---
title: "Azure Reference Architectures"
url: "/docs/proxy/deploy/cloud/azure"
canonical_url: "https://docs.litellm.ai/docs/proxy/deploy/cloud/azure"
type: "docs"
last_updated: "2026-11-12"
summary: "Deploy LiteLLM on AKS with a private Application Gateway frontend, corporate network access, private endpoints, and NAT egress."
related:
  - "/docs/proxy/deploy/cloud/overview"
  - "/docs/proxy/deploy/cloud/aws"
---
# Azure Reference Architectures

> Index of all LiteLLM docs: https://docs.litellm.ai/llms.txt


Connect corporate users and applications through VPN, ExpressRoute, or an approved private access service. Use private DNS and a private Application Gateway frontend. Keep AKS and data connections private. NAT Gateway serves outbound provider calls.

## Helm on AKS {#deploy-this-architecture}

Deploy separate gateway, backend, and UI services with [Helm](../helm.md). Provide the VNet, private AKS cluster, Application Gateway, databases, private endpoints, and corporate network routes.

Use Application Gateway v2 with a private-only frontend in its dedicated subnet. Delegate that subnet to `Microsoft.Network/applicationGateways`. Allow corporate client ranges to reach HTTPS on the private frontend. Configure private DNS for the gateway hostname. See [private Application Gateway deployment](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-private-deployment).

Use AGIC v1.7 or later. Set `appgw.ingress.kubernetes.io/use-private-ip: "true"` on the LiteLLM Ingress. AGIC ignores this annotation when the gateway has no private IP. It sends requests directly to pod private IPs. Set routes and health probes for your service layout. See [AGIC private IP configuration](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-private-ip).

Associate NAT Gateway with the AKS subnet for outbound public API calls. Keep PostgreSQL, Redis, and optional Azure OpenAI private endpoints on their private paths. Disable public access to these data services and link their private DNS zones to the VNet.

For identity checks, see [Microsoft Entra Application Proxy](../iap/overview.md#azure). For client certificates, see [Client Authentication with mTLS](../mtls.md). For replicas and rollouts, see [High Availability](../ha/overview.md).

## Related pages

- [Overview](https://docs.litellm.ai/docs/proxy/deploy/cloud/overview.md)
- [AWS](https://docs.litellm.ai/docs/proxy/deploy/cloud/aws.md)