What Is an Azure Landing Zone
An Azure landing zone is the prepared Azure environment where teams run what they build, under shared rules that help govern, secure and scale it.
Azure
Azure architecture and engineering: landing zones, identity, networking, governance and operations.
SeriesAzure Landing Zone Engineering Series18 articles
Articles
Platform Scope and Workload Boundaries
The platform team owns the shared foundation, each workload team owns its own workload, and keeping that line clear is what lets many teams share one…
Tenant, Billing, Subscriptions and Management Groups
Every Azure environment is built on four things: a Microsoft Entra tenant (the home of your organization's users and their sign-ins) for identity, a…
The Cloud Operating Model
A cloud operating model is the answer to "who does what in the cloud?", and there are three models: centralized, shared management and decentralized.
Business Requirements: Compliance, Region, Recovery, Connectivity and Cost
Before you build a landing zone, you write down what the business needs, and five common requirements (compliance, region, recovery, connectivity and…
Billing and the Microsoft Entra Tenant, in Depth
Your billing agreement decides how subscriptions are created and paid for, your Microsoft Entra tenant decides who can sign in, and the default is to…
Identity and Access in the Landing Zone
Identity decides who can sign in and what they can change, so know where your identities live, give roles to groups at a scope that fits the job,…
Privileged Access: MFA, Conditional Access and PIM
Administrator accounts are a frequent target for attackers, so protect them with three controls that work together: multifactor authentication to…
Resource Organization
Resource organization is how you arrange management groups, subscriptions, resource groups, names and tags so that rules, access and cost land in the…
Network Topology and Connectivity
Network topology and connectivity is the layout of your virtual networks and their links to on-premises networks, and the landing zone guidance…
Security
The Security design area of an Azure landing zone sets up the tools for security operations and the controls for access. It lists what the platform…
Management and Monitoring
The Management design area of an Azure landing zone sets up the common tools for running the cloud every day (this is called the operations…
Governance and Azure Policy
The Governance design area of an Azure landing zone sets up the tools for cloud governance, compliance auditing and automated guardrails, mainly with…
Platform Automation and DevOps
The Platform automation and DevOps design area of an Azure landing zone is about building, changing and running the landing zone through code, review…
Minimum Viable Platform Landing Zone: What to Build First
Start with a small first version of the platform landing zone, with seven capabilities, check that it works, and add more pieces only when workloads…
Greenfield Rollout
To apply a landing zone to a brand-new Azure environment, get your tenant and permissions ready, decide each design area, choose a deployment tool,…
Brownfield Rollout
To bring an existing Azure environment to a landing zone, list what you have, build the landing zone beside it in the same tenant, try its policies…
Landing Zone Use Cases
Most real situations use the same landing zone and only need a different answer to one question: which group does this workload go in, or how many…