Azure Landing Zone Architecture: Enterprise Guide

Azure Landing Zone Architecture: The 2026 Enterprise Guide

Azure Landing Zones (ALZ) are the de facto starting point for every enterprise Azure deployment in 2026. Microsoft's Cloud Adoption Framework (CAF) Enterprise-Scale Landing Zone deploys management groups, hub-spoke networking, Azure Policy initiative assignments, Azure Monitor + Log Analytics, and Microsoft Sentinel in a single Bicep or Terraform run. The compressed bootstrap that used to take 6-12 weeks of architect time now finishes in 4-7 days.

This guide walks through the full Azure Landing Zone architecture as we deliver it for Fortune 500 healthcare, financial services, government, and defense organizations. EPC Group has delivered Azure architecture engagements since the original Azure General Availability program in 2010 and has deployed landing zones across regulated and unregulated tenants alike.

TL;DR — What an ALZ Includes

Component	Why It Matters
Management Group hierarchy	RBAC + policy inheritance across subscription estate
Subscription topology	Workload isolation, billing separation, blast-radius control
Hub-spoke virtual network	Centralized egress, shared services, security boundaries
Azure Policy initiatives	Compliance posture (CIS, NIST 800-53, HIPAA, PCI DSS)
Azure Monitor + Log Analytics	Unified observability and metric correlation
Microsoft Sentinel	Cloud-native SIEM and incident response
Microsoft Defender for Cloud	CSPM and workload protection
Azure Firewall + Azure Bastion	Network security and management plane access
Azure Backup + Site Recovery	Business continuity and disaster recovery
ExpressRoute or VPN Gateway	Hybrid connectivity to on-premises

Why Landing Zones Matter

Without a landing zone, enterprise Azure adoption typically follows this anti-pattern:

1. Engineering team A creates a subscription, builds workload A in default networking
2. Engineering team B creates a subscription, builds workload B with overlapping IP space
3. Engineering team C creates a subscription, can't connect to A or B
4. Security team retroactively tries to apply policies, hits 100+ violations
5. Networking team retroactively tries to connect everything, hits IP conflicts
6. Cost team can't allocate spending because there's no consistent tagging

Landing zones prevent each of these by establishing the foundation BEFORE workloads land.

Management Group Hierarchy

Microsoft Cloud Adoption Framework recommended hierarchy:

Tenant Root Group
├── Platform (foundation services, shared by all workloads)
│ ├── Connectivity (hub-spoke networking, ExpressRoute)
│ ├── Identity (Microsoft Entra ID, identity workloads)
│ └── Management (Log Analytics, Sentinel, Backup)
├── Landing Zones (workload-hosting subscriptions)
│ ├── Corp (internal corporate workloads)
│ └── Online (internet-facing workloads)
├── Sandbox (experimentation, separate from production)
└── Decommissioned (workloads being retired)

This hierarchy enables Azure Policy inheritance — policies applied at "Tenant Root Group" cascade to all child management groups, with override at lower levels for specific exceptions. EPC Group standard policy structure: tenant-wide CIS controls at root, regulatory-specific at "Corp" level (HIPAA for healthcare, FedRAMP for federal), workload-specific at individual subscriptions.

Hub-Spoke Networking

Hub-spoke is the recommended Azure networking topology for most enterprises:

• Hub VNet (typically 10.0.0.0/16) — central transit network with Azure Firewall, ExpressRoute Gateway, VPN Gateway, Azure Bastion, shared DNS, and Azure Monitor
• Spoke VNets (typically 10.1.0.0/16, 10.2.0.0/16, etc.) — workload-isolated networks peered to hub
• Azure Firewall in hub for centralized egress and east-west traffic inspection
• Azure DDoS Protection for internet-facing workloads
• Network Security Groups at subnet level for fine-grained control

For multi-region deployments, hub-spoke per region with global peering between hubs.

For Microsoft Entra Internet Access and Microsoft Entra Private Access (Microsoft Global Secure Access), the hub-spoke evolves into a service-edge model — appropriate for most enterprises in 2026.

Azure Policy Initiatives

Pre-built initiatives Microsoft maintains:

• CIS Microsoft Azure Foundations Benchmark (v2.0.0)
• NIST SP 800-53 Rev. 5 (FedRAMP foundation)
• HIPAA HITRUST 9.2
• PCI DSS v4
• ISO 27001:2013
• Microsoft Cloud Security Benchmark (Microsoft's own baseline)

Each initiative bundles dozens of individual policies (e.g., "VMs must use managed disks," "Storage accounts must have firewall enabled," "SQL servers must have transparent data encryption enabled"). EPC Group standard deployment assigns 3-5 initiatives at the tenant root and additional regulated-industry initiatives at the Corp level.

Microsoft Sentinel and Defender for Cloud

Sentinel and Defender for Cloud are deployed during landing zone setup, not retroactively:

• Microsoft Sentinel workspace in Management subscription with data connectors to Microsoft Entra ID, M365, Defender for Cloud, Defender for Endpoint, and on-prem AD/firewalls
• Microsoft Defender for Cloud enabled tenant-wide with CSPM (Cloud Security Posture Management) and CWPP (Cloud Workload Protection Platform) — both Standard tier for regulated industries
• Pre-built analytics rules for common attack scenarios
• Standard playbooks for automated response

Hybrid Connectivity

Most enterprises require hybrid connectivity:

• ExpressRoute for high-bandwidth, low-latency private connectivity (typically $300-$5,000/month per circuit + bandwidth)
• VPN Gateway for site-to-site VPN (typically $100-$300/month)
• Azure Virtual WAN for SD-WAN integration with global mesh

EPC Group recommendation: ExpressRoute for tier-1 production workloads, VPN Gateway for development/test, Virtual WAN for geographically distributed enterprises.

Frequently Asked Questions

What is an Azure Landing Zone?

Azure Landing Zone is the foundation infrastructure (management groups, networking, policy, observability, security) that every enterprise Azure subscription should be built on. Microsoft Cloud Adoption Framework Enterprise-Scale Landing Zone is the reference implementation.

How long does an Azure Landing Zone deployment take?

EPC Group standard deployment: 4-7 days for Bicep/Terraform-driven Enterprise-Scale Landing Zone bootstrap. Custom configuration for regulated industries (FedRAMP, HIPAA) extends to 2-3 weeks. Full enterprise rollout including documentation and team training: 4-6 weeks.

What's the difference between Azure Landing Zone and Azure subscription?

Azure subscription is a billing container. Azure Landing Zone is the architectural foundation that subscriptions are organized within. A landing zone deployment creates a management group hierarchy, multiple subscriptions, and the foundational networking and security policies that govern all of them.

Do I need an Azure Landing Zone for a small workload?

For organizations under 100 users with single-team Azure usage, a simplified landing zone is appropriate (single subscription, simplified hub-spoke, basic Defender for Cloud). For Fortune 500 and regulated organizations, full Enterprise-Scale Landing Zone is the standard.

What's the cost of an Azure Landing Zone?

EPC Group fixed-fee Azure Landing Zone implementations, scoped to complexity and regulatory requirements. Ongoing operational costs: management groups + Azure Policy = free, Sentinel ingestion = $5-$25/GB depending on volume, Defender for Cloud Standard = $15/server/month, hub networking = $200-$2,000/month.

How does ALZ support FedRAMP compliance?

EPC Group FedRAMP-aligned landing zones include Azure Government Cloud subscriptions, NIST SP 800-53 Rev. 5 policy initiative, FedRAMP High security baseline configuration, encryption-at-rest with Customer-Managed Keys, hardened management plane with Azure Bastion, comprehensive audit logging to Microsoft Sentinel, and incident response runbooks aligned to FedRAMP continuous monitoring requirements.

Should I use Bicep or Terraform for landing zone deployment?

Both are supported. Microsoft's Enterprise-Scale Landing Zone reference implementation supports Bicep and Terraform. EPC Group recommendation: Bicep for Microsoft-native organizations, Terraform for organizations with multi-cloud (AWS + Azure + GCP) infrastructure-as-code consistency requirements.

How EPC Group Delivers Azure Landing Zones

EPC Group has delivered Azure architecture engagements since the original Azure General Availability program in 2010. Errin O'Connor's Microsoft Press book Microsoft Azure: Plain & Simple covers Azure architecture fundamentals.

Every landing zone engagement we deliver includes management group hierarchy design, subscription topology, hub-spoke networking with Azure Firewall, Azure Policy initiative assignment for compliance posture, Microsoft Sentinel deployment, Microsoft Defender for Cloud configuration, hybrid connectivity (ExpressRoute or VPN Gateway), backup and disaster recovery, and written architecture decision records.

For regulated industries (HIPAA, FedRAMP, FINRA, CMMC), every engagement includes regulatory-specific Azure Policy initiatives, Customer-Managed Keys for encryption, Customer Lockbox enablement, and audit-defensible documentation.

Next Steps

Schedule a 30-minute discovery call at /schedule or call (888) 381-9725. Senior architects (not sales reps) take discovery calls. We'll discuss your current Azure footprint, evaluate landing zone approach, and outline next steps.

Related reading: Azure Cost Optimization Enterprise Guide, Azure Landing Zone Architecture Enterprise Guide, and Microsoft Sentinel Enterprise Guide.