Azure Landing Zone: baseline

📅 Updated: August 24, 2025 · ⏱ Estimated duration: 9 min · 🎓 Level: Intermediate

---

🧩 Components

An Azure Landing Zone baseline establishes the essential building blocks of your cloud environment:

1. Identity: Integration with Azure AD and federated identity.
2. Networking: Secure and scalable network design.
3. Management Groups: Subscription hierarchy and policies.
4. Cost Management: Initial cost controls and budgets.
5. Tagging: Resource classification for governance and visibility.

---

👤 Identity

• Implement Azure AD as the central identity provider.
• Enable MFA for all administrative accounts.
• Use custom roles only when strictly necessary.
• Set up security groups and RBAC for delegated access.

---

🌐 Networking

• Define a hub-and-spoke network topology for scalability.
• Configure NSGs (Network Security Groups) and Azure Firewall for security.
• Enable Private Endpoints for critical services.
• Plan hybrid connectivity with VPN Gateway or ExpressRoute if applicable.

---

🏛 Management Groups

• Recommended hierarchical structure:
  • Root Management Group
    • Platform (shared infrastructure)
    • Landing Zones (workloads)
    • Sandbox (innovation and testing)
• Apply Azure Policy at higher management groups for consistent governance.

---

💰 Cost Management

• Set up initial budgets per subscription or resource group.
• Enable spending alerts for financial administrators.
• Use Cost Analysis to identify oversized resources.
• Implement Azure Advisor for optimization recommendations.

---

🏷 Tagging

• Define a standard tagging schema from the start:
  • owner → resource owner.
  • env → environment (dev, test, prod).
  • costcenter → cost center.
  • app → associated app or service.
• Enforce Azure Policy to require mandatory tags at deployment.

---

🛡 Best Practices

1. Identity first → establish security and access before creating resources.
2. Clear networking → define a scalable network design before workloads.
3. Automate → use ARM or Bicep templates for consistency.
4. Early governance → apply policies and RBAC from the baseline.
5. Mandatory tagging → no tags, no production resource.

---

✅ Quick Checklist

---

📊 Success Metrics

• Identity coverage: % of accounts with MFA enabled.
• Policy compliance: number of resources compliant with Azure Policy.
• Tagging execution: % of resources with mandatory tags applied.
• Cost visibility: number of configured alerts and generated reports.

---

📚 Additional Resources

• Microsoft Cloud Adoption Framework – Landing Zones
• Azure Governance Best Practices
• Cost Optimization in Azure

---

💡 Final Recommendation: start with a minimum viable baseline, measure it with compliance metrics, and progressively expand toward a more mature governance model.