Azure Landing Zones

What's inside

A landing zone is a set of decisions that are cheap to make on the first day and expensive to change once workloads depend on them.

This independent guide follows Microsoft's Cloud Adoption Framework through every design area of an Azure landing zone, explains what each decision commits you to, and then builds the result as code. It is written for engineers and architects who already know the individual Azure services and now have to design, build or run an estate of many subscriptions.

Four parts, fifteen chapters

• The framework: what the Cloud Adoption Framework is for, what a landing zone is and isn't, the platform and workload landing zones, the minimum viable platform, and the eight design areas as a decision process with a decision log.
• Environment design areas: billing offers and the Microsoft Entra tenant, platform identity and access with PIM and emergency access, the management group hierarchy, naming and tagging, subscription vending, hub-spoke and Virtual WAN networks, ExpressRoute and VPN, DNS and private endpoints at scale.
• Compliance design areas: governance with Azure Policy by archetype, Defender for Cloud and Microsoft Sentinel, the Sovereign Landing Zone, Log Analytics and data collection, Azure Monitor Baseline Alerts, patching and backup through policy, and platform automation with the Azure Landing Zones IaC Accelerator and workload identity federation.
• Living with a landing zone: workload landing zones for data and AI, sandboxes and decommissioning, adopting existing subscriptions, bringing resources under code, drift, reviews and the platform team's operating model.

Inside

• Comparison tables for the close calls, such as which billing offer, which firewall tier, hub-spoke or Virtual WAN, which policy effect, and Bicep or Terraform.
• 174 Common pitfall callouts that name the mistakes real estates make and what to do instead.
• 15 architecture diagrams, from the CAF phases and the management group hierarchy to private endpoint DNS, policy inheritance and the brownfield transition.
• Build it sections in chapters 4 to 15, with Terraform and Bicep built on Azure Verified Modules in a free companion repository on GitHub, deployed and destroyed in a test tenant, with what to expect and what to watch for when you run it.
• A glossary of 340 terms, each linked to Microsoft Learn, with a free online version for print readers.

Up to date

Azure changes quickly. This edition reflects Microsoft's documentation as of October 2026, including the move from application to workload landing zones, the Azure Verified Modules-based accelerator and the trimmed Cloud Adoption Framework scenarios.

Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who designs Azure landing zones and holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.

Part of the Ultra Transcenders series from Distilled Press: Beyond the Exam. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.

Is this book for you?

• Yes, if you design, build or run an Azure estate of many subscriptions, as a platform or cloud engineer, architect or consultant, and want the decisions behind it as well as the reference architecture.
• It isn't an exam guide. It follows Microsoft's own framework rather than an exam outline, and assumes you already know the individual Azure services, at about the level of the AZ-104 and AZ-305 exams.
• Companion code: github.com/Distilled-Press/azure-landing-zones, under the MIT Licence, tested in October 2026 with Terraform 1.13.4, Bicep CLI 0.48.1 and Azure CLI 2.91.0. Deploy it in a test environment, never production.

New to the individual services?

Start with the exam books this one builds on:

Ultra Transcenders AZ-104: Microsoft Azure Administrator

Know which role, setting or tool does the job, and why.

Buy on AmazonStudy notes

Free with Kindle Unlimited

Ultra Transcenders AZ-305: Designing Microsoft Azure Infrastructure Solutions

Choose the right design, and explain why.

Buy on AmazonStudy notes

Free with Kindle Unlimited

What the book covers

Part 1: The framework

• 1. The Cloud Adoption Framework in one chapter
  The seven phases (Strategy, Plan, Ready, Adopt, Govern, Secure, Manage) and the decision each answers; teams and roles; where landing zones sit; CAF, Well-Architected and the Architecture Center; scenarios.
• 2. What a landing zone is (and isn't)
  Platform vs workload landing zones; conceptual and reference architectures (hub-spoke, Virtual WAN); accelerators vs custom build; the minimum viable platform landing zone; when a small organisation doesn't need the full pattern.
• 3. Design areas as a decision process
  The eight design areas, who decides each, the order to take them in, a decision log.

Part 2: Environment design areas

• 4. Billing and tenant
  EA, MCA and CSP; subscription creation rights; single vs multiple tenants; test tenants.
• 5. Identity and access for the platform
  Platform RBAC model; PIM and emergency access; custom roles; identity subscription (AD DS vs Entra Domain Services); workload identity federation; Azure Lighthouse.
• 6. Resource organisation
  Management group hierarchy, intermediate root, archetypes; subscriptions as the unit of scale; resource groups; naming and tagging.
• 7. Subscription vending
  Intake, what a vended subscription gets, AVM vending modules, pipelines, IP address management.
• 8. Network topology I: hub-spoke
  Hub design, Azure Firewall vs NVAs, forced tunnelling, peering, Azure Virtual Network Manager, IP planning, multi-region.
• 9. Network topology II: Virtual WAN, hybrid and DNS
  Secured hubs, routing intent, choosing a topology, ExpressRoute and VPN resilience, private DNS and DNS Private Resolver, private endpoint DNS through policy, ingress, DDoS.

Part 3: Compliance design areas

• 10. Governance at scale with Azure Policy
  Landing zone library and archetypes, assignments, effects, remediation, exemptions, policy as code, built-in migration, cost guardrails.
• 11. Security baseline
  Security subscription, Defender for Cloud, Sentinel, Key Vault per workload, Zero Trust via CAF Secure, Sovereign Landing Zone.
• 12. Management baseline
  Log Analytics design, AMBA-ALZ, Update Manager, Change Tracking, Backup and Site Recovery through policy, CAF Manage (RAMP).
• 13. Platform automation and DevOps
  Bicep vs Terraform, Azure Verified Modules, the IaC accelerator phases, GitHub vs Azure DevOps, state, workload identity federation, portal accelerator, staying current.

Part 4: Living with a landing zone

• 14. Workload landing zones
  Placement (Corp, Online, Local), workload accelerators, data and AI workloads, sandbox and decommissioning.
• 15. Brownfield and day two
  Adopting existing subscriptions, moving to AVM, drift, periodic reviews, the platform team operating model.

Plus an appendix glossary of 300+ terms, each linked to Microsoft Learn, with the same terms explained free online for print readers.

Sample diagrams

Free notes

Some sections of the book, free to read online:

• The eight Azure landing zone design areas at a glance

  The four environment and four compliance design areas of the Cloud Adoption Framework, what each one decides, and which team usually owns it.

• The minimum viable platform landing zone: what to build first

  What a first platform landing zone needs on day one, what can safely wait, and how to grow it without redesigning later.

• The Azure landing zone management group hierarchy explained

  The intermediate root, Platform, Landing zones, Sandboxes and Decommissioned groups: what each is for and why the hierarchy stays shallow.

• Azure Firewall Basic, Standard or Premium for a landing zone hub

  What each Azure Firewall tier adds, where Basic stops being enough, and how to choose for a hub that many workloads share.

• Hub-spoke or Virtual WAN for an Azure landing zone

  The factors that decide between a customer-managed hub and Azure Virtual WAN, and the constraints that can make the choice for you.

• Private endpoint DNS at scale with Azure Policy

  How central private DNS zones and DeployIfNotExists policy register private endpoint records automatically, and the permissions it needs.

• Choosing Azure Policy effects for landing zone guardrails

  When to use Audit, Deny, DeployIfNotExists, Modify and DenyAction in a landing zone, and what each commits you to.

• Bicep or Terraform for an Azure landing zone platform

  How the two infrastructure-as-code options compare for deploying and running an Azure landing zone, and what decides the choice.