Architecture · Cloud Architecture
Azure Environment Architecture
A landing zone pattern for Azure: management group hierarchy, subscription strategy, hub and spoke networking, policy baseline and centralised logging.
AdvancedUpdated 2026-09-01
Overview
An Azure landing zone establishes the platform before workloads arrive: identity model, management group structure, subscription separation, network topology, policy guardrails, logging destinations and cost governance.
Retrofitting these decisions is expensive because resources cannot easily change subscription boundaries or address space, and policy applied late reveals a backlog of non compliant resources.
Layer model
Platform
Management groups by function and environmentIdentity subscriptionManagement subscription (logging, automation)Connectivity subscription (hub network, firewall, gateways)
Landing zones
Workload subscriptions per application and environmentSpoke virtual networks peered to the hubDelegated RBAC per workload teamTagging enforced by policy
Guardrails
Azure Policy for allowed regions, SKUs and encryptionDeny public network access on data servicesDiagnostic settings enforced to central workspaceBudget alerts and cost allocation
Design considerations
- Plan address space against on premises and other clouds before the first virtual network is created.
- Separate production and non production by subscription to bound blast radius and simplify policy.
- Centralise activity and diagnostic logs in a workspace in a restricted subscription.
- Use PIM for all privileged Azure roles and avoid subscription level Owner assignments.
Security considerations
- Private endpoints for data services and no management ports exposed to the internet.
- Defender for Cloud enabled with actioned recommendations, not just a score.
- Infrastructure as code with review for identity and network changes.
Failure points
- Single region deployment for tier-1 workloads
- Hub firewall as an unmonitored single point
- Policy exemptions that never expire