Search

Series18 articles

Azure Landing Zone Engineering Series

A zero-to-production walk through designing an Azure landing zone: what it is, who owns what, identity, resource organization and networking. Every article defines its words first, shows one diagram and is checked against Microsoft Learn.

Start with the first postRead the introduction

  1. 01What Is an Azure Landing ZoneAn Azure landing zone is the prepared Azure environment where teams run what they build, under shared rules that help govern, secure and scale it.Landing zoneFundamentals9 min read
  2. 02Platform Scope and Workload BoundariesThe platform team owns the shared foundation, each workload team owns its own workload, and keeping that line clear is what lets many teams share one Azure environment safely.Platform landing zoneOwnership7 min read
  3. 03Tenant, Billing, Subscriptions and Management GroupsEvery Azure environment is built on four things: a Microsoft Entra tenant (the home of your organization's users and their sign-ins) for identity, a billing offer for payment, subscriptions that hold your…TenantBillingManagement groupsSubscriptions7 min read
  4. 04The Cloud Operating ModelA cloud operating model is the answer to "who does what in the cloud?", and there are three models: centralized, shared management and decentralized.Operating model6 min read
  5. 05Business Requirements: Compliance, Region, Recovery, Connectivity and CostBefore you build a landing zone, you write down what the business needs, and five common requirements (compliance, region, recovery, connectivity and cost) each change a specific part of the landing zone.RequirementsComplianceCost12 min read
  6. 06Billing and the Microsoft Entra Tenant, in DepthYour billing agreement decides how subscriptions are created and paid for, your Microsoft Entra tenant decides who can sign in, and the default is to build the landing zone in one tenant, with many…BillingMicrosoft EntraTenant17 min read
  7. 07Identity and Access in the Landing ZoneIdentity decides who can sign in and what they can change, so know where your identities live, give roles to groups at a scope that fits the job, protect privileged access, and let applications use managed…IdentityAzure RBACMicrosoft Entra16 min read
  8. 08Privileged Access: MFA, Conditional Access and PIMAdministrator accounts are a frequent target for attackers, so protect them with three controls that work together: multifactor authentication to prove who is signing in, Conditional Access to set the rules,…MFAConditional AccessPIMPrivileged access12 min read
  9. 09Resource OrganizationResource organization is how you arrange management groups, subscriptions, resource groups, names and tags so that rules, access and cost land in the right place, and the usual advice is to keep the hierarchy…Management groupsResource organization14 min read
  10. 10Network Topology and ConnectivityNetwork topology and connectivity is the layout of your virtual networks and their links to on-premises networks, and the landing zone guidance offers two layouts, a traditional hub-and-spoke where you manage…NetworkingHub-and-spokeVirtual WAN20 min read
  11. 11SecurityThe Security design area of an Azure landing zone sets up the tools for security operations and the controls for access. It lists what the platform team needs to decide: who gets security alerts, where logs…SecurityZero TrustKey Vault19 min read
  12. 13Management and MonitoringThe Management design area of an Azure landing zone sets up the common tools for running the cloud every day (this is called the operations baseline), which means seeing what is happening, staying in the…MonitoringAzure MonitorBackup and recovery17 min read
  13. 14Governance and Azure PolicyThe Governance design area of an Azure landing zone sets up the tools for cloud governance, compliance auditing and automated guardrails, mainly with Azure Policy, so rules are checked and enforced by…GovernanceAzure PolicyCost management17 min read
  14. 15Platform Automation and DevOpsThe Platform automation and DevOps design area of an Azure landing zone is about building, changing and running the landing zone through code, review and automatic pipelines, instead of clicking in the portal.DevOpsInfrastructure as codeCI/CD22 min read
  15. 16Minimum Viable Platform Landing Zone: What to Build FirstStart with a small first version of the platform landing zone, with seven capabilities, check that it works, and add more pieces only when workloads need them.Landing zoneMigrationPlatform engineering22 min read
  16. 61Greenfield RolloutTo apply a landing zone to a brand-new Azure environment, get your tenant and permissions ready, decide each design area, choose a deployment tool, build the platform landing zone, check it, and then hand the…RolloutLanding zonePlatform engineering17 min read
  17. 62Brownfield RolloutTo bring an existing Azure environment to a landing zone, list what you have, build the landing zone beside it in the same tenant, try its policies in audit-only mode, and then move subscriptions in wave by…RolloutMigrationLanding zone27 min read
  18. 63Landing Zone Use CasesMost real situations use the same landing zone and only need a different answer to one question: which group does this workload go in, or how many tenants and groups does my company need?Use casesLanding zoneManagement groups12 min read

More parts are written and published in order. This list grows as each one passes the Microsoft Learn check.