Why Landing Zones Matter
The most costly error in enterprise cloud adoption is launching workloads without a solid foundational infrastructure. Organizations that overlook the landing zone phase face several issues, including:
- Inconsistent security configurations
- Network connectivity gaps
- Policy violations that lead to compliance audit findings
- Operational blind spots
Additionally, retrofitting governance onto an existing Azure deployment can cost 3-5 times more than establishing it correctly from the beginning.
Cloud Adoption Framework Pillars
Microsoft's Cloud Adoption Framework defines five foundational pillars:
- Identity — Azure AD integration, conditional access, privileged identity management
- Network — Hub-spoke or Virtual WAN topology, DNS, firewall, ExpressRoute/VPN
- Security — Microsoft Defender for Cloud, Azure Sentinel, security baselines
- Governance — Management groups, Azure Policy, cost management, tagging standards
- Management — Azure Monitor, Log Analytics, update management, backup and recovery
Management Group Hierarchy
The management group hierarchy is the most important architectural decision. It determines how policies propagate and how your environment scales.
Tenant Root Group
├── Platform (Identity, Management, Connectivity)
├── Landing Zones (Corp internal, Online internet-facing)
├── Sandbox (development/experimentation)
└── Decommissioned (retired subscriptions)
Implement policies at the management group level. This approach ensures that they automatically apply to all subscriptions below.
- Use the "Deny" effect for essential security policies.
- For best practices that you want to monitor without immediate enforcement, use the "Audit" effect.
Network Topology Comparison
| Criteria | Hub-Spoke | Virtual WAN |
|---|---|---|
| Management | Customer-managed | Microsoft-managed |
| NVA Support | Full (any vendor) | Select partners |
| Multi-region | Manual peering | Automatic mesh |
| Cost | Lower (simple) | Higher (managed) |
| Best for | Single region, existing NVAs | Multi-region, many branches |
Essential Azure Policies
- Allowed locations — Restrict deployment to approved regions for data residency
- Allowed VM SKUs — Prevent oversized or prohibited VM types
- Require tags — Enforce cost center, environment, and owner tags
- Deny public IP — Prevent accidental internet exposure
- Require encryption — Enforce encryption at rest and in transit
- Audit diagnostic settings — Ensure all resources log to central Log Analytics
- Require NSG on subnets — Enforce network security group association
Security Baseline
Enterprise security baselines should include several key components. These are essential for a robust security posture:
- Enable Microsoft Defender for Cloud (Standard tier for production).
- Deploy Azure Sentinel for SIEM/SOAR.
- Configure Azure DDoS Protection Standard on hub networks.
- Implement Azure Firewall with threat intelligence filtering.
- Enable Key Vault with soft-delete and purge protection.
- Configure Azure Bastion for secure admin access, eliminating public RDP/SSH.
Hybrid Connectivity
ExpressRoute provides dedicated private connections with speeds from 50 Mbps to 100 Gbps. It includes SLA-backed latency, making it suitable for production workloads.
For smaller sites or as a backup, Site-to-Site VPN offers affordable connectivity at speeds up to 10 Gbps.
Most enterprise landing zones utilize both solutions:
- ExpressRoute: Primary connection
- VPN: Failover option
Implementation with EPC Group
EPC Group's Azure landing zone methodology follows four phases: assess requirements (1-2 weeks), design architecture with stakeholder review (2-3 weeks), deploy using Infrastructure as Code with Bicep or Terraform (2-3 weeks), and validate with penetration testing and compliance review (1-2 weeks). We customize the Azure landing zone accelerator for each client's compliance requirements, including HIPAA, SOC 2, and FedRAMP configurations.
Frequently Asked Questions
What is an Azure landing zone?
An Azure landing zone is a pre-configured cloud environment that provides foundational infrastructure for hosting workloads in Azure. It includes identity management (Azure AD integration), network topology (hub-spoke or Virtual WAN), security baselines (Defender for Cloud), governance (Azure Policy, management groups), and monitoring (Azure Monitor, Log Analytics). It is the enterprise-grade foundation that must be in place before deploying production workloads. Microsoft provides reference architectures through the Cloud Adoption Framework.
What is the difference between platform and application landing zones?
Platform landing zones contain shared services: identity, networking, management, and security. Application landing zones are dedicated environments for specific workloads that inherit policies and connectivity from the platform. The platform provides the hub network and firewall; application landing zones connect via peering and inherit security rules. This separation lets central IT manage shared infrastructure while application teams manage their workloads.
Should I use hub-spoke or Virtual WAN topology?
Hub-spoke gives full control over routing and NVAs, best for existing third-party firewall investments. Virtual WAN is Microsoft-managed, simplifying multi-region and branch connectivity. Hub-spoke costs less in simple scenarios; Virtual WAN scales better for complex deployments. For most enterprises starting fresh, hub-spoke with Azure Firewall provides the best balance of control and simplicity.
How do management groups and subscriptions work?
Management groups create a hierarchy above subscriptions for applying Azure Policy and RBAC at scale. The recommended hierarchy: Root (tenant-wide policies), Platform (Identity, Management, Connectivity subscriptions), Landing Zones (Corp and Online applications), Sandbox (development), and Decommissioned. Each level inherits policies from its parent, enabling centralized governance with delegated autonomy.
How long does Azure landing zone implementation take?
Baseline implementation takes 4-8 weeks: management group design (1 week), platform deployment with identity, networking, and management (2-3 weeks), Azure Policy customization (1 week), and validation (1-2 weeks). Complex environments with hybrid connectivity, multiple regions, or stringent compliance requirements can take 12-16 weeks. The Azure landing zone accelerator reduces deployment time by 30-40%.
Need an Azure Landing Zone?
EPC Group designs and implements Azure landing zones for enterprise organizations in healthcare, finance, and government.
Schedule an Azure Architecture ReviewErrin O'Connor
CEO & Chief AI Architect at EPC Group | Microsoft consulting since 1997