How would you design a secure network architecture in Azure?

Work outside in, applying defence in depth.

• Virtual networks and subnets. Segment by tier — web, application, data — with each in its own subnet so traffic between them can be controlled.
• Network Security Groups on subnets and network interfaces, allowing only required ports from required sources. Deny by default; the data subnet should accept traffic only from the application subnet, never from the internet.
• Private endpoints for PaaS services. This is the most important single measure: it gives Azure SQL, Storage, and Key Vault a private IP inside your virtual network and lets you disable public access entirely. Without it, those services are internet-reachable and protected only by credentials and firewall rules.
• A hub-and-spoke topology for anything beyond a small estate — shared services such as firewall, DNS, and gateways in the hub, workloads in peered spokes.
• Azure Firewall for centralised egress filtering, and Application Gateway with WAF for inbound HTTP, protecting against common web attacks. Front Door where you need global routing plus WAF and DDoS protection at the edge.
• Bastion for administrative access, so virtual machines need no public IP and RDP or SSH is never exposed.

Note: Add that you would enforce this with Azure Policy — denying public IPs on VMs and requiring private endpoints — rather than relying on reviewers to notice.