Infrastructure Overview

Architecture Diagram

The Mastra Agent Framework is deployed as a containerized application with supporting Azure services for AI, storage, security, and networking.

Authentication Flow

Deployment Order

Resources are deployed in dependency order:

Resource Components

Core Infrastructure

Component	Purpose	SKU Options
Resource Group	Container for all resources	N/A
User-Assigned Managed Identity	Passwordless auth to all Azure services	N/A

Compute

Component	Purpose	SKU Options
App Service Plan	Hosts App Service and Function App	F1, B1-B3, S1-S3, P0v3-P3v3
App Service	Main API (container-based, Linux)	Inherits from plan
Function App	Background processing (container-based)	Inherits from plan

Data & Storage

Component	Purpose	SKU Options
Azure SQL Server	Primary relational database	Basic, S0-S12, P1-P15
Storage Account	Blobs, Files, Tables, Queues	Standard_LRS
Container Registry	Docker image repository	Basic, Standard, Premium

AI Services

Component	Purpose	SKU Options
Azure AI Services	Azure AI model deployments	S0
Content Safety	Content moderation for TAP	F0, S0
Form Recognizer	Document Intelligence	F0, S0
AI Search	Vector search, indexing	Basic, Standard

Security & Networking

Component	Purpose	SKU Options
Key Vault	Secrets, connection strings	Standard, Premium
API Management	Gateway, JWT/subscription auth	Developer, Basic, Standard
VNet	Network isolation	N/A
Private Endpoints	Private connectivity to services	N/A

Monitoring

Component	Purpose	SKU Options
Application Insights	Logging, metrics, traces	Pay-as-you-go
Log Analytics Workspace	Log aggregation	Pay-as-you-go

Resource Naming Convention

All resources follow a consistent naming pattern:

{environment}-{projectPrefix?}-{projectName}-{resourceType}

Examples

Environment	Project Prefix	Project Name	Resource	Final Name
dev	-	aitools	App Service	`dev-aitools-app`
staging	k12	aitools	SQL Server	`staging-k12-aitools-sql`
prod	tap	aitools	Key Vault	`prod-tap-aitools-kv`

Resource Group Naming

{ENVIRONMENT}-{projectPrefix?}-{projectName}-rg

Example: DEV-aitools-rg or STAGING-k12-aitools-rg

Private Endpoints Architecture

Only data-storing services require Private Endpoints:

note

Why no Private Endpoints for some services?

ACR: Basic SKU doesn't support PE; stores container images, not business data
Content Safety: Processes data transiently, no persistent storage
Form Recognizer: Processes documents transiently, no persistent storage

Architecture Diagram​

Authentication Flow​

Deployment Order​

Resource Components​

Core Infrastructure​

Compute​

Data & Storage​

AI Services​

Security & Networking​

Monitoring​

Resource Naming Convention​

Examples​

Resource Group Naming​

Private Endpoints Architecture​

What to Read Next​