---
title: "Azure Deployment"
description: "The image shows a possible architecture of walt.id Enterprise deployed in the Azure Cloud."
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/setup/deployment/azure-deployment
generated: 2026-07-20
---
# Azure Deployment

The image shows a possible architecture of walt.id Enterprise deployed in the Azure Cloud.
![image](https://docs.walt.id/img/enterprise-stack/concepts/azure-deployment.png)

## Infrastructure
This infrastructure is optional. It is needed when you deploy AKS or CosmosDB Cluster in private mode (not public accessible)

* __Bastion:__ All sensitive endpoints are not publicly exposed. In order to connect to internal services,you need to connect to the jumphost via the bastion first. If you want to restrict access of some user to internal service, you just need to revoke access to the bastion. The user might still possess credentials for the services, but can not log on, because he cannot connect to the service.
* __JumpHost:__ This is a linux vm which serves as SOCSK5 proxy by tunneling through SSH connection.
* __VNET:__ A VNET which connects the bastion with the jumpHost. The vnet is peered with all environment VNETs

## Walt.Id Environment
* __AKS:__ Hosts the Walt.Id Enterprise service
* __Application Gateway:__ Exposes Walt.id Enterprise service to public. In Azure are several options available.
* __CosmosDB Mongo__
* __VNET:__ The VNET connects CosmosDB, AKS and Application Gateway

**Note:**

This is only one possible architecture. The Walt.Id Enterprise Service can be easily integrated in any already existing
Azure Cloud infrastructure.

**Note:**

Terraform examples can be provided, which demonstrates how to set up enterprise stack.