What is an Azure landing zone?

The Ready phase of the Cloud Adoption Framework helps you design your Azure landing zone to meet your organization's requirements. An Azure landing zone is a proven and flexible architecture for governing, securing, and scaling a multi-subscription Azure environment. An Azure landing zone consists of two components:

• Platform landing zone: The centralized foundation that establishes governance, security, and shared resources for all your Azure workloads.

• Application landing zones: Azure environments where you deploy and operate workload resources within the standards established by the platform landing zone.

You can implement each component of your Azure landing zone in one of two ways:

• Accelerators: Microsoft-provided accelerators for both platform landing zone and application landing zone scenarios use infrastructure as code to deploy Azure environments based on recommended practices.

• Custom build: You design and build the solution internally or with support from Microsoft or Microsoft partners.

For most organizations, accelerators provide the fastest path to a deployment that aligns with Microsoft's recommended practices.

Azure landing zone architecture

Every Azure landing zone starts with the platform landing zone. Before you build a platform landing zone, define organizational requirements across the Azure landing zone design areas. These decisions determine how you design your Azure landing zone.

The Azure landing zone reference architecture represents a recommended target architecture. Use it as a starting point and adapt it to meet your organization's requirements.

Conceptual

Beneath that, the application landing zones section, managed by workload teams, shows Microsoft Fabric compute and Data and AI/ML workloads (Azure Databricks, Azure Machine Learning) to the left, and Workload 1 and Workload n boxes each containing Azure resources. A Microsoft Foundry (Foundry IQ) box connects upward to the workloads to integrate AI. Dashed lines below link the Azure box to Microsoft Copilot Studio, Microsoft Fabric (Fabric IQ), and Microsoft 365 (Microsoft 365 Copilot, Work IQ). A bottom row labeled "All data sources" lists On-premises, Dataverse, Microsoft 365, Azure workloads, and Other clouds.

Hub & Spoke

Around the middle are individual subscriptions as boxes. Security and Management subscriptions (D, upper left) contain Log Analytics workspaces, Microsoft Sentinel, and dashboards. The Identity subscription holds virtual networks with domain services and Recovery Services vaults. The Connectivity subscription (E) contains Azure DDoS Protection, Azure DNS, VPN/ExpressRoute gateways, Azure Firewall, and peered hub virtual networks across two regions. Application landing zone A2 and P1 subscriptions (F) hold application virtual networks, resource groups, and workload resources (G) and a Sandbox subscription (H) at right. Each subscription repeats a common toolset row: Action Groups, Alerts, Cost Management, Role assignment, Policy assignment, Network Watcher, Defender for Cloud, and Azure Update Manager.

Azure landing zone architecture using a hub & spoke networking topology. Download a Visio file or PDF file of this architecture.

Virtual WAN

Around the middle are individual subscriptions as boxes. Security and Management subscriptions (D, upper left) contain Log Analytics workspaces, Microsoft Sentinel, and dashboards. The Identity subscription holds virtual networks with domain services and Recovery Services vaults. The Connectivity subscription (E) contains Azure DDoS Protection, Azure DNS, Azure Firewall, and two Azure Virtual WAN hubs (Region 1 and Region N) with VPN/ExpressRoute gateways. VWAN Hub Connection lines link these hubs to the application landing zone virtual networks. Application landing zone A2 and P1 subscriptions (F) hold application virtual networks, resource groups, and workload resources (G) and a Sandbox subscription (H) at right. Each subscription repeats a common toolset row: Action Groups, Alerts, Cost Management, Role assignment, Policy assignment, Network Watcher, Defender for Cloud, and Azure Update Manager.

Azure landing zone architecture using an Azure Virtual WAN networking topology. Download a Visio file or PDF file of this architecture.

Management Group Hierarchy Only

In the Subscriptions band below, each management group links to its subscriptions. Security, Management, Identity, and Connectivity management groups each map to a matching subscription of the same name. Corp connects to the application landing zone A1, Application landing zone P1, and application landing zone A2 subscriptions. Local connects to application landing zone C1 subscription (Azure Local Clusters) and application landing zone A1 subscription (Applications). Decommissioned maps to a Decommissioned subscription, and Sandbox maps to Sandbox subscription 1 and Sandbox subscription 2. The Online management group has no subscription shown beneath it.

Azure landing zone architecture's Management Group hierarchy only. Download a Visio file or PDF file of this architecture.

Platform vs. application landing zones

The central and upper structures remain unshaded, above is the the Enterprise Agreement/Microsoft Customer Agreement billing hierarchy (A), Identity and access management (B), Microsoft Entra ID with on-premises Active Directory Domain Services, and Git repository, boards, and pipelines.

Azure landing zone architecture's management group hierarchy only. Download a Visio file or PDF file of this architecture.

Platform landing zone

The platform landing zone establishes your organization's Azure foundation. It defines how you organize your Azure resources, enforce governance, and provide shared capabilities centrally. Most organizations should have only one platform landing zone per Microsoft Entra tenant.

A platform landing zone consists of a management group hierarchy and centralized resources (as needed). An important function of the platform is to have a way to distribute application landing zones to workload teams.

• Management group hierarchy: The management group hierarchy provides the governance structure for the Azure environment. It organizes all of your Azure subscriptions and applies governance standards to those subscriptions. The hierarchy separates platform resources and workload resources. A well-designed hierarchy allows you to apply governance standards consistently without creating unnecessary administrative complexity.

• Centralized resources: Many organizations provide certain capabilities centrally so every workload can use the same approved services and standards. Common examples include connectivity and networking, security monitoring, Active Directory identity services, and management services. What you centralize depends on your requirements. Only centralize capabilities that provide clear governance, operational, or economic benefits across multiple workloads.

• Key platform responsibility: You need a repeatable process for requesting, creating, and distributing application landing zones to workload teams. A standardized approach ensures every new application landing zone follows your organization's governance and security baselines. You can do this process manually or automate it. As the number of application landing zone requests grows, automation becomes increasingly important. See Subscription vending.

Implementation options: Microsoft provides several platform landing zone accelerators that implement recommended architecture patterns and organizational guardrails. See Platform landing zone implementation options. You can also develop your own implementation or work with Microsoft or Microsoft partners to build a customized platform landing zone.

Application landing zones

Application landing zones host Azure workload resources. Most workloads use multiple application landing zones, with separate application landing zones for each environment such as development, testing, and production. An application landing zone can be one or more Azure subscriptions. You only need multiple Azure subscriptions when required to accommodate workload requirements, organizational boundaries, or Azure subscription limits.

The platform team places application landing zones in either the Online, Internal ("Corp"), or Local management group under the (application) "Landing zones" management group. The application landing zones inherit the governance and security policies from the Azure Policies applied to the management group hierarchy. This model provides consistent guardrails and allows flexibility to meet workload-specific requirements.

Implementation options: Microsoft provides several accelerators to establish application landing zones. You can also implement their own approach or engage Microsoft or Microsoft partners for assistance. See the Azure Architecture Center for a list of application landing zone accelerators.

Technology adoption in an Azure landing zone

An Azure landing zone supports new and emerging technologies without requiring changes to the overall architecture. You deploy workload resources into application landing zones regardless of workload type, such as AI. As new requirements emerge, you update the governance and security policies in the platform landing zone. Those policies are then applied consistently across application landing zones, which helps you adopt new technologies faster and maintain consistency across all workloads of that type.

The Cloud Adoption Framework provides guidance for common adoption scenarios to help you prepare your people, processes, and platform for successful adoption. See Scenarios.

Next steps

Design principles