The Prisma SD-WAN Azure Virtual Deployment guide provides instructions for deploying Prisma SD-WAN ION devices to Microsoft Azure. It is intended for network administrators who plan to extend the Prisma SD-WAN fabric between existing or, to be deployed data centers in Azure VNETs hosting applications and the rest of the corporate locations; thereby allowing administrators to align their WAN policies with business intent for performance, security, and compliance.

Figure 1 shows an example of branch deployments connecting to applications hosted in different Azure VNETs, with a Prisma SD-WAN ION in Azure acting in a data center deployment model.

With cloud services such as Azure, there may be a single Resource Group with workloads behind it as previously shown. However, there may be instances where there are multiple workloads and associated resource groups.

To accomplish this, Microsoft implements Virtual network peering. With this type of deployment, a Prisma SD-WAN ION may be placed in the logical location where the Azure VPN is shown depending on the design of the organization. Refer here for more information on VPN Gateway Peering.