Do you know the best practices for Azure landing zone design?

Before any app goes into Azure, someone has to set up the basics: the subscriptions, the network, who gets access and which policies apply. Microsoft calls this setup a landing zone. Many teams skip it and set up Azure by hand for each project, so every project ends up different and harder to secure.

That's why you should design the landing zone first, following Microsoft's best practices.

❌ Figure: Bad example - The deployment fails because of a policy the team did not know about

Start from Microsoft's design instead of a blank page

1. Start with an accelerator - Microsoft's ready-made templates, called accelerators, deploy the recommended design as code. For most organizations they are "the fastest path"
2. Decide every design area first - Microsoft lists eight (e.g. identity, network, governance and automation)
3. Separate environments with subscriptions - Development, test and production each get their own, organized under management groups
4. Set the rules with Azure Policy - Assign policies (e.g. allowed regions and required tags) to a management group. Every subscription below inherits them
5. Give roles to groups, not to people - Assign them on the subscription or resource group, a level below the policies
6. Share only what many projects need - Set those services up once, centrally (e.g. the network hub, DNS and one Log Analytics workspace)

Know the rules before you build on one

When the landing zone already exists, ask the team that owns it what was decided, before you design your app. You can see the policies yourself in the Azure portal, under Policy, then Assignments:

Figure: Policy, Assignments lists every policy that applies to the subscription. The last one is set above it, on the Tenant Root Group

Write the answers down in the repo, so the next developer does not have to ask again.

docs/landing-zone.md

Checked 12 Oct 2026 with Bob Northwind (platform team)

Subscription  Northwind-Production. Contributor on the resource group only
Policies      Australia East only. Owner and Environment tags required
Network       Private endpoints required. Private DNS zones are in the hub
Identity      Access through Entra groups. Pipelines use a managed identity
Monitoring    Logs go to the central Log Analytics workspace

✅ Figure: Good example - The answers are in the repo before the design starts