What are Azure Landing Zones?

Azure Landing Zones are the output of a multi-subscription Azure environment that accounts for scale, security, governance, networking, and identity. They provide a foundation for migrating, modernizing, and innovating at scale.

Key Design Areas

Management Group Hierarchy

Tenant Root Group
├── Platform
│   ├── Identity
│   ├── Management
│   └── Connectivity
└── Landing Zones
    ├── Corp
    │   ├── Production
    │   └── Non-Production  
    └── Online
        ├── Production
        └── Non-Production

Identity and Access Management

• Azure AD: Central identity provider
• Privileged Identity Management: Just-in-time access
• Conditional Access: Risk-based authentication
• RBAC: Role-based access control at appropriate scope

Network Topology

Hub-Spoke Architecture

Hub VNet (Connectivity Subscription)
├── Azure Firewall
├── VPN Gateway
├── ExpressRoute Gateway
└── Bastion

Spoke VNets (Landing Zone Subscriptions)
├── Workload A VNet ←→ Peered to Hub
├── Workload B VNet ←→ Peered to Hub
└── Workload C VNet ←→ Peered to Hub

Governance

Azure Policy for compliance at scale:

// Policy: Require tags on resources
{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "field": "tags['CostCenter']",
      "exists": "false"
    },
    "then": {
      "effect": "deny"
    }
  }
}

Security

• Microsoft Defender for Cloud: Security posture management
• Azure Sentinel: SIEM and SOAR
• Key Vault: Centralized secrets management
• DDoS Protection: Network layer protection

Management and Monitoring

• Log Analytics: Centralized logging
• Azure Monitor: Metrics and alerts
• Update Management: Automated patching
• Azure Automation: Runbooks for common tasks

Implementation Options

Azure Landing Zone Accelerator

Use the Enterprise-Scale reference implementation for quick deployment:

az deployment mg create \
  --location eastus \
  --management-group-id "Tenant Root Group" \
  --template-uri "https://raw.githubusercontent.com/Azure/Enterprise-Scale/main/eslzArm/eslzArm.json"

Terraform Module

Use the CAF Terraform module for infrastructure as code:

module "enterprise_scale" {
  source  = "Azure/caf-enterprise-scale/azurerm"
  version = "~> 3.0"
  
  root_parent_id = data.azurerm_client_config.current.tenant_id
  root_id        = "contoso"
  root_name      = "Contoso"
}

Best Practices

• Start with a clear management group hierarchy
• Implement policy-driven governance early
• Use dedicated subscriptions for platform services
• Plan network address space carefully
• Establish naming and tagging conventions

Conclusion

Azure Landing Zones provide a proven architecture for enterprise-scale cloud adoption. Invest time in proper foundation design to enable faster and safer cloud migration.