Architectural Feedback: Is SPFx + Azure Database a viable choice for an internal ticketing system?

SPFx as the user interface, an Entra-secured API, and PostgreSQL behind that API is a valid pattern. The web part should never connect directly to the database. Use SPFx AadHttpClient to call the registered API, validate tenant, issuer, audience, scopes, and user identity server-side, and enforce department authorization from trusted data rather than a client-supplied department value. Let the Function or App Service use managed identity and PostgreSQL Microsoft Entra authentication so no database secret reaches SPFx. Lists are preferable for simpler workflows and modest relationships; Dataverse is stronger when you need managed business rules, auditing, and role-based application security; PostgreSQL is justified for complex relational queries, volume, custom SLA processing, and SQL analytics. Budget for API versioning, database backup and high availability, private networking, telemetry, throttling, deployment pipelines, and supported SPFx/Node versions. Prototype authorization and expected ticket volume first, then compare operational cost and licensing with Dataverse before committing.