Enterprise Landing Zone Setup on Azure
Cloud Architecture
A landing zone is the foundation every Azure workload inherits. Getting it wrong means every team that follows inherits technical debt. This is the design I apply for enterprises moving from lift-and-shift into a governed, scalable Azure environment.
Key Patterns & Steps
- Start with the Azure Cloud Adoption Framework (CAF) landing zone accelerator — customise, do not build from scratch
- Hub-and-spoke topology: centralise shared services (DNS, firewall, monitoring, bastion) in a hub VNet
- Management group hierarchy: Root → Platform → Landing Zones → Sandboxes. Assign Azure Policy at each level
- Enforce naming conventions, tagging policies, and allowed regions via Azure Policy before any workload onboards
- Separate subscriptions for production, non-production, and platform services — budget alerts per subscription
- Deploy via Bicep or Terraform from day one — no manual portal deployments in the landing zone core
Lessons Learned
Teams skip management groups because they seem like overhead — until six months later when they need to enforce a policy across 40 subscriptions. Design the hierarchy before the first workload lands.
Technologies
← Back to Architecture Notes