Running cloud-native architectures at scale is like maintaining an aircraft in mid-flight. When everything is green on your monitoring dashboard, it feels like smooth sailing. But what happens when an entire Availability Zone drops out of nowhere, Entra ID tokens fail to refresh, or a sudden cache stampede hits your stateful backends?

In a distributed environment, failures are not a matter of if, but when. Traditional disaster recovery strategies rely on manual game days and rigid, siloed tests. Platform and site reliability engineering (SRE) teams often make the same mistake over and over: treating failure injection as an isolated experiment rather than an integrated, application-centric governance framework.

If you configure chaos tests manually per resource, your testing blueprints instantly fall out of sync the second an auto-scaling event triggers or a developer deploys a new microservice. Even worse, giving a testing framework unchecked permissions to trigger faults across your infrastructure presents a massive security vector.

This is where the new Public Preview of Azure Chaos Studio Workspaces and Scenarios steps in. It fundamentally shifts chaos engineering from fragmented, manual resource targeting to automated, application-centric resilience validation.

In this article, we will explore this new capability from a practical Platform Architecture and Zero Trust perspective. First, we will break down how the Workspace model redefines security blast radiuses. Then, we will walk through constructing a production-grade, multi-layered cascading failure using native Bicep infrastructure as code (IaC).

Traditional Chaos Studio testing relied on individual experiment resources. Each experiment required its own managed identity, its own role assignments, and hardcoded resource targets. If your application structure changed, your experiments broke.

The new Workspace model introduces a powerful abstraction layer. Instead of targeting raw VMs or databases individually, you point a Workspace at an application’s logical boundary—such as a subscription, resource group, or a custom service group.

Once defined, Chaos Studio automatically discovers all underlying resources within that scope and dynamically recommends out-of-the-box Scenarios: preconfigured, end-to-end orchestration paths that mirror real-world outage patterns.

When you transition to Workspaces, security is treated as a first-class citizen rather than an afterthought. As an engineer focused on aligning infrastructure with Zero Trust principles, what excites me most about this architecture is its dual-perimeter safety mechanism.

Chaos Studio enforces a strict two-layer authorization model

The managed identity acts as your ultimate blast-radius regulator. If a Scenario contains an action to simulate a database failover, the Workspace identity must explicitly hold the required RBAC role (like Contributor) on that target database asset. If that explicit permission assignment is missing, the platform drops the execution at runtime before your environment is impacted.

Let’s stop talking theory and implement a repeatable, automated chaos pipeline. In this walkthrough, we will define a custom Workspace and deploy a cascading failure scenario using Bicep.

Before proceeding, ensure you have:

We start by creating the central management boundary. We will leverage a system-assigned managed identity to keep our setup simple and tightly coupled with the workspace lifecycle.

Create chaos-workspace.bicep:

param location string = resourceGroup().location
param workspaceName string = 'chaos-app-workspace'

resource workspace 'Microsoft.Chaos/workspaces@2026-05-01-preview' = {
  name: workspaceName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    scope: {
      type: 'ResourceGroup'
      value: resourceGroup().id
    }
  }
}

output workspacePrincipalId string = workspace.identity.principalId

Deploy the workspace to your target resource group using the Azure CLI:

RESOURCE_GROUP="rg-resilience-testing"

az deployment group create \
  --resource-group $RESOURCE_GROUP \
  --template-file chaos-workspace.bicep

Before executing any faults, we must satisfy our Zero Trust constraints. We fetch the Workspace’s principal ID and grant it the explicit roles it needs to interact with our infrastructure.

# Fetch the principal ID from the previous deployment output
PRINCIPAL_ID=$(az deployment group show \
  --resource-group $RESOURCE_GROUP \
  --name chaos-workspace \
  --query properties.outputs.workspacePrincipalId.value -o tsv)

# Fetch your resource group ID scope
RG_ID=$(az group show --name $RESOURCE_GROUP --query id -o tsv)

# Assign Virtual Machine Contributor to handle zone shutdowns
az role assignment create \
  --assignee-object-id $PRINCIPAL_ID \
  --assignee-principal-type ServicePrincipal \
  --role "Virtual Machine Contributor" \
  --scope $RG_ID

# Assign Contributor to allow PostgreSQL database failovers
az role assignment create \
  --assignee-object-id $PRINCIPAL_ID \
  --assignee-principal-type ServicePrincipal \
  --role "Contributor" \
  --scope $RG_ID

Standard out-of-the-box templates (like blocking DNS traffic via port 53 or simulating full Entra ID drops) are fantastic. But for complex cloud-native architectures, we need to replicate how real incidents unfold.

We will deploy a custom Scenario using the Bicep orchestration engine. This test will shut down virtual machines in a specific Availability Zone, wait for the dependency to transition into a Running state, and immediately trigger a PostgreSQL Flexible Server failover to see how gracefully our application logic recovers.

Create custom-scenario.bicep:

resource workspace 'Microsoft.Chaos/workspaces@2026-05-01-preview' existing = {
  name: 'chaos-app-workspace'
}

resource customScenario 'Microsoft.Chaos/workspaces/scenarios@2026-05-01-preview' = {
  parent: workspace
  name: 'zone-down-then-db-failover'
  properties: {
    description: 'Shut down a zone, then fail over the database.'
    parameters: [
      {
        name: 'zone'
        type: 'string'
        required: true
        description: 'Availability zone to take down.'
      }
    ]
    actions: [
      {
        name: 'shutdown-zone'
        actionId: 'microsoft-compute-shutdown/1.0'
        description: 'Shut down VMs in the target zone.'
        duration: 'PT10M'
        parameters: [
          {
            key: 'zones'
            value: '%%{parameters.zone}%%'
          }
        ]
      }
      {
        name: 'db-failover'
        actionId: 'microsoft-azurePostgreSql-failover/1.0'
        description: 'Fail over the PostgreSQL flexible server.'
        duration: 'PT5M'
        runAfter: {
          behavior: 'All'
          items: [
            {
              type: 'Action'
              name: 'shutdown-zone'
              onActionLifecycle: 'Running'
            }
          ]
        }
      }
    ]
  }
}

Apply the scenario layout directly to the active workspace scope:

az deployment group create \
  --resource-group $RESOURCE_GROUP \
  --template-file custom-scenario.bicep

To ensure real-time web users don’t suffer from lagging responses because of bulk background batch jobs, we can enforce strict routing priorities using the experimental InferenceObjective CRD:

apiVersion: inference.networking.k8s.io/v1alpha1
kind: InferenceObjective
metadata:
  name: critical-chat-traffic
  namespace: inference
spec:
  poolRef:
    group: inference.networking.k8s.io
    kind: InferencePool
    name: vllm-qwen2-5-0-5b
  priority: 10

By passing the custom header -H 'x-gateway-inference-objective: critical-chat-traffic' from your user interface workloads, the EPP scheduler automatically prioritizes this execution thread and sheds background queue stress when the GPU node hits high saturation levels.

You can test and verify this priority routing behavior directly with the following execution payload:

curl -i http://${GATEWAY_ADDRESS}/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -H 'x-gateway-inference-objective: critical-chat-traffic' \
  -d '{
    "model": "Qwen/Qwen2.5-0.5B-Instruct",
    "messages": [{"role": "user", "content": "What is 2+2? Answer in one word."}],
    "max_tokens": 10
  }'

Now that our orchestration boundaries and policies are deployed, we can initiate a controlled game-day test directly using the Azure CLI. We pass our parameter target to simulate an outage specifically in Availability Zone 1:

# Trigger the orchestrated scenario execution
az rest --method post \
  --uri "https://management.azure.com${RG_ID}/providers/Microsoft.Chaos/workspaces/chaos-app-workspace/scenarios/zone-down-then-db-failover/run?api-version=2026-05-01-preview" \
  --body '{"parameters": {"zone": "1"}}'

Once the simulation completes, Chaos Studio automatically generates a comprehensive Scenario report. If a developer accidentally removed an RBAC policy or changed a service tag, the platform pinpoint-isolates exactly which action failed and why, producing audit logs designed for DORA compliance frameworks and team retrospectives.

# Fetch the latest workspace scenario execution logs
az rest --method get \
  --uri "https://management.azure.com${RG_ID}/providers/Microsoft.Chaos/workspaces/chaos-app-workspace/scenarios/zone-down-then-db-failover/executionDetails?api-version=2026-05-01-preview"

As Platform Engineers and Architects, we must move away from defensive engineering and aggressively embrace chaos. Building high-availability architectures on paper means nothing if your actual downstream systems suffer from cascading timeout patterns and pool exhaustion under pressure.

The Public Preview of Workspaces and Scenarios in Azure Chaos Studio provides a highly structured solution. By centralizing identity lifecycles, separating authorization domains, and allowing declarative Bicep engineering, platform teams can now confidently embed continuous injection pipelines into their standard application delivery workflows.

The structural blueprint remains simple:

Thank you for taking the time to explore this guide! Keep pushing your boundaries, stay curious, and continue engineering infrastructure that doesn’t just survive failures—but expects them.