Back in March I wrote a blog about an early version of Azure Canvas. It looked pretty but I quickly realized it would go nowhere as a downloadable C# app and I abandoned it before I expanded it further. What I needed was a webapp which was truly accessible. I’m happy to say the 2.0 is here and is more-or-less feature complete. At least, I think so, but I welcome and further suggestions for improvement, especially from those who are involved with this kind of thing day to day. Please post any suggestions in the comments below. I will read them and take them onboard.

Azure architecture often starts as boxes and arrows, becomes Infrastructure as Code, and eventually meets Azure Resource Manager, which may have several opinions about your boxes and arrows.

Azure Canvas brings those stages together in one free, browser-based tool. You can design an Azure environment visually, import existing resources, validate the design against a live subscription, generate templates, and deploy directly to Azure.

Try it: https://azure-canvas.com/

A diagram that understands Azure

Azure Canvas is more than a collection of draggable icons. It understands placement and relationships:

– VNets contain subnets.

– VMs, NSGs, route tables, NAT gateways, private endpoints, and Application Gateways live in subnets.

– VPN Gateway, Azure Bastion, and Azure Firewall receive their required reserved subnets.

– VNet peerings, VPN connections, public IP associations, monitoring links, identities, and application dependencies are represented explicitly.

The searchable toolbox covers networking, compute, containers, storage, databases, security, observability, messaging, and events. Resource-type captions are shown on badges by default, while right-click Explain provides a summary, typical connections, and a Microsoft Learn link.

Import what already exists

After signing in with Microsoft Entra ID, Azure Import can map either an entire resource group or one VNet with its connected resources.

The import is read-only and reconstructs relationships from Azure Resource Manager IDs. Imported resources can replace the current canvas or be added to it, which is useful when combining environments or subscriptions into a larger architecture view. Unsupported resource types are reported rather than silently ignored.

Imported resources retain their subscription name and region. Azure Canvas can display these as visual-only Subscription and nested Region boundaries, helping distinguish production, development, disaster-recovery, or cross-subscription environments without forcing Resource Groups to dominate a high-level network diagram.

Practical diagramming features

The canvas now includes:

– Arrange Canvas, including extra spacing for peered VNets and a separate Resource Group metadata rail.

– Change Region to update the design to a different Azure region.

– Marquee selection, Shift+click selection, group movement, keyboard deletion, and dependency-aware cleanup.

– Resizable VNets and automatic subnet layout.

– Freestyle Text Boxes for notes and dashed callouts attached to resources.

– Compact Labels that sit directly on an existing connection or object border for details such as `TCP 443`, protocols, or IP information. Labels move with their target and do not create extra connection lines.

– Light and dark modes.

– JSON import/export and browser-local saving.

The **Load Example** button creates a randomized, fully wired architecture for exploring the tool. The generated design is connected from the start rather than presenting a collection of empty relationship dropdowns.

Better network configuration

Route Tables now support multiple UDR entries. Each route has its own name, address prefix, next-hop type, and optional virtual-appliance IP address.

All routes are:

– Editable in the Properties panel.

– Imported from existing Azure route tables.

– Checked by diagram validation.

– Included in generated ARM JSON and Bicep templates.

NSGs also account for service-specific requirements. For example, when an NSG shares a subnet with Application Gateway v2, Azure Canvas includes the required `GatewayManager` traffic rule instead of waiting for Azure to explain the omission during deployment.

Validate against a real subscription

Validate Design combines local architecture checks with live Azure checks, including:

– Resource provider registration.

– Region availability.

– VM size availability by region.

– Storage account name availability.

– CIDR validity and overlap.

– Required subnet and resource relationships.

– Service-specific constraints.

Warnings remain advisory, while structural errors block deployment.

Generate or deploy

The Generate menu provides:

– A deployable Bicep template.

– A deployable ARM JSON template.

– A Terraform starter configuration for the currently supported Terraform resource set.

For the shortest route from diagram to Azure, Azure Deploy submits the generated ARM JSON directly to Azure Resource Manager. No local Azure CLI or Bicep compiler is required.

Deployment progress is monitored for up to 60 minutes to accommodate slower services. VPN Gateway and Azure Bastion designs display timing warnings before deployment. Azure errors are shown in selectable text, with nested failure details extracted where possible.

If a Resource Group already exists in another region, Azure Canvas explains the conflict and offers two sensible recovery paths: align the design using Change Region, or open the existing Resource Group in Azure Portal and delete it only if it is an unused failed deployment.

Lessons from deploying for real

Building Azure Canvas has reinforced that “valid template” and “Azure will deploy it” are not the same sentence.

Real deployments exposed retired VM image SKUs, regional resource mismatches, provider-registration limitations, subnet dependency races, gateway timing, quota limits, Application Gateway NSG requirements, and API properties that are technically mandatory even when their value is an empty array.

Every one of those failures improved the generator and the deployment experience. Azure remains an enthusiastic reviewer.

Privacy and access

Azure Canvas runs in the browser. Diagrams can be stored locally or exported as JSON. Azure access uses the signed-in user’s delegated permissions, and Azure Import is read-only. There is no application backend receiving your diagram by default.

Who is it for?

Azure Canvas is for architects, network and security teams, engineers, students, and anyone who prefers to understand an environment visually before expressing it as code.

It is free, actively evolving, and shaped by practical feedback from people designing and operating real Azure environments.

Try Azure Canvas: https://azure-canvas.com/