Free notes from Azure Landing Zones

• The eight Azure landing zone design areas at a glance

  The four environment and four compliance design areas of the Cloud Adoption Framework, what each one decides, and which team usually owns it.

• The minimum viable platform landing zone: what to build first

  What a first platform landing zone needs on day one, what can safely wait, and how to grow it without redesigning later.

• The Azure landing zone management group hierarchy explained

  The intermediate root, Platform, Landing zones, Sandboxes and Decommissioned groups: what each is for and why the hierarchy stays shallow.

• Azure Firewall Basic, Standard or Premium for a landing zone hub

  What each Azure Firewall tier adds, where Basic stops being enough, and how to choose for a hub that many workloads share.

• Hub-spoke or Virtual WAN for an Azure landing zone

  The factors that decide between a customer-managed hub and Azure Virtual WAN, and the constraints that can make the choice for you.

• Private endpoint DNS at scale with Azure Policy

  How central private DNS zones and DeployIfNotExists policy register private endpoint records automatically, and the permissions it needs.

• Choosing Azure Policy effects for landing zone guardrails

  When to use Audit, Deny, DeployIfNotExists, Modify and DenyAction in a landing zone, and what each commits you to.

• Bicep or Terraform for an Azure landing zone platform

  How the two infrastructure-as-code options compare for deploying and running an Azure landing zone, and what decides the choice.

About the book · Azure Landing Zones terms in the glossary