Deploy and configure a Sovereign Landing Zone

You need to complete the various prerequisite steps before deploying and configuring the Sovereign Landing Zone (SLZ).

Deploy the SLZ

The SLZ deploys and configures various Azure resources in a manner that aligns with the enterprise-scale landing zone as part of the Cloud Adoption Framework (CAF) best practices and provides appropriate guardrails an organization can configure to achieve their data sovereignty requirements. Select the deployment technology for further deployment information.

Bicep

You need to complete various prerequisite steps before deploying and configuring the Sovereign Landing Zone (SLZ) using Bicep. For a detailed overview of an SLZ and all its capabilities, see Sovereign Landing Zone (Bicep) documentation on GitHub.

Prerequisites

To complete the deployment, you need to perform the prerequisite steps:

• Ensure that your local environment has the following versions installed (or newer):

  • PowerShell 7.0
  • Azure RM 2.51.0
  • Azure PowerShell 10.0.0
  • Azure Bicep 0.20.0

• Ensure that you have access to a Microsoft Entra ID identity with the following permissions in Azure:

  • Create (or use existing) subscriptions
  • Owner to the subscriptions
  • Create service principals
  • Create policy set definitions and assignments.

Steps to deploy the Sovereign Landing Zone

1. Check out a local copy of the Sovereign Landing Zone.

2. Validate whether the prerequisites are met for your local runtime environment and Azure permissions by running the Confirm-SovereignLandingZonePrerequisites.ps1 script.

3. Update the parameter file with the required parameters in your local copy of the SLZ repository. You can create an SLZ deployment with the following minimal parameters:

   • Unique and human-readable names for the SLZ
   • Location and approved location for the deployment
   • Billing information for the newly created or existing subscriptions

4. (Optional) Add custom policy definitions as needed for compliance.

5. Run the all steps within the New-SovereignLandingZone.ps1 deployment script. The initial deployment process can take upwards of an hour.

6. Verify the deployment finished by checking out the compliance dashboard output link displayed at the end of the deployment.

Configure the Sovereignty Baseline policy initiatives

You need to use the following SLZ configuration parameters for configuring the Sovereignty Baseline policy initiatives:

• parAllowedLocations: Use this parameter to configure the location restriction policies for all resources deployed by the SLZ outside of the confidential management group scopes.

• parAllowedLocationsForConfidentialComputing: Use this parameter to configure the location restriction policies for resources deployed within the confidential management group scopes. This parameter can be the same as the parAllowedLocations parameter but might need to be different if Azure Confidential Computing isn't available in the preferred region.

• parPolicyEffect: This parameter toggles between the baseline having a deny effect, which is recommended for production workloads, or an audit effect.

Use the policy portfolio or ALZ policies

Any preview initiative within the policy portfolio must have its definition deployed before being used in an SLZ deployment. Review the article on policy portfolio for details of deploying these definitions. You can use these steps to deploy the definitions to any existing landing zone.

Use the following configuration parameters for configuring these policy initiatives:

• parCustomerPolicySets: This parameter helps you specify a list of policy set definitions to assign at the top-level management group scope for an SLZ deployment.

• parDeployAlzDefaultPolicies: This parameter enables the ALZ policies to be deployed at relevant scopes within an SLZ deployment.

Terraform

You need to complete various prerequisite steps before deploying and configuring the Sovereign Landing Zone (SLZ) using Terraform. For a detailed overview of an SLZ and all its capabilities, see Sovereign Landing Zone (Terraform) documentation on GitHub.

Prerequisites

To complete the deployment, you need to perform the prerequisite steps:

• Ensure that your local environment has the following versions installed (or newer):

  • Terraform v1.9.0
  • PowerShell 7.0
  • Azure RM 2.51.0
  • Azure PowerShell 10.0.0
  • ALZ 4.0.0

• Ensure that you have access to a Microsoft Entra ID identity with the following permissions in Azure:

  • Create (or use existing) subscriptions
  • Owner to the subscriptions
  • Create service principals
  • Create policy set definitions and assignments.

Steps to deploy the Sovereign Landing Zone

1. Download a copy of the inputs.yaml to configure your deployment. You can create an SLZ deployment with the following minimal parameters:

   • Unique and human-readable names for the SLZ
   • Location and approved location for the deployment
   • Billing information for the newly created or existing subscriptions

2. (Optional) Add custom policy definitions as needed for compliance.

3. Run the deploy accelerator PowerShell command to check out a local copy of the Sovereign Landing Zone (Terraform).

Deploy-Accelerator -iac terraform -bootstrap alz_local -inputConfigFilePath path\to\inputs.yaml

4. Run the terraform apply command. The initial deployment process can take upwards of an hour.

5. Verify whether the deployment is complete by checking out the compliance dashboard output link displayed at the end of the deployment.

Configure the Sovereignty Baseline policy initiatives

You need to use the following SLZ configuration parameters for configuring the Sovereignty Baseline policy initiatives:

• allowed_locations: Use this parameter to configure the location restriction policies for all resources deployed by the SLZ outside of the confidential management group scopes.

• allowed_locations_for_confidential_computing: Use this parameter to configure the location restriction policies for resources deployed within the confidential management group scopes. This parameter can be the same as the allowed_locations parameter but might need to be different if Azure Confidential Computing isn't available in the preferred region.

• policy_effect: This parameter toggles between the baseline having a deny effect, which is recommended for production workloads, or an audit effect.

Use the policy portfolio or ALZ policies

Any preview initiative within the policy portfolio must have its definition deployed before being used in an SLZ deployment. Review the article on policy portfolio for details about deploying these definitions. You can use these steps to deploy the definitions to any existing landing zone.

Use the following configuration parameters for configuring these policy initiatives:

• customer_policy_sets: This parameter helps you specify a list of policy set definitions to assign at the top-level management group scope for an SLZ deployment.

• apply_alz_archetypes_via_architecture_definition_template: This parameter enables the ALZ policies to be deployed at relevant scopes within an SLZ deployment.

Deploy a platform or application landing zone

After an SLZ has been deployed, you can provision platform or application landing zone through the following steps:

1. Check out a local copy of the ALZ Landing Zone Vending.

2. Reference the existing SLZ deployment logs for relevant management groups, locations, resource IDs, etc. needed to configure the vending module.

3. Update the main.bicep file with the appropriate parameters and run the bicep script.

See also

• Overview of the Sovereign Landing Zone
• Sovereign Landing Zone concepts
• Policy portfolio