azure-landing-zone-setup

Azure Landing Zone Setup

Purpose

Azure's isolation boundary is the subscription, not the account — and subscriptions default to being cheap and numerous, which is a feature if the tenant has a real Management Group hierarchy and a liability if it doesn't. Without a landing zone, organizations end up with dozens of subscriptions with inconsistent Azure Policy assignments, no shared connectivity hub, and RBAC assigned ad hoc at the resource group level. This skill defines a landing zone aligned to Microsoft's Cloud Adoption Framework (CAF) "enterprise-scale" pattern: a Management Group hierarchy that mirrors organizational/environment boundaries, policy-as-guardrail enforced at scale, and a repeatable subscription vending process — so new teams get compliant subscriptions in hours, not weeks of manual RBAC and policy setup.

When to use

• Standing up a new Azure tenant or restructuring subscriptions under Management Groups for the first time.
• Deciding the Management Group hierarchy and which Azure Policy initiatives apply at which level.
• Onboarding a new subscription for a business unit, product team, or environment (dev/test/prod).
• Migrating from the classic CAF "foundation" template to "enterprise-scale," or from a flat single-subscription tenant.
• Auditing an existing tenant for Azure Policy compliance drift or subscriptions that sit outside any Management Group governance.

Prerequisites & environment

• Global Administrator or at least Owner/User Access Administrator at the tenant root Management Group to create the Management Group hierarchy.
• Azure CLI ≥ 2.60 or Azure PowerShell Az module, and Terraform ≥ 1.5 with the azurerm provider ≥ 3.x if using IaC (the azurerm provider's Management Group and Policy resources changed materially between 2.x and 3.x — do not mix generations of examples).
• An Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), or Cloud Solution Provider (CSP) billing relationship — subscription creation mechanics (and who can automate it) differ by agreement type.
• Decide the accelerator: the Azure Landing Zone (ALZ) Bicep/Terraform modules (Azure/alz-terraform-accelerator) for enterprise-scale, or a lighter hand-rolled Management Group + Policy setup for smaller estates. Enterprise-scale is the right default above roughly a handful of subscriptions or multiple business units.
• Microsoft Entra ID (formerly Azure AD) tenant with groups already modeled for RBAC assignment (don't assign roles to individual users in a landing zone).