# How Azure Protects Your Mobile App

> The 5 layers standing between your app and the database.

- **Format:** short video, 8 steps, ~26 seconds
- **Topic:** The real shape of a secure mobile backend on Azure — app, Front Door with WAF, your own API, Microsoft Entra ID and a database with no public address — assembled one node at a time so the viewer sees that the app never touches the data.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-16
- **Tags:** azure, security, systemdesign, microsoftentraid, azurefrontdoor, apisecurity, cloudarchitecture, mobilesecurity, dotnet, azuresql, devsecops, microsoftazure, az204, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/azure-mobile-app-layers/

---
## What you'll learn

- Why an app talking straight to a database is the bug, not a shortcut
- Why authentication and authorization are two different checks, not one
- Why a private endpoint means the database has no public address to attack

## Understand it one step at a time

### 1. Most people draw this

The app, the database, and a straight line between them — the shape everyone reaches for first, and the shape that gets you breached.

### 2. That line is the whole attack

No token, no owner check, and a database sitting on the internet — that one line is your entire attack surface.

### 3. Front Door meets it first

The WAF runs the OWASP ruleset and drops SQL injection and bad bots at the edge — before a container spins up or a database connection opens.

### 4. Your API is the only door

It is the one public thing you own, and the only place that holds credentials for anything. Everything else hides behind it.

### 5. Entra ID proves who is calling

Your API validates the token's signature, issuer and audience against Microsoft's published keys — a local check, no extra network call.

### 6. Then: what may she see?

Entra ID says she is Priya. Your API still has to decide Priya only gets Priya's rows — that's a WHERE clause, not middleware.

### 7. The database has no address

Private endpoint on, public access off. The database gets a private IP — no internet-facing address left to scan or misconfigure.

### 8. The app never touches it

Four checks in front — WAF, your API, Entra ID, authorization — and no public address behind. The app never touches the data.

---

## The takeaway

**The app never touches the database.**

Four checks in front of it, and no public address behind — that is the whole shape.