Skip to content

What You Get: a Spoke

A spoke is your product on the platform: an Azure subscription for one workload in one environment, set up and connected for you.

Per spoke

You get Details
A subscription Renamed to the agreed name (for example sub-app1-dev), tagged, and placed in the right management group (for example corp for internal workloads, online for internet-facing ones)
A network A virtual network with the subnets, NSGs and route tables you asked for, connected to the hub. DNS points at the central DNS resolver, so private endpoints resolve automatically.
Outbound internet through the central firewall By default, internet traffic goes through the hub firewall. Only destinations with a firewall rule are allowed.
Access groups Four Entra ID groups: …_Owners, …_Contributors, …_Readers, …_Support. Your team's existing group is made a member, either directly or through PIM (just-in-time).
A service principal SPN-SPOKE-<workload>-<env> with Owner on the subscription, for your own deployment pipelines. Its secret is in your Key Vault, or it uses federated credentials. How credentials work: Spoke canvas.
A Key Vault RBAC mode, private endpoint (on by default)
A storage account Customer-managed key, private endpoint (on by default)
A Log Analytics workspace For your own logs and alerts (on by default)
Optional: an Azure DevOps repository and service connection If you ask for it
Optional: managed virtual machines If your platform offers the Managed VM module (Managed virtual machines)
Optional: a data, integration, AI or Kubernetes platform If your platform offers one: Base Fabric Data Platform, Integration Platform, AI Platform or AKS Platform
Optional: a developer portal If your platform offers it: the Agentic Developer Portal with your workloads, cost and security views and AI agents
Optional: shared services Access to shared APIM, ACR, Service Bus or Event Hub, if your platform has them

From the platform, for every spoke

Included What it means for you
Security baseline Azure Policy initiatives (ISO 27001, CIS, Microsoft cloud security benchmark, NIS2) assess your resources. Some policies deny non-compliant deployments.
Central DNS Private endpoints are registered in the central private DNS zones by policy.
Monitoring baseline Azure Monitor Baseline Alerts for platform components; Service Health alerts.
Defender for Cloud If enabled for spokes on your platform.
Optional publishing Inbound web traffic through the central Application Gateway with WAF, on request.
Optional hybrid connectivity Reaching on-premises networks through the hub VPN or ExpressRoute, with firewall rules.

Spoke variants

Variant What it is
Standard spoke The default, described above
Sandbox A subscription for experiments, with no connection to the hub, to other workloads or to internal networks. No spoke resources. See New sandbox subscription.
Managed spoke A standard spoke where the platform team also builds and maintains the resources of your workload, under a separate agreement. Suited to teams that are still learning Azure or are too small to run the workload technically. See Service types and Managed spokes.

Your workload

A workload is your business solution as the platform sees it: the owner, the groups, optionally a project in Azure DevOps and the spokes for each environment. One workload normally has a spoke for production data and one or more spokes for non-production data. See Architecture reference.

Environments

You normally get one spoke per environment, for example:

Environment Use
dev Development and experiments
tst Test
acc Acceptance, production-like
prd Production. Only here may you process production data.
shared Shared components used by several environments

Each environment is its own subscription with its own network range, groups and Key Vault.

Policies can differ per environment

A common choice is to assign the security initiatives as audit in dev and tst, so you see compliance without being blocked, and as deny in acc and prd. Check compliance in the lower environments regularly and fix issues before you promote. Ask your platform team which effect applies where (Policy and exemptions).

Baseline resources are for the baseline

The Key Vault, storage account and Log Analytics workspace of the baseline support the spoke itself. Check with your platform team what the storage account is meant for (on some platforms it holds the state files of your infrastructure as code) before you put application data in it. Deploy storage for your application with your own code, together with the rest of your infrastructure. Enable a private endpoint for a baseline resource only if you use it.

Not included