Share via

Deploy and configure a Sovereign Landing Zone

  • Article

You need to complete the various prerequisite steps before deploying and configuring the Sovereign Landing Zone (SLZ).

Deploy the SLZ

The SLZ deploys and configures various Azure resources in a manner that aligns with the enterprise-scale landing zone as part of the Cloud Adoption Framework (CAF) best practices and provides appropriate guardrails an organization can configure to achieve their data sovereignty requirements. For a detailed overview of an SLZ and all its capabilities, see Sovereign Landing Zone documentation on GitHub.

Prerequisites

To complete the deployment, you need to perform the prerequisite steps:

  • Ensure that your local environment has the following versions installed (or newer):

    • PowerShell 7.0
    • Azure RM 2.51.0
    • Azure Bicep 0.20.0
    • Azure PowerShell 10.0.0

  • You must have access to a Microsoft Entra ID identity with the following permissions in Azure:

    • Create (or use existing) subscriptions
    • Owner to the subscriptions
    • Create service principals
    • Create policy set definitions and assignments.

Steps to deploy the Sovereign Landing Zone

  1. Check out a local copy of the Sovereign Landing Zone.

  2. Validate the prerequisites have been met for your local runtime environment and Azure permissions by running the Confirm-SovereignLandingZonePrerequisites.ps1 script.

  3. Update the parameter file with the required parameters in your local copy of the SLZ repository. You can create an SLZ deployment with the following minimal parameters:

    • Unique and human-readable names for the SLZ
    • Location and approved location for the deployment
    • Billing information for the newly created or existing subscriptions

  4. (Optional) Add custom policy definitions as needed for compliance.

  5. Run the all step within the New-SovereignLandingZone.ps1 deployment script. The initial deployment process takes about two hours.

  6. Verify the deployment finished by checking out the compliance dashboard output file at the end of the deployment script.

For more information, see Sovereign Landing Zone documentation on GitHub.

Configure the Sovereignty Baseline policy initiatives

You need to use the following SLZ configuration parameters for configuring the Sovereignty Baseline policy initiatives:

  • parAllowedLocations: Use this parameter to configure the location restriction policies for all resources deployed by the SLZ outside of the confidential management group scopes.

  • parAllowedLocationsForConfidentialComputing: Use this parameter to configure the location restriction policies for resources deployed within the confidential management group scopes. This parameter can be the same as the parAllowedLocations parameter but might need to be different if Azure Confidential Computing isn't available in the preferred region.

  • parPolicyEffect: This parameter toggles between the baseline having a deny effect, which is recommended for production workloads, or an audit effect.

For more information, see Sovereign Landing Zone documentation on GitHub.

Use the policy portfolio or ALZ policies

Any preview initiative within the policy portfolio must have its definition deployed prior to being used in an SLZ deployment. Review the article on policy portfolio for details about deploying these definitions. You can use these steps to deploy the definitions to any existing landing zone.

Use the following configuration parameters for configuring these policy initiatives:

  • parCustomerPolicySets: This parameter allows a user to specify a list of policy set definitions to assign at the top-level management group scope for an SLZ deployment.

  • parDeployAlzDefaultPolicies: This parameter enables the ALZ policies to be deployed at relevant scopes within an SLZ deployment.

For more information, see Sovereign Landing Zone documentation on GitHub.

Deploy a platform or application landing zone

After an SLZ has been deployed, you can provision platform or application landing zone through the following steps:

  1. Check out a local copy of the ALZ Landing Zone Vending.

  2. Reference the existing SLZ deployment logs for relevant management groups, locations, resource IDs, etc. needed to configure the vending module.

  3. Update the main.bicep file with the appropriate parameters and run the bicep script.

For more information, see Sovereign Landing Zone documentation on GitHub.

See also