To minimize costs: The Archive tier is optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements (on the order of hours).
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, lower latencies, and higher security than typical connections over the Internet.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

Enable Azure Monitor Application Insights on your App Service to monitor web app performance, availability (using ping tests), and user behavior, with alerts configured for high function usage and downtime. Key actions include setting up Availability Tests, configuring alerts on Metric/Log data, and analyzing user flow via Application Insights.
1. Enable Application Insights
Navigate to your Web App in the Azure Portal.
Under Settings, select Application Insights.
Select Enable and create a new resource or select an existing one. This automatically starts collecting request rates, response times, failures, and user telemetry.
2. Monitor Availability & Send Notifications
Go to your Application Insights resource.
Select Availability under the Investigate section.
Click Add Standard test (or Ping test) to monitor the app's endpoint, setting it to run from multiple locations.
Select Alerts > Create Alert Rule to trigger notifications (email, SMS, Azure Function) if the availability test fails.
3. Monitor Azure Functions Usage
Ensure Application Insights is also configured for the Azure Functions app, preferably using the same App Insights instance for centralized visibility.
In the Function App, go to Monitor > Metrics.
Select the Function Execution Count or Function Execution Units metric.
Click New alert rule to configure alerts when usage exceeds a specific threshold.
4. Analyze User Behavior
In Application Insights, use the Usage pane for analytics.
Users/Sessions/Events: Analyze active users, session lengths, and custom events.
Funnels: Measure user conversion rates through a sequence of steps.
User Flows: Visualize how users navigate through your app.
Key Components Used
Availability Tests: Checks HTTP endpoint availability.
Azure Monitor Alerts: Sends notifications.
Application Map: Visualizes dependency connections, including Functions.
Log Analytics (Kusto Query Language): Allows advanced querying of user behavior and function execution logs.
Reference:
https://learn.microsoft.com/en-us/azure/app-service/monitor-app-service

Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access. Have reviews recur periodically: You can set up recurring access reviews of users at set frequencies such as weekly, monthly, quarterly or annually, and the reviewers will be notified at the start of each review. Reviewers can approve or deny access with a friendly interface and with the help of smart recommendations.
Why are access reviews important?
"Azure AD enables you to collaborate with users from inside your organization and with external users. Users can join groups, invite guests, connect to cloud apps, and work remotely from their work or personal devices. The convenience of using self-service has led to a need for better access management capabilities."
https://docs.microsoft.com/en-us/azure/active-directory/governance/manage-user-access-with- access-reviews

Azure Key Vault logging
After you create one or more key vaults, you'll likely want to monitor how and when your key vaults are accessed, and by whom. Enabling logging for Azure Key Vault saves this information in an Azure storage account that you provide.
Azure Key Vault activity can be monitored by checking the Key Vault activity log. By enabling logging, you can track access to your secrets and other Key Vault resources, including who accessed them, when they accessed them, and the specific actions performed.
Reference:
https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault