Azure Landing Zones Explained: A Starting Point That Won't Need a Rewrite

A landing zone is the environment your workloads land in — subscriptions, management groups, policies, and networking, set up before the first application gets deployed. Getting this wrong doesn't show up immediately; it shows up eight months later when you need to retrofit governance onto fifty resource groups.

Management group hierarchy first

Decide how subscriptions are grouped — by environment, by business unit, by workload type — before you create your first subscription. This hierarchy is where Azure Policy and RBAC inherit from, and restructuring it later means reassigning policy at scale.

Policy as guardrails, not gates

Azure Policy should stop obviously wrong configurations (public storage accounts, unencrypted disks) without requiring a human to approve every deployment. Start with a small set of deny policies for genuine risks, and audit-mode policies for everything else while you learn what's actually normal in your environment.

Networking topology decides your ceiling

Hub-and-spoke with a central hub for shared services (firewall, DNS, VPN gateway) is the standard starting point for most mid-size organizations. It's not the only valid topology, but it's the one that scales cleanly from five workloads to fifty without a redesign.