Stage 5 · Platform
Infrastructure as Code on Azure
Azure Landing Zones
Enterprise-scale architecture, management group hierarchy, and CAF patterns.
What Are Landing Zones?
Landing Zones are pre-configured Azure environments that provide a secure, compliant, and scalable foundation for workloads. They implement governance, security, networking, and identity patterns from the Cloud Adoption Framework (CAF).
- Platform Landing Zone — Shared infrastructure (Hub VNet, Firewall, DNS, Bastion)
- Application Landing Zone — Subscription(s) for application workloads
- Policy Landing Zone — Azure Policy definitions and initiatives
- Identity Landing Zone — Entra ID, B2C, and hybrid identity
Cloud Adoption Framework
The Cloud Adoption Framework is Microsoft's collection of best practices, tools, and guidance for cloud adoption. It covers strategy, plan, ready, adopt, govern, and manage phases.
| Phase | Focus | Key Activities |
|---|---|---|
| Strategy | Business justification | Business case, motivations, outcomes |
| Plan | Technical planning | Application rationalization, landing zone design |
| Ready | Environment preparation | Landing zone deployment, subscription vending |
| Adopt | Migration and innovation | Workload migration, modernization |
| Govern | Compliance | Policy, cost management, security |
| Manage | Operations | Monitoring, SRE, incident response |
Management Group Hierarchy
# Root management group (Tenant Root Group)
# ├── Platform
# │ ├── Connectivity (Hub VNet, Firewall, DNS)
# │ ├── Identity (Entra Connect, B2C)
# │ └── Management (Log Analytics, Monitor)
# ├── Landing Zones
# │ ├── Corp (Line of business apps)
# │ ├── Online (Internet-facing apps)
# │ └── SAP (SAP workloads)
# ├── Sandbox (Dev/test subscriptions)
# └── Decommissioned (Retired subscriptions)
# Create a management group hierarchy
az account management-group create --name Platform
az account management-group create --name Connectivity --parent Platform
az account management-group create --name Identity --parent Platform
az account management-group create --name Management --parent Platform
az account management-group create --name LandingZones
az account management-group create --name Corp --parent LandingZones
az account management-group create --name Online --parent LandingZonesThe management group hierarchy provides governance at scale. Policies assigned at a parent group inherit to all child groups and subscriptions.
Subscription Organization
Landing zones organize subscriptions by workload type, sensitivity, or business unit. Each subscription gets its own RBAC, policies, and budget. This provides blast radius isolation and cost allocation.
# Create a subscription under the Corp landing zone
az account subscription create \
--name "Payments Production" \
--offer-type MSDN_ULTIMATE \
--account-id "00000000-0000-0000-0000-000000000000"
# Move it under the Corp management group
az account management-group subscription add \
--name Corp \
--subscription "{subscription-id}"Subscription vending is the process of creating new subscriptions from a self-service catalog. It ensures every new subscription starts with standard governance.
Platform Landing Zone
// Hub VNet for shared services
resource hubVnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
name: 'vnet-hub-eastus'
location: 'eastus'
properties: {
addressSpace: {
addressPrefixes: ['10.0.0.0/16']
}
subnets: [
{
name: 'AzureFirewallSubnet'
properties: { addressPrefix: '10.0.0.0/26' }
}
{
name: 'GatewaySubnet'
properties: { addressPrefix: '10.0.1.0/27' }
}
{
name: 'AzureBastionSubnet'
properties: { addressPrefix: '10.0.2.0/27' }
}
]
}
}
// Azure Firewall
resource firewall 'Microsoft.Network/azureFirewalls@2023-05-01' = {
name: 'fw-hub-eastus'
location: 'eastus'
properties: {
sku: { name: 'AZFW_VNet', tier: 'Standard' }
firewallPolicy: { id: firewallPolicy.id }
}
}The hub VNet hosts shared services (Firewall, DNS, VPN Gateway, Bastion). Spoke VNets peer with the hub and route traffic through the firewall.
Application Landing Zone
# Create a spoke VNet for the application
az network vnet create \
--resource-group rg-payments-prod \
--name vnet-payments-prod \
--address-prefixes 10.1.0.0/16 \
--subnet-name subnet-aks \
--subnet-prefixes 10.1.1.0/24
# Peer with the hub VNet
az network vnet peering create \
--resource-group rg-payments-prod \
--name peer-payments-to-hub \
--vnet-name vnet-payments-prod \
--remote-vnet vnet-hub-eastus \
--allow-vnet-access true \
--allow-forwarded-traffic trueApplication landing zones peer their spoke VNets with the hub. This provides access to shared services (firewall, DNS, VPN) without duplicating infrastructure.
Microsoft provides landing zone accelerators (Bicep templates) that deploy a complete landing zone with networking, security, and governance. Use them as a starting point instead of building from scratch.
Adapt the landing zone architecture to your organization. Small teams may need only a few subscriptions. Large enterprises may need hundreds with complex management group hierarchies.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.