plan-forge caf.instructions.md

Azure Cloud Adoption Framework (CAF) Governance

Based on the Microsoft Cloud Adoption Framework for Azure. CAF is the environment governance layer — it governs how subscriptions, management groups, and shared services are organized across the enterprise, above the workload level.

---

Management Group Hierarchy

Root Management Group
├── Platform
│   ├── Identity         (AAD, PIM, DNS)
│   ├── Management       (Log Analytics, Automation, Backup)
│   └── Connectivity     (hub VNet, ExpressRoute, Azure Firewall)
└── Landing Zones
    ├── Corp             (internal workloads — connected to hub)
    │   ├── Production subscriptions
    │   └── Non-prod subscriptions
    └── Online           (internet-facing workloads — no hub connectivity required)
        ├── Production subscriptions
        └── Non-prod subscriptions

IaC: Management Group Structure

// management-groups.bicep — deploy at tenant scope
targetScope = 'tenant'

resource landingZones 'Microsoft.Management/managementGroups@2023-04-01' = {
  name: 'mg-landing-zones'
  scope: tenant()
  properties: {
    displayName: 'Landing Zones'
    details: { parent: { id: tenantResourceId('Microsoft.Management/managementGroups', rootMgId) } }
  }
}

resource corpLz 'Microsoft.Management/managementGroups@2023-04-01' = {
  name: 'mg-corp'
  properties: {
    displayName: 'Corp'
    details: { parent: { id: landingZones.id } }
  }
}

---

Subscription Design

Pattern	When to Use
One subscription per workload	Default for most landing zones
One subscription per environment (dev/prod)	High-compliance or regulated workloads
Shared subscription	Only for non-production, shared infrastructure

Subscription Naming

sub-{workload}-{environment}
sub-payments-prod
sub-payments-nonprod
sub-platform-identity
sub-platform-management
sub-platform-connectivity

---