Azure Landing Zones
Understand what a landing zone is, explore the conceptual architecture for enterprise-scale landing zones, and deploy a landing zone using the Azure portal accelerator.
Azure Landing Zones is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a Landing Zone?
An Azure Landing Zone is a pre-configured Azure environment that provides the foundational infrastructure and governance capabilities that all workloads in an organisation can build on. Think of it as the 'runway' that workloads land on when they arrive in Azure. A landing zone is not a single resource — it is a collection of subscriptions, management groups, networking, identity, policies, and monitoring configurations that implement an organisation's standards.
Why Landing Zones Exist
Without a landing zone, each team deploying to Azure creates its own networking, security controls, and governance independently — leading to inconsistency, security gaps, and ungoverned costs. A landing zone solves this by establishing shared platform services (connectivity hub, identity, monitoring) once, then allowing application teams to deploy their workloads into pre-approved, compliant environments with guardrails already in place.
Platform vs. Application Landing Zones
Landing zones are divided into two categories:
- Platform landing zones — subscriptions that host shared services used by all applications: connectivity (hub VNet, firewall, VPN gateway), identity (Entra ID domain controllers), and management (Log Analytics workspace, Azure Monitor)
- Application landing zones — subscriptions where individual workloads are deployed, already connected to platform services and governed by inherited policies
Management Group Hierarchy in Landing Zones
The landing zone architecture uses a management group hierarchy to apply policies and access controls at different scopes. A typical enterprise hierarchy looks like:
- Root Management Group — tenant-wide policies (e.g., deny resource creation outside approved regions)
- Platform — management, connectivity, identity subscriptions
- Landing Zones — prod, non-prod child management groups
- Sandboxes — experimental subscriptions with relaxed policies
# Create a management group:
az account management-group create \
--name 'LandingZones' \
--display-name 'Landing Zones'
# Move a subscription into the management group:
az account management-group subscription add \
--name 'LandingZones' \
--subscription 'my-app-subscription-id'Connectivity in the Landing Zone
The connectivity subscription hosts the hub VNet, which contains shared network services: Azure Firewall for centralised outbound traffic inspection, VPN Gateway or ExpressRoute for on-premises connectivity, Azure DNS private zones, and peering connections to all spoke (application) VNets. Application teams connect their VNets to the hub via VNet peering without needing to manage their own firewall or VPN.
Identity in the Landing Zone
The identity subscription hosts any infrastructure needed for on-premises Active Directory integration — typically Azure Active Directory Domain Services (AADDS) or Windows Server VMs running Active Directory domain controllers. Centralising identity in a dedicated subscription prevents identity infrastructure from being accidentally modified by application teams and ensures it is governed independently.
Management in the Landing Zone
The management subscription hosts the tooling used to operate all workloads across the environment:
- Log Analytics workspace — centralised log ingestion from all subscriptions
- Azure Monitor — alerts and dashboards for the entire estate
- Azure Automation — automated patching and runbooks
- Azure Backup vault — centralised backup for VMs and databases
Centralising these tools reduces duplication and provides a single operational view.
Azure Policy in Landing Zones
Azure Policy is the enforcement layer of the landing zone. Policies assigned at the root or landing zones management group automatically apply to all subscriptions below. Common policies in a landing zone include: require tags on all resource groups, deny public IP on VMs, require diagnostic settings enabled, deny resource creation outside approved regions, and enforce HTTPS on storage accounts.
# Assign a policy to a management group:
az policy assignment create \
--name 'RequireTags' \
--scope '/providers/Microsoft.Management/managementGroups/LandingZones' \
--policy 'RequireTagOnResourceGroups' \
--params '{"tagName":{"value":"CostCenter"}}'The Landing Zone Accelerator
Microsoft provides an Azure Landing Zone Accelerator — a set of Bicep or Terraform templates that deploy the entire conceptual landing zone architecture automatically. The accelerator creates the management group hierarchy, platform subscriptions, networking infrastructure, policy assignments, and diagnostic settings in a single deployment. It is the fastest way to get a production-ready landing zone foundation in place.
# Deploy the CAF Landing Zone using Bicep templates:
# 1. Clone https://github.com/Azure/ALZ-Bicep
# 2. Run the deploy.sh script with your tenant and subscription details:
# ./scripts/deploy.sh --parTenantId <id> --parSubscriptionId <id>
# This creates management groups, policies, and platform subscriptionsScaling Landing Zones
Landing zones are designed to scale as the organisation adds more applications. Adding a new application means creating a new application landing zone subscription, peering its VNet to the hub, and assigning the appropriate team RBAC roles. Because the governance policies are inherited from the management group hierarchy, the new subscription is immediately compliant without requiring manual policy configuration by the application team.
Landing Zones and the CAF
Azure Landing Zones are the deliverable of the Ready stage of the Cloud Adoption Framework. They bridge the gap between the strategic decision to adopt Azure and the actual deployment of workloads. A well-designed landing zone accelerates subsequent migration and innovation waves because application teams spend less time on foundational infrastructure and more time on delivering business value.
Quick Check
Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.
Lesson Recap
In this lesson you learned: a landing zone is a pre-configured environment with shared platform services, governance, and networking foundations; it is divided into platform landing zones (connectivity, identity, management) and application landing zones; and the Landing Zone Accelerator provides Bicep/Terraform templates to deploy the full architecture rapidly. Next up we explore hub-and-spoke network topology in depth.
Frequently asked questions
Is the “Azure Landing Zones” lesson free?
Yes — the full text of “Azure Landing Zones” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Azure Landing Zones”?
Understand what a landing zone is, explore the conceptual architecture for enterprise-scale landing zones, and deploy a landing zone using the Azure portal accelerator. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Azure Landing Zones” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.