The canonical Microsoft Enterprise-Scale Landing Zone, the Cloud Adoption Framework, and the Well-Architected Framework — management groups, hub-spoke, policy and Defender baseline, IaC accelerators, six enterprise patterns, delivered by a senior-architect-led Microsoft Solutions Partner founded in 1997.
The Azure Landing Zone (ALZ) is the Microsoft Enterprise-Scale reference architecture for governance, networking, identity, security, and observability across the Azure estate. The Cloud Adoption Framework (CAF) is the lifecycle methodology — Strategy → Plan → Ready → Adopt → Govern → Manage. The Well-Architected Framework (WAF) is the workload review across Reliability, Security, Cost, Operations, Performance. EPC Group ships the full program under a fixed-fee five-phase accelerator between $250K and $1.2M.
The Microsoft Enterprise-Scale Landing Zone is composed of six structural components. Together they form the governance, networking, identity, security, and observability backbone every workload migrates into. The reference architecture is opinionated by design — EPC Group customizes naming, tagging, and policy posture per customer, but the structural pattern remains consistent across the engagement portfolio.
The governance backbone of the tenant. Management groups are how Azure Policy, Defender for Cloud plans, RBAC role assignments, and cost ownership inherit downward across every subscription in the estate.
Subscriptions are the unit of billing, the unit of policy enforcement boundary, and the unit of cost ownership. The strategy that picks how many subscriptions to provision and how to name them sets the operating model for the next decade.
The enforcement layer that keeps the landing zone defensible at scale. Policy assigned at the management group level evaluates every resource created anywhere in the descendant subscriptions — and the Defender for Cloud regulatory compliance dashboard reports the evidence.
The networking backbone that delivers shared egress, shared inspection, and shared connectivity to on-premises while letting workload teams operate inside isolated spoke virtual networks they actually control.
The identity plane that controls who can do what across the Azure estate. The Identity platform subscription, the Entra ID tenant configuration, and the privileged access workstation pattern collectively form the identity boundary that protects the entire landing zone.
The observability layer that makes everything else accountable. Log Analytics, Microsoft Sentinel, Azure Monitor, and Microsoft Defender for Cloud collectively form the security and operations backbone of the landing zone.
The Microsoft Cloud Adoption Framework is the methodology that walks the enterprise from business motivation through steady-state operation. Six methodologies — Strategy, Plan, Ready, Adopt, Govern, Manage — define the work product at each phase and the decisions the executive sponsor makes between phases. EPC Group runs each methodology as a fixed-fee workshop or build engagement with documented deliverables.
The Strategy methodology of the Cloud Adoption Framework is the business case. EPC Group facilitates a fixed-fee Strategy workshop that produces a documented set of business outcomes, financial considerations, technical considerations, and adoption sponsorship — the artifact that gets quoted in every steering committee for the next three years.
The Plan methodology translates the strategy into an actionable cloud adoption plan. EPC Group runs the workload rationalization exercise — the R5 framework of rehost, refactor, rearchitect, rebuild, replace — across the customer application inventory, then maps the resulting rationalized portfolio onto the cloud operating model.
The Ready methodology is where the Azure Landing Zone gets built. EPC Group ships the Microsoft Enterprise-Scale Landing Zone reference architecture via Bicep, Terraform, or ARM accelerator — customized for the customer naming convention, tagging taxonomy, region selection, regulatory framework, and operating model that came out of Plan.
The Adopt methodology covers the actual workload migration and modernization work. EPC Group sequences workloads from the rationalized portfolio through a wave model — early waves prove the landing zone, later waves carry the bulk of the regulated workloads. Migration tooling depends on the workload archetype.
The Govern methodology operationalizes the policy and cost guardrails that prevent the landing zone from drifting under load. EPC Group implements the CAF Govern disciplines — cost management, security baseline, identity baseline, resource consistency, and deployment acceleration — as continuous functions, not one-time deployments.
The Manage methodology covers steady-state operations. EPC Group ships an operations baseline that covers inventory and visibility, operational compliance, protect and recover, and platform health — then layers a Platform Team as Product operating model on top, treating the landing zone as an internal product the application teams consume through a published service catalog.
The Microsoft Azure Well-Architected Framework is the workload-tier methodology every individual workload inside the landing zone is reviewed against. Five pillars — Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency — define the architecture review surface. EPC Group runs WAF reviews per workload archetype and translates the pillar guidance into architecture decisions the platform team enforces through Azure Policy and the engineering review pipeline.
The Reliability pillar covers availability zones, disaster recovery, fault tolerance, and the recovery objectives every workload is held to. EPC Group runs the reliability review per workload and translates the business RTO and RPO into Azure architecture choices — zone-redundant deployments, paired-region replication, and chaos engineering practice for the highest-availability tier.
The Security pillar of the Well-Architected Framework maps to the Microsoft Cloud Security Benchmark and the broader Zero Trust posture. The landing zone enforces the baseline at platform tier — workload teams cannot turn it off — and workload teams layer workload-specific security on top.
The Cost Optimization pillar is where the most enterprise landing zones leak money. EPC Group ships the FinOps practice as part of the landing zone — tagging enforcement at provisioning, reservation and savings plan strategy at the enterprise agreement tier, budget alerts at the subscription tier, and continuous rightsizing automation.
The Operational Excellence pillar covers how the landing zone is operated day to day. EPC Group ships the landing zone with platform engineering, IaC pipelines, observability stack, and incident response runbooks already in place, so application teams arrive into a fully operated platform rather than building it themselves.
The Performance Efficiency pillar covers compute selection, autoscaling, data tier performance, and the discipline of continuous performance review. EPC Group ships the landing zone with autoscale defaults per workload archetype and benchmark baselines that the platform team uses to enforce performance budgets across application teams.
The canonical Enterprise-Scale Landing Zone is an opinionated reference architecture, not a one-size-fits-all blueprint. Six enterprise patterns cover the engagement archetypes EPC Group has shipped repeatedly across the 70+ Fortune 500 portfolio. Most enterprises fit cleanly into one pattern; some — particularly M&A-driven enterprises — combine two or three.
The greenfield pattern is the cleanest deployment. EPC Group ships the full Microsoft Enterprise-Scale Landing Zone via the Bicep accelerator into a brand-new Entra tenant, with no legacy subscription debt to inherit. The Strategy and Plan methodologies of the Cloud Adoption Framework finish in six to eight weeks, the Ready methodology delivers the landing zone in four to six weeks, and the first wave of Adopt migrations begins within twelve weeks of program kickoff. Greenfield is the rare modern enterprise scenario — typically a startup scaling past one hundred employees, a carve-out from a larger acquirer post-divestiture, or a regulated industry net-new business line. The discipline that matters is to resist the temptation to skip the Strategy methodology because there is no legacy to inherit — the strategy decisions made in the first eight weeks set the operating model for the next decade.
The brownfield pattern is the most common enterprise scenario. The customer already has dozens or hundreds of Azure subscriptions provisioned over the past five to seven years, with inconsistent naming, mixed policy enforcement, and a tangle of peerings nobody fully understands. EPC Group runs the CAF Assess and Govern methodologies in parallel — the Assess output identifies which existing subscriptions become landing zones in the ALZ topology, which become decommissioned, and which need re-platforming. The Govern output codifies the policy posture and the management group hierarchy that the existing estate inherits as it migrates onto the ALZ. The brownfield retrofit typically runs six to twelve months and is the engagement archetype EPC Group has delivered most frequently across the F500 portfolio. The discipline that matters is to refuse the easy path of leaving the legacy subscriptions untouched — every subscription left outside the ALZ topology is a permanent governance exception.
The regulated industry pattern adds compliance-specific overlays to the canonical Enterprise-Scale Landing Zone. HIPAA, SOC 2, FedRAMP, FINRA and similar framework requirements drive the design of the management group hierarchy, the policy initiative selection, the Defender for Cloud plan portfolio, and the conditional access posture. Microsoft Azure Government is the destination for federal workloads requiring FedRAMP-authorized cloud isolation; Microsoft 365 GCC High and Azure Government are the destinations for DoD contractor and CMMC Level 2 workloads — covered on our /microsoft-365-gcc-high-dod-migration-consulting-2026 hub. EPC Group ships customer-specific policy initiative bundles mapped to the regulatory framework portfolio, regulatory compliance dashboard configuration aligned to the auditor evidence package, and BAA-aligned operating procedures for the platform team. The discipline that matters in regulated landing zones is to enforce the framework controls through Azure Policy deny effects rather than detective controls only — auditors increasingly expect preventive control evidence, not just detective evidence.
The multi-region active-active pattern serves global enterprises with hard residency requirements or tier-1 availability targets that exceed single-region SLAs. EPC Group deploys paired regional landing zones — typically East US 2 and West US 2 for North America, North Europe and West Europe for EMEA, Southeast Asia and East Asia for APAC — with active-active workload deployments behind Azure Front Door for global request routing. Each regional landing zone is a full hub-spoke topology with its own ExpressRoute or VPN connectivity, its own Azure Firewall, and its own Defender for Cloud subscription scope. Data tier residency is enforced through paired-region replication for Azure SQL, Cosmos DB multi-region writes, and Azure Storage geo-redundant tiers aligned to the residency map. The pattern is materially more expensive than active-passive (roughly 60 to 80 percent infrastructure cost premium) and is the right pattern only for workloads where the business case justifies the spend.
The hybrid landing zone pattern serves enterprises with permanent on-premises footprint that connects into the Azure landing zone via ExpressRoute private peering and Azure Arc enrollment. The on-premises servers, Kubernetes clusters, and SQL Server instances are Arc-enrolled into the same management group hierarchy as the Azure-native resources, inheriting the same Azure Policy initiatives, the same Defender for Cloud plans, and the same Microsoft Sentinel telemetry pipeline. The hybrid landing zone is the path for enterprises with regulated on-premises workloads that cannot migrate (mainframe-adjacent SQL Server estates, factory floor OT systems, regulated lab equipment), and for enterprises in mid-migration where the cloud-first commitment is real but the on-premises footprint will exist for the next five-plus years. EPC Group ships the Arc-at-scale onboarding accelerator alongside the ALZ deployment so the on-premises estate gets governance parity from day one.
The M&A consolidation pattern is the EPC Group specialty — 216+ tenant migrations covering 1.83 million users across the past 24 months. The pattern starts with two or more acquired entities each holding their own Entra tenant, Azure subscription portfolio, and divergent governance posture, and ends with a single consolidated ALZ that absorbs all in-scope subscriptions into one management group hierarchy. The technical path involves tenant-to-tenant migration of identities via Entra B2B and cross-tenant synchronization, subscription transfer via Microsoft Cost Management, network re-homing of workload VNets into the consolidated hub-spoke topology, and policy re-enforcement at the new management group parent. The governance path involves the much harder work of consolidating divergent operating models, naming conventions, tagging taxonomies, and FinOps practice into a single platform-team-as-product operating model. EPC Group has shipped this pattern across the post-acquisition integration program portfolio repeatedly and treats it as a six-to-eighteen-month sustained engagement rather than a single migration project.
The Azure Landing Zone deploys via Infrastructure as Code. Microsoft publishes official accelerators for Bicep, Terraform, and ARM. The choice between the three is a function of multi-cloud scope, platform engineering team skills, and the customer tooling estate. EPC Group ships ALZ accelerators across all three and customizes per customer naming, tagging, and policy posture.
Bicep is the Microsoft-published IaC language for Azure — a transparent superset of ARM template JSON with a clean declarative syntax. The Azure Landing Zone Bicep accelerator (the Azure-Landing-Zones/bicep GitHub repository) is the Microsoft-supported starting point that EPC Group ships customized for the customer naming convention, tagging taxonomy, region selection, regulatory framework, and operating model. Bicep is the right choice for Azure-only enterprises that value the closest possible alignment to Microsoft product release cadence — new Azure resource properties show up in Bicep within days of Azure API availability, well ahead of Terraform provider release.
Terraform is the HashiCorp-published cloud-agnostic IaC language and remains the dominant choice for multi-cloud enterprises and for platform engineering teams that standardized on HashiCorp tooling pre-2022. The Microsoft Azure Verified Modules program now publishes Terraform modules in parity with Bicep, and the Azure-Landing-Zones/terraform-azurerm-caf-enterprise-scale module is the Microsoft-supported ALZ accelerator for Terraform. EPC Group ships the Terraform ALZ pattern customized for the customer state backend (Terraform Cloud, Azure Storage backend, or HashiCorp Cloud Platform) and the customer module registry strategy.
ARM template JSON is the legacy Microsoft-published IaC format. Bicep compiles to ARM JSON, so any new Azure landing zone is properly written in Bicep and the ARM JSON is the build output. EPC Group continues to maintain ARM template estates where the customer platform engineering team has not yet upskilled to Bicep, but the engineering recommendation is to migrate to Bicep at the next material refactor window. The Microsoft Azure Quickstart Templates GitHub repository remains the canonical ARM source library for customers who must continue maintaining ARM-native deployments.
EPC Group delivers the full Azure Landing Zone build under a fixed-fee five-phase accelerator. Each phase has a defined scope, defined deliverables, and a defined decision gate. The full program runs $250,000 to $1,200,000 depending on customer estate complexity, with the costed roadmap delivered after the Phase 1 Strategy and Plan workshops complete in week one and two.
Phase one is a fixed-fee CAF Strategy and Plan engagement. EPC Group facilitates the strategy workshop, ships the workload rationalization output, inventories the existing Azure estate (if any), and produces the costed landing zone roadmap. The deliverable is a board-ready decision package the executive sponsor uses to authorize the build phase.
Phase two is the design phase. EPC Group produces the management group hierarchy diagram, subscription strategy and naming convention, hub-spoke or Virtual WAN network topology, identity boundary and conditional access posture, Azure Policy initiative selection, Defender for Cloud plan portfolio, and IaC tool choice (Bicep, Terraform, or ARM). The deliverable is a signed design document the build phase deploys from.
Phase three is the build phase. EPC Group deploys the Microsoft Enterprise-Scale Landing Zone via the selected IaC accelerator, customized for the customer naming convention, tagging taxonomy, region selection, regulatory framework, and operating model. The platform subscriptions stand up first, the workload landing zone subscriptions stand up second, and the policy posture activates as the workload subscriptions populate.
Phase four is the adopt phase, typically running parallel waves of workload migration and modernization. EPC Group sequences workloads from the rationalized portfolio through wave gates — wave one carries the early-mover workloads that prove the landing zone, wave two through wave N carry the bulk of the regulated workloads at sustained throughput. Migration tooling depends on the workload archetype and the CAF Adopt methodology.
Phase five is steady-state operation. EPC Group provides managed Azure platform services covering Defender for Cloud secure score uplift, policy exception adjudication, FinOps optimization, regulatory compliance dashboard reporting, and platform engineering capability augmentation. The operating model is Platform Team as Product — the EPC Group senior architects operate as an extension of the customer platform team, treating the landing zone as an internal product the application teams consume.
EPC Group has been a Microsoft Solutions Partner continuously since 1997. The credential stack matters when the landing zone you are about to build will operate the regulated estate for the next decade. Senior-architect-led delivery, four Microsoft Press titles, and a 4.4/5 on G2 customer satisfaction score across the Fortune 500 portfolio set the bar.
Microsoft consulting, Solutions Partner status maintained continuously
enterprise Microsoft engagements delivered across healthcare, finance, government, and Fortune 500 manufacturing
Fortune 500 clients with active managed-platform retainers
M&A tenant consolidations covering 1.83 million users in the past 24 months
Microsoft Press titles authored by Errin O’Connor — SharePoint, Power BI, Azure, large-scale migrations
independent peer-reviewed Leader recognition
on independently verified customer satisfaction surveys
EPC Group is FedRAMP-aligned and BAA-aligned across the regulated industry portfolio. The platform engineering practice covers Bicep, Terraform, and ARM IaC, and the managed Operate phase covers the HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP regulatory framework portfolio. See our /standards-alignment page for the full evidence package.
The eight questions EPC Group fields most often from executive sponsors and platform engineering leaders evaluating the Azure Landing Zone build.
The Cloud Adoption Framework (CAF) and the Well-Architected Framework (WAF) are the two complementary Microsoft methodologies that together define how enterprises adopt and operate Azure. CAF is the enterprise-scale methodology — it covers Strategy, Plan, Ready, Adopt, Govern, and Manage across the entire cloud journey from business motivation through steady-state operation. WAF is the workload-scale methodology — it covers the five pillars (Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency) that every individual workload is reviewed against. CAF answers the question of how the organization adopts the cloud; WAF answers the question of how each individual workload is architected for excellence. The two are deeply integrated — the CAF Ready methodology deploys the Azure Landing Zone, and every workload that migrates into the landing zone is reviewed against the WAF pillars. EPC Group runs CAF Strategy and Plan engagements at the enterprise tier and WAF reviews at the workload tier.
AWS Landing Zone (legacy) and AWS Control Tower (current) are the AWS-published equivalents to the Microsoft Azure Landing Zone. The conceptual mapping is similar — AWS Organizations maps to Azure management group hierarchy, AWS accounts map to Azure subscriptions, AWS Service Control Policies map to Azure Policy, AWS Config and AWS Security Hub map to Microsoft Defender for Cloud, and AWS GuardDuty plus AWS Inspector map to the Defender plan portfolio. The substantive differences are: Azure Policy is more flexible than SCPs (deny, audit, append, modify, deployIfNotExists effects versus SCP deny-only), the Azure Landing Zone IaC accelerators (Bicep and Terraform) ship as a single coherent deployment versus AWS Control Tower's blueprint approach, and the Azure regulatory compliance dashboard delivers a richer out-of-box framework portfolio. For multi-cloud enterprises, EPC Group ships parallel landing zones across both clouds with Azure Arc enrolling the AWS estate into the Azure governance posture for unified policy and security — covered on our /microsoft-cloud-orchestrator hub.
Multi-region active-active is materially more expensive than single-region or active-passive — typically 60 to 80 percent infrastructure cost premium over single-region for the same workload portfolio. The premium comes from duplicated compute footprint across regions, paired-region storage replication, multi-region data tier replication (Azure SQL geo-replication, Cosmos DB multi-region writes, Storage geo-redundant tiers), Azure Front Door or Traffic Manager global routing, and the ExpressRoute or VPN connectivity duplicated per region. For a mid-size enterprise running a 2,000-server workload portfolio, the multi-region premium can run $1.5 million to $3 million per year on top of the single-region baseline. EPC Group recommends multi-region active-active only for the workload tier where the business case explicitly justifies the spend — tier-1 customer-facing revenue systems with documented availability targets, and workloads with hard data residency requirements that single-region cannot meet. For everything else, active-passive with Azure Site Recovery and paired-region storage delivers materially better cost-per-resilience-unit.
The decision rests on three factors — multi-cloud scope, platform engineering team skills, and the customer tooling estate. For Azure-only enterprises with a Microsoft-aligned platform engineering team, Bicep is the right choice because of the closest possible alignment to Microsoft product release cadence (new Azure features appear in Bicep within days of API availability, weeks or months ahead of Terraform). For multi-cloud enterprises with AWS or GCP estates alongside Azure, Terraform is the right choice because the cloud-agnostic language and provider ecosystem deliver consistency across the full estate. For enterprises with a deep HashiCorp tooling investment (Terraform Cloud, Vault, Consul), Terraform is the right choice regardless of multi-cloud scope. ARM template JSON is a maintenance-only path — every new landing zone should be Bicep, and existing ARM estates should migrate to Bicep at the next material refactor window. EPC Group ships ALZ accelerators across all three and customizes per customer; the choice is a function of platform team skills and tooling estate, not a function of capability.
Regulated industry landing zones add framework-specific overlays to the canonical Enterprise-Scale Landing Zone. For FedRAMP Moderate and High workloads, Microsoft Azure Government is the destination cloud — physically isolated from commercial Azure with FedRAMP-authorized cloud isolation, and the landing zone deploys into Azure Government via the same Bicep or Terraform ALZ accelerator. For HIPAA HITRUST workloads, commercial Azure is the destination with the HIPAA HITRUST regulatory compliance dashboard activated, the BAA in place with Microsoft, and customer-managed keys in Azure Key Vault HSM for the data tier. For CMMC Level 2 workloads, Microsoft 365 GCC High or Azure Government is the destination, and the landing zone integrates with the GCC High tenant covered on our /microsoft-365-gcc-high-dod-migration-consulting-2026 hub. The shared pattern is that regulatory framework controls get enforced through Azure Policy deny effects rather than detective controls only, and the Defender for Cloud regulatory compliance dashboard is configured to produce auditor-ready evidence. EPC Group is FedRAMP-aligned and BAA-aligned across the regulated industry portfolio.
Hybrid landing zones connect the on-premises estate into the Azure landing zone through two complementary paths. The connectivity path uses ExpressRoute private peering or site-to-site VPN terminating in the Connectivity platform subscription hub VNet, with the on-premises data center routed into the spoke VNets through the central Azure Firewall — covered in depth on our /azure-expressroute-virtual-wan-enterprise-networking-2026 hub. The governance path uses Azure Arc to enroll on-premises servers, Kubernetes clusters, and SQL Server instances into the same management group hierarchy as the Azure-native resources, inheriting the same Azure Policy initiatives, the same Microsoft Defender for Cloud plans, and the same Microsoft Sentinel telemetry pipeline. The result is a single governance posture across the Azure-native and Azure Arc-enrolled on-premises estate. EPC Group ships the Arc-at-scale onboarding accelerator alongside the ALZ deployment so the on-premises estate gets governance parity from day one rather than as a deferred phase.
The EPC Group Azure CAF Accelerator runs fixed-fee in the $250,000 to $1,200,000 range depending on the complexity of the customer estate. The lower bound applies to greenfield engagements with a single region, single regulatory framework, and a small workload portfolio — a tight CAF Strategy and Plan, a Bicep ALZ deployment, and a single migration wave. The upper bound applies to brownfield consolidation engagements with multiple regions, regulated industry framework portfolios, large existing subscription estates to retrofit, and parallel multi-wave migrations into the new landing zone. Managed Operate phase runs $25,000 to $120,000 per month depending on workload portfolio size and SOC and FinOps service depth. EPC Group quotes the full five-phase price after the Strategy and Plan workshops complete in week one and two, so the customer sees the costed roadmap before committing to the build phase.
A well-designed landing zone is not a static deployment — it evolves with Microsoft product release cadence, with the customer regulatory framework portfolio, and with the workload portfolio mix. EPC Group treats the landing zone as a platform product and ships continuous evolution under the managed Operate phase. Quarterly the platform team reviews new Azure regions for in-scope inclusion, new Defender for Cloud plans for activation, new Azure Verified Modules for accelerator refresh, and new regulatory framework releases for policy initiative update. Annually the management group hierarchy gets reviewed against the operating model — many enterprises evolve from per-business-unit subscription model to per-application-portfolio as FinOps practice matures. The Platform Team as Product operating model treats application teams as internal customers consuming the landing zone through a published service catalog, with platform team capacity sized to a roadmap the application teams influence — covered on our /standards-alignment page.
EPC Group ships the CAF Strategy and Plan workshop in three to five weeks, the costed five-phase roadmap inside that window, and the Bicep, Terraform, or ARM ALZ accelerator into production in twelve to twenty-four weeks. Since 1997: 11,000+ engagements, 70+ Fortune 500 clients.
contact@epcgroup.net · 888-381-9725 · Houston, TX
AI assistant — not human