# Managed Dedicated: Azure Architecture

A Managed Dedicated instance on Azure runs in its own virtual network (VNet), in
an Azure subscription that Zuplo manages, in the Azure region you choose. Zuplo
provisions, operates, scales, and upgrades the instance. You don't need an Azure
subscription to use it, but you need one to connect it to backends in your own
VNet.

For the components that make up every Managed Dedicated instance, see
[Architecture](../architecture.mdx).

## Availability

The gateway runs across the availability zones in your region. If one zone
fails, the other zones keep serving traffic.

To run in more than one region, contact your account manager.

## Inbound traffic

Clients reach the gateway through a public load balancer. Zuplo terminates TLS
and manages the certificates, including for your
[custom domains](../custom-domains.mdx).

To put a CDN or WAF, such as Azure Front Door, in front of the gateway, make
sure clients can't bypass it and call the gateway directly. Have the CDN add a
shared secret header that the gateway checks, or authenticate the CDN with
[client mTLS](../../articles/securing-the-gateway-with-client-mtls.mdx).

## Outbound traffic and IP addresses

The gateway reaches the internet through a NAT gateway with a fixed public IP
address. If your backend or a third-party API allowlists callers by IP address,
ask your account manager for this address.

## Connecting to your backends

The gateway can call any backend it can reach over the internet. To keep backend
traffic off the public internet, use Private Endpoint or VNet peering. See
[Azure Private Networking](./private-networking.mdx).

However your backend is reached, make sure it only accepts requests from your
gateway. See [Securing your backend](../../articles/securing-your-backend.mdx).