Can an existing subscription be brought under the zone?

Yes, where the subscription's resources fit the design; the assessment in week one states what moves, what is rebuilt and what is retired.

Who operates the zone afterwards?

The organization's cloud team, using the documentation and the runbook; managed operation is available separately.

Does the landing zone make us compliant with HIPAA or FedRAMP?

No landing zone makes an environment compliant on its own. Azure Policy and Microsoft Defender for Cloud can assign a regulatory standard, such as HIPAA or FedRAMP High, and show which resources pass the controls that can be assessed automatically. Microsoft notes that controls which cannot be assessed automatically show as greyed out, because Defender for Cloud cannot decide whether a resource complies (Microsoft Learn, Regulatory compliance in Defender for Cloud). The rest of the evidence, such as processes, people and documentation, is reviewed by the assessor or auditor for that regime.

Azure Landing Zone — a fixed-fee accelerator from EPC Group

Last updated November 2, 2026 by Errin O'Connor, Founder & Chief AI Architect, EPC Group

EPC Group delivers the Azure Landing Zone as a fixed-fee accelerator: 4–6 weeks, led by the senior architect named on the Statement of Work, scoped to the deliverables below. The decision it supports: What the organization's first governed Azure environment should look like before workloads land in it. Fixed fee, quoted after a one-hour call with a senior architect. EPC Group does not publish price ranges.

Abstract slate panel with a teal hub ring and four spokes to faint outlined zones — the landing zone topology.

Duration: 4–6 weeks
Team: Senior architect named on the Statement of Work; engagement lead where the program size warrants it.
How it is priced: Fixed fee, quoted after a one-hour call with a senior architect. EPC Group does not publish price ranges.

What it is

A landing zone is the Azure foundation every workload inherits: management groups and subscriptions, identity through Microsoft Entra ID, a hub-and-spoke network, Azure Policy guardrails and a security baseline with Defender and Sentinel. The accelerator designs and deploys that foundation to the enterprise-scale pattern, adapted to the organization's compliance obligations rather than copied from a reference.

An initial workload migration — up to five servers — proves the zone with real traffic and gives the operations team its first run of the processes the zone assumes. The documentation that closes the engagement is the one the cloud team keeps extending.

The design follows the eight Azure landing zone design areas in Microsoft's Cloud Adoption Framework: Azure billing and Active Directory tenant, identity and access management, resource organization, network topology and connectivity, security, management, governance, and platform automation and DevOps (Microsoft Learn, Azure landing zone design areas, updated 2026-10-13). Each area's decisions are written down, so later workloads inherit them instead of deciding them again.

Who it is for

Organizations building their first governed Azure environment, or replacing one that grew subscription by subscription without a design.

Start here by size — Run a multi-wave programme. Migrations, landing zones and Centers of Excellence delivered in waves across a large estate. The organizations EPC Group serves, and the ones it does not, are set out on the fit page.

Deliverables

Enterprise-scale landing zone architecture
Management groups, subscriptions and naming designed for the organization's structure.
Identity and access management (Entra ID)
Role assignments, privileged access and break-glass handled deliberately.
Hub-spoke network topology
Connectivity, segmentation and egress designed for the workloads that are coming.
Azure Policy and governance guardrails
Policies that enforce the design instead of documenting it.
Security baseline (Defender, Sentinel)
Posture management and the first detections wired to the operations team.
Initial workload migration (up to five servers)
The zone proven with real workloads and the runbook recorded.

What is not included

Migration of the wider estate beyond the five servers — scoped from the runbook as a programme (see cloud migration).
Application modernization or re-architecture.
Azure consumption and reservation purchasing (recommendations are given; procurement is the organization's).

Anything outside the deliverables above is a change order under the Engagement Charter — written, priced and approved before the work starts.

When to start

The first production workload is about to land in Azure and no foundation exists.
Subscriptions have multiplied without policy and the bill or the audit has noticed.
A data-centre exit date is set.

How it is priced

Fixed fee, quoted after a one-hour call with a senior architect. EPC Group does not publish price ranges. The scoping call is run by the architect who would lead the work; the fixed fee, the deliverables and the acceptance criteria are written into the Statement of Work, and the change-control, escalation and acceptance rules are the ones in the Engagement Charter.

Frequently Asked Questions

It follows that pattern and adapts it to the organization's compliance obligations and operating model; the adaptations are documented so the cloud team knows why each one exists.

Book the scoping call

A one-hour call with the architect who would lead the Azure Landing Zone engagement; the fixed fee follows in writing.

Contact EPC Group