Comparing Azure Compute network isolation options for multi-tenant SaaS

Cloud Platforms Microsoft Azure
, , , , , , , ,
1

I’m designing network isolation for a multi-tenant SaaS platform on Azure Compute and evaluating different approaches. We need strict tenant separation at the network level while maintaining efficient resource utilization.

I’m comparing three main patterns: dedicated Virtual Networks per tenant with VNet peering, shared VNet with NSG-based isolation, and Application Gateway with path-based routing combined with Azure Firewall for egress control. Each has trade-offs in terms of management overhead, cost, and security posture.

Has anyone implemented multi-tenant network isolation at scale? What patterns worked best for balancing security requirements with operational complexity?

2

We went with dedicated VNets per tenant initially but hit Azure subscription limits around 50 tenants. The management overhead was brutal - each VNet needed its own NSGs, route tables, and peering connections. We’ve since migrated to a hub-spoke model with shared services VNet and tenant-specific subnets. Much more scalable but requires careful NSG rule management.

3

Application Gateway with WAF rules per tenant works well for our use case. We use path-based routing (/tenant1/, /tenant2/) and backend pools pointing to tenant-specific VM scale sets. Azure Firewall handles all egress traffic with tenant-specific FQDN rules. The challenge is managing firewall rules as tenants grow - we automated rule generation through ARM templates.

4

We run Application Gateway in autoscale mode with minimum 2 instances for HA. Scaling is smooth but takes 3-5 minutes to add capacity. For Azure Firewall latency, we see roughly 2-3ms overhead on average. The bigger concern is throughput - standard SKU maxes at 30 Gbps. We route only internet-bound traffic through Firewall and use Service Endpoints for Azure services to bypass it.

5

Thanks for the insights. The Application Gateway approach seems promising but I’m concerned about the single point of failure. How do you handle Gateway scaling during traffic spikes? Also, does Azure Firewall introduce noticeable latency for tenant egress traffic?

6

After implementing multi-tenant isolation for several Azure customers, here’s my perspective on the three patterns:

Virtual Network Isolation: Dedicated VNets provide the strongest isolation but don’t scale beyond 50-100 tenants due to peering limits and management complexity. Best for enterprise scenarios with large tenants who need complete network autonomy. Use VNet peering for inter-tenant communication when required, but expect operational overhead managing routing and connectivity.

Application Gateway with Azure Firewall: This is the sweet spot for most SaaS platforms. Application Gateway provides L7 routing and SSL termination with tenant-specific backend pools. Key considerations:

  • Use WAF policies to enforce tenant-specific security rules
  • Configure custom health probes per tenant backend
  • Azure Firewall handles egress filtering with FQDN rules (critical for compliance)
  • Implement Azure Front Door in front of App Gateway for global distribution and additional DDoS protection

Latency impact is minimal (2-5ms) and throughput scales well. The management overhead is reasonable with proper automation.

Shared VNet with NSG Isolation: Most cost-effective but requires rigorous security controls. We use this pattern with Azure Policy governance:

  • Each tenant gets a dedicated subnet with strict NSG rules
  • Application Security Groups (ASGs) simplify rule management as you scale
  • User-Defined Routes force all traffic through an NVA for additional inspection
  • Continuous compliance monitoring via Azure Security Center

The risk is misconfigured NSGs allowing lateral movement. This pattern works well when combined with application-level tenant isolation and strong identity controls.

For your platform, I’d recommend the Application Gateway + Azure Firewall approach. It balances security, scalability, and operational efficiency. Start with path-based routing and evolve to multi-site configuration as tenant count grows. Automate firewall rule deployment through CI/CD pipelines to maintain consistency.

7

The shared VNet approach with NSG isolation is the most cost-effective but has security trade-offs. You’re relying on NSG rules to prevent lateral movement between tenant subnets. We use Azure Policy to enforce NSG standards and audit configurations continuously. Application-level isolation is equally important - don’t rely solely on network controls.