---
title: Solution Architecture Overview
slug: solution-architecture-overview
createdAt: 2025-06-09T20:07:24.136Z
---

This overview describes how Activate components fit together in a secure, scalable, and operable solution. It focuses on logical layers, trust boundaries, identity, data, and operational concerns so you can adapt the design to on-premises, hybrid, or cloud-only models.

# Architectural Layers

## Presentation Layer

- **Activate Web**: End-user and admin portal (dashboards, self-service, approvals, admin tools).
- Enforces HTTPS and Content Security Policy.
- Integrates with the chosen identity provider for SSO and MFA.

## Orchestration Layer

- **Activate Orchestrator**: Executes workflows (scheduled, event-driven, on-demand).
- Manages queues, retries, and transactional steps.
- Uses service accounts and connector credentials to call downstream systems.

## Configuration & Design Layer

- **Activate Studio**: Design-time configuration for workflows, parameters, connectors, forms, and security model (roles, permissions).

## Integration Layer

- **Activate API**: REST interface for inbound and outbound integrations.
- Connectors/adapters for Microsoft 365, Exchange Online, Active Directory, ticketing/ITSM, and custom REST/SOAP endpoints.
- **Activate Anywhere** (optional): Proxy component for DMZ or segmented networks to bridge internal resources safely.

## Data Layer

- **Activate Database**: System-of-record for configuration, workflow state, audit history, cached directory data, and indexes.
- Hosted on an enterprise SQL Server instance (including servers hosted in Azure).

  Use enterprise SQL backup/HA strategies; avoid platform features that are incompatible with Activate.


# Environments and Separation

## Typical Environment Set

- **Development** → **Test/UAT** → **Production** (optionally **Pre-Prod**).
- Configuration and content are promoted through controlled pipelines and change control.

## Trust Boundaries

- Public/DMZ (optional) → App tier → Data tier.
- **Activate Anywhere** can terminate or relay requests at the boundary to avoid exposing internal resources.

# Identity, Access, and Security

## Authentication

- SSO via Azure AD or other supported identity providers.
- MFA and conditional access enforced at the IdP.

## Authorization

- Role-based access control in Activate (roles, permissions, policies).
- Service accounts with least privilege for orchestration and connectors.

## Secrets Management

- Store credentials and API keys in secure parameters or a vault solution.
- Rotate secrets on a defined schedule; audit all access.

## Network Security

- HTTPS only for **Activate Web** and **Activate API**.
- Restrict inbound ports at each tier; allow only required egress to third-party APIs.
- Optional IP allowlists or private networking for admin and API endpoints.

# Data and Integrations

## Data Flow (High-Level)

1. User initiates a request in **Activate Web** (or via **Activate API**).
2. Request is persisted and queued in the **Activate Database**.
3. **Activate Orchestrator** processes workflow steps, calling connectors or external APIs.
4. Results and audit events are written back to the database and surfaced in the UI.
5. Notifications/approvals are sent via email or chat integrations where configured.

## Directory and Messaging

- Cloud-only: Operates against Azure AD and Exchange Online without on-prem domain controllers.
- Hybrid: Supports mixed mailbox and identity footprints with secure connectivity to both sides.
- On-prem: Direct integration with AD/Exchange and other on-prem systems.

# Availability, Performance, and Scale

## Scale-Out Patterns

- **Web**: Horizontal scale behind a load balancer; stateless requests.
- **Orchestrator**: Multiple workers/instances for parallel workflow execution.
- **Database**: Sized for IOPS and memory; monitor query performance and indexing.

## High Availability

- Multiple web instances across zones where possible.
- Orchestrator worker redundancy.
- SQL Server HA using clustering/AGs according to enterprise standards.

## Caching and Indexing

- Maintain directory cache and search indexes for fast lookups.
- Schedule background tasks to keep caches current without overloading upstream services.

# Operations, Observability, and Governance

## Logging and Monitoring

- Centralised logs for **Web**, **Orchestrator**, and **API** (requests, errors, workflow telemetry).
- Health checks and synthetic transactions for key user journeys.
- Alerts on queue backlogs, job failures, connector timeouts, and auth errors.

## Auditing and Compliance

- Comprehensive audit trail for user actions, approvals, and workflow changes.
- Retention policies aligned with regulatory requirements.

## Backup and Recovery

- Regular full and differential backups of the **Activate Database** with tested restores.
- Export configuration baselines from **Activate Studio** for rapid rebuilds.
- Documented runbooks for DR and environment rehydration.

# Deployment Topologies (Examples)

## Cloud-Only (Identity and Messaging)

- Hosting: Any mix of on-prem or cloud for **Web**/**Orchestrator**.
- Identity/Mail: Azure AD, Exchange Online; no dependency on on-prem DCs.
- Data: SQL Server hosted in Azure or on customer infrastructure.

## Hybrid

- Hosting: Web and/or Orchestrator may run in cloud; **Activate Anywhere** in DMZ to reach on-prem systems.
- Identity/Mail: Mixed estates (cloud and on-prem).
- Data: Enterprise SQL Server in preferred location.

## On-Premises

- Hosting: All components on customer infrastructure.
- Identity/Mail: AD and Exchange on-prem.
- Data: SQL Server on-prem with enterprise HA/backup.

# Connectivity and Ports (Indicative)

## Inbound (to Web/API)

- 443/TCP from users, service integrations, and admin endpoints.

## Inbound (to Orchestrator)

- Management access (admin/RDP/SSH) restricted to operations networks.
- Message/queue endpoints if used (enterprise-standard services only).

## Data Tier

- 1433/TCP (SQL Server) from Web and Orchestrator subnets only.

## Outbound

- Identity provider endpoints, Microsoft 365 services, ticketing/ITSM APIs, and any approved third-party APIs required by workflows.

# Non-Functional Requirements Checklist

- Security: SSO/MFA, least privilege, secret rotation, TLS enforcement.
- Reliability: HA across tiers, tested backup/restore, DR plan with RTO/RPO.
- Performance: Capacity model for web concurrency, workflow throughput, and SQL IOPS.
- Observability: Centralised logging, metrics, traces, actionable alerts.
- Operability: Runbooks, change control, environment promotion strategy.
- Compliance: Audit retention, data residency, privacy impact assessment where applicable.

These topologies are illustrative, not prescriptive. Activate is flexible and deployments can combine elements from multiple models to meet specific security, connectivity, and operational needs.