
When I first wrote about Azure Canvas, the easy pitch was “draggable Azure icons in your browser.” That was never the point, and the gap between the two has widened considerably since. Azure Canvas is not a diagramming tool that happens to use Azure shapes — it is an architecture designer that understands what those shapes mean, what they are allowed to do, and whether Azure will actually accept them.
The distinction matters, because anyone can push coloured rectangles around a canvas. The hard part is a canvas that pushes back.
As ever, the tool is free and runs entirely in the browser.
Try it: https://azure-canvas.com/
A canvas that understands Azure
Every object in Azure Canvas carries the rules of the real service behind it, and the canvas enforces them as you design:
– VNets contain subnets; VMs, NSGs, route tables, NAT gateways, private endpoints, and Application Gateways live inside subnets rather than floating in space.
– VPN Gateway, Azure Bastion, and Azure Firewall claim their required reserved subnets automatically, because Azure insists on them and so should the diagram.
– Peerings, VPN connections, public IP associations, identities, monitoring links, and application dependencies are modelled as real relationships, not decorative arrows.
– Service‑specific obligations are handled for you — an NSG sharing a subnet with Application Gateway v2 gets its GatewayManager rule without you needing to remember it at 11pm.
The result is a design that is structurally correct by construction. You are not drawing a picture of an architecture; you are building the architecture, and the picture is a side effect.
From design to validated to deployed
The reason the modelling matters is that the diagram is the start of a pipeline, not the end of one:
– Import reconstructs an existing resource group or VNet and its connected resources directly from Azure Resource Manager, read‑only, with subscription and region boundaries intact.
– Validate Design combines local structural checks with live Azure checks — provider registration, region and VM‑size availability, storage name availability, CIDR overlap, required relationships, and service constraints — so problems surface before deployment, not during it.
– Generate produces deployable Bicep, ARM JSON, and a Terraform starter from the same model.
– Deploy submits the generated template straight to Azure Resource Manager, no local CLI or compiler required, and monitors progress with the timing warnings that gateways and Bastion have taught it to give.
Each stage reads from one architecture‑aware model. That is what separates this from a drawing app: the boxes are not the artifact, they are the source of truth that everything else is derived from.
Taking the design elsewhere
Because the model is real, the outputs are too. Alongside JSON import/export and browser‑local saving, Azure Canvas can now hand your design to the places architectures tend to end up — exporting to native Visio for design packs that have to live in someone else’s document, and printing a design that crops, scales, and fits itself to the page instead of fighting you. Useful, unglamorous, and firmly in service of the design rather than the headline.
Who it’s for
Azure Canvas is for architects, network and security teams, engineers, and students — anyone who prefers to understand an environment visually before committing it to code, and who wants the visual to be more than a pretty guess.
It is free, actively evolving, and shaped by people designing and operating real Azure environments. Suggestions are welcome in the comments; I read them, and Azure remains an enthusiastic reviewer of the rest.
Try Azure Canvas: https://azure-canvas.com/









