a dedicated reliability page for a service.
Service guides are the fastest way to turn a vague finding (“improve resilience of the database”) into a concrete change (“enable zone redundancy and test the failover group”).
The Well-Architected Review And Azure Advisor Scores
The framework gives you two complementary ways to measure a workload: a questionnaire that captures design intent and practices, and Azure Advisor, which scans deployed resources.
The Azure Well-Architected Review
The Azure Well-Architected Review is a free assessment on Microsoft Learn made up of multiple-choice and multiple-response questions tied to the pillar checklists. Microsoft lists it at about 60 minutes. You choose a workload type (Advisor’s documentation lists Core, Azure Machine Learning, Internet of Things, plus SAP on Azure and Azure Stack Hub in preview) and then work through the pillars. The output is a score and personalized guidance linked back to the relevant framework pages. A separate Mission Critical version of the review exists for workloads with very high availability needs.
Because it is a questionnaire, the review is only as good as the answers. Microsoft’s own tip is that skipping questions to reach the guidance faster produces few or no recommendations. Run it with the people who actually build and operate the workload, and repeat it over time so you can track the score across iterations.
Running The Review From Azure Advisor
Azure Advisor now has an Assessments area (in preview at the time of writing) that launches the Well-Architected Review against a specific subscription and workload. Per Microsoft’s documentation, the resulting recommendations appear in Advisor within about eight hours, can be tracked as Not started, In progress, Completed or Postponed and dismissed, and do not immediately affect your Advisor score. You need Contributor rights on the subscription to create an assessment, a Microsoft Learn account whose home tenant matches the subscription, and guest accounts are not supported. Not every subscription is eligible during the preview.
How The Azure Advisor Score Works
Azure Advisor scans your deployed resources and produces recommendations in five categories that map to the five pillars: Reliability, Security, Cost, Operational Excellence and Performance. The Advisor score is the average of the five category scores. A few details matter when you read it:
Reliability, Performance and Operational Excellence scores are weighted averages of subcategories based on the share of healthy resources. In Reliability, for example, zone resiliency and regional resiliency carry the largest weights.
The Security score comes from the Microsoft Defender for Cloud secure score model.
The Cost score is weighted by the retail (pay-as-you-go) cost of the affected resources, so it does not reflect your negotiated discounts, and long-standing recommendations count more heavily.
The score refreshes at least daily, and a fix can take 24 hours or more to show up.
Advisor does not distinguish production from dev/test. Dismissing or postponing a recommendation that does not apply removes that resource from the calculation at the next refresh.
That last point is where scores get gamed. Dismissing recommendations will lift the number without improving anything, so require a written reason for every dismissal and review them periodically.
Review Versus Advisor: Use Both
Advisor sees configuration: a VM without backup, a storage account open to the internet, an idle disk. It cannot see whether you have an incident response plan, agreed recovery targets or a tested rollback process. The Well-Architected Review captures those practices but relies on honest self-reporting. A good review session pulls the Advisor findings for the workload’s subscriptions alongside the questionnaire results and reconciles the two.
How The Framework Relates To The Cloud Adoption Framework And Landing Zones
Microsoft publishes two frameworks that are easy to confuse. The Cloud Adoption Framework (CAF) covers the organization: strategy, planning, governance, security, management and the shared platform across many workloads. The Well-Architected Framework covers the design quality of one workload at a time. Microsoft says directly that if you are improving a portfolio of workloads through centralized controls, CAF is the better fit and WAF guidance may not fully apply.
Azure landing zones are where the two meet. A landing zone, defined in CAF, has two parts: a platform landing zone, which is the central foundation of management groups, policy, connectivity, identity and security monitoring, and workload landing zones, where individual teams deploy their workloads inside the platform’s guardrails. The platform team owns the first; workload teams own the second.
In practice, the platform landing zone handles many organization-wide controls once (policy, networking, logging), and the Well-Architected Framework guides what each workload team builds on top. A workload review that finds “no central log collection” may really be a platform gap to raise with the landing zone owners rather than something the workload team should solve alone. If your environment does not yet have a landing zone, read our Azure landing zones guide before investing heavily in per-workload reviews.
Aspect
Cloud Adoption Framework
Well-Architected Framework
Scope
Organization and cloud estate
A single workload
Main audience
Cloud leadership, platform and governance teams
Workload architects, developers and operators
Key outputs
Adoption strategy, governance, landing zones
Workload design decisions and an improvement backlog
Typical timing
Before and during large-scale adoption
Design, pre-production and periodically in production
Assessment tools
CAF readiness and strategy assessments
Well-Architected Review, Azure Advisor
How To Use The Framework Step By Step
Microsoft’s own learning path suggests understanding the principles, prioritizing checklist items, reviewing trade-offs, finding a matching workload guide and then configuring services with the service guides. Turned into a working process, that looks like this:
Pick one workload. Start with something business-critical and well understood, not the whole estate.
Write down the requirements. Uptime, recovery time and recovery point objectives, performance targets, compliance obligations and a budget. Many findings depend on these.
Gather evidence. Architecture diagram, list of subscriptions and resource groups, current Advisor recommendations, Defender for Cloud secure score, cost data and recent incident history.
Run the Well-Architected Review. Answer as a group, honestly, and pick the matching workload type.
Prioritize. Microsoft recommends weighing checklist items by business criticality, compliance needs and time to market, and deferring what matters less for this workload.
Record trade-offs. When you decide not to add a second region, write down why. That decision log is as valuable as the fixes.
Fix in the backlog, not a slide deck. Put remediation items into the team’s normal work tracking with owners and dates, then rerun the review in three to six months.
The framework also includes a five-level maturity model, from establishing a foundation on Azure up to future-proofing with agility. It is a guide rather than a strict ladder, but it helps teams agree on a realistic next level instead of trying to adopt everything at once.
Running A Review Internally Versus With A Partner
Running It Internally
Everything you need is free and public, so an internal review is realistic for teams with an experienced Azure architect. A typical internal format is a half-day or day-long working session with the workload’s architect, a lead developer, someone from operations and someone from security, followed by a week of evidence checking and backlog writing. The main risks are blind spots and optimism: teams tend to score their own practices generously, and nobody is in a position to challenge a design decision they made themselves.
Running It With A Partner
Many Microsoft partners offer Well-Architected reviews as a fixed-scope engagement, often scoped to one workload or one pillar such as cost or reliability. A partner brings an outside view, patterns from other clients and the bandwidth to inspect configurations rather than rely on interviews. A partner makes most sense before a major launch, after a significant outage, ahead of an audit, or when the internal team lacks deep Azure experience. Engagement pricing varies widely by scope, so compare written statements of work rather than headline numbers. Our list of top Azure consulting companies is a starting point for project-based reviews.
If you want the findings fixed and then kept fixed, a managed service provider that runs your environment day to day can fold Advisor recommendations and periodic reviews into ongoing operations. See our top Azure managed service providers for that model.
What To Ask A Partner
Do you use the official Azure Well-Architected Review and pillar checklists, or a proprietary method, and how do they map?
Will you inspect live configuration (with read-only access) or rely on interviews only?
What does the deliverable look like: a prioritized backlog with effort estimates, or a slide deck?
How do you separate workload findings from landing zone or platform findings?
Is remediation priced separately, and are you free to recommend against your own services?
Which Microsoft Solutions Partner designations or specializations does your team hold for Azure, and can we verify them in the partner directory?
Typical Findings From A Well-Architected Review
Every workload is different, but certain findings come up again and again. These are patterns drawn from the framework’s checklists and Advisor categories, not statistics:
Reliability: no written recovery targets; production resources deployed in a single zone; backups configured but restores never tested; no failover rehearsal.
Security: standing administrator access instead of just-in-time elevation; secrets in app settings or pipelines rather than Azure Key Vault; storage or databases reachable from the public internet; open Defender for Cloud recommendations nobody owns.
Cost Optimization: oversized or idle VMs and databases; unattached disks and old snapshots; dev/test environments running around the clock; steady workloads still on pay-as-you-go rates; no budgets or cost alerts.
Operational Excellence: resources created by hand in the portal; no infrastructure as code; alerts that are either missing or so noisy they are ignored; no defined rollback process.
Performance Efficiency: no agreed performance targets; no load testing before release; scaling configured on a single fixed instance count; missing caching for read-heavy paths.
The fixes for many of these are small configuration changes. The harder findings are usually process ones, such as owning recommendations and testing recovery, which is why the review should end with named owners rather than just a score.
Frequently Asked Questions
Is The Azure Well Architected Framework Free To Use?
Yes. The documentation, checklists and the Azure Well-Architected Review assessment on Microsoft Learn are free. You pay only for any changes you make to your Azure resources, or for a partner if you hire one to run the review or remediation.
What Are The Five Pillars Of The Azure Well-Architected Framework?
Reliability, Security, Cost Optimization, Operational Excellence and Performance Efficiency. Each pillar has design principles, a design review checklist and a list of trade-offs against the other pillars.
How Often Should We Run A Well-Architected Review?
Microsoft frames the review as iterative rather than one-off. A practical rhythm is once during design, once before production launch, after any major architectural change or serious incident, and then every six to twelve months. Azure Advisor runs continuously in between.
Is A High Azure Advisor Score The Same As Being Well-Architected?
No. Advisor checks deployed configuration and can be raised by dismissing recommendations. It cannot see practices like recovery testing, incident response or deployment safety. Treat the score as one input next to the questionnaire-based review.
How Is This Different From The AWS Well-Architected Framework?
The ideas are similar, but they are separate frameworks with their own guidance, tools and service coverage. Microsoft’s version uses five pillars and ties into Azure Advisor, Defender for Cloud and Azure-specific service guides, so use the one that matches the cloud the workload runs on.
Conclusion
The Azure Well-Architected Framework is most useful when it is treated as a habit rather than an audit: define the workload’s requirements, run the Well-Architected Review honestly, compare it with Azure Advisor, record your trade-offs and work the backlog. Put the shared controls in your landing zone and use the five pillars to guide each workload built on top of it.
If you want outside help, compare the top Azure consulting companies for a one-time review or the top Azure managed service providers for ongoing operations, and explore more guides in our Microsoft Azure hub.
