Azure Enterprise Landing Zone: What You Must Get Right Before Deploying at Scale
The Azure Enterprise-Scale Landing Zone is the foundational architecture that determines how every workload in your organisation runs on Azure. Get it right and you have a platform that scales cleanly, enforces governance automatically, and gives workload teams the freedom to move fast inside guardrails. Get it wrong and every workload deployment becomes a remediation project. This guide covers the components that matter most for 2026 enterprise deployments.
Management Group and Subscription Hierarchy
The management group hierarchy is the governance skeleton of your landing zone. The Enterprise-Scale reference architecture uses a five-level hierarchy: Tenant Root Group, a top-level management group for your organisation, then Platform, Landing Zones, Decommissioned, and Sandbox groups below it.
The critical design decision is where to place subscription-level policy assignments versus management group-level assignments. Policies assigned at a management group level cascade to all subscriptions underneath — which is powerful for baseline controls (diagnostic settings, allowed regions, encryption requirements) but dangerous if applied too broadly. Start conservative: assign baseline security policies at the Landing Zones management group level, and only push stricter controls down to specific child groups where workload requirements demand it.
Policy Hierarchy and Enforcement
Azure Policy is the enforcement mechanism for your governance model. The Enterprise-Scale approach uses Azure Policy Initiative (Policy Set) assignments at management group levels, with individual policies grouped by domain: security baseline, network controls, identity controls, cost management, and logging requirements.
Deny policies stop non-compliant resource creation. Audit policies surface non-compliance without blocking deployment. DeployIfNotExists policies automatically remediate missing configuration. The art is choosing the right effect for each control — deny too aggressively and you block legitimate workloads; audit too liberally and compliance becomes a reporting exercise rather than an enforcement mechanism.
Hub-Spoke Networking
The network topology for Enterprise-Scale deployments is hub-spoke with Azure Virtual WAN or a traditional hub VNet depending on scale requirements. The hub contains shared network services: Azure Firewall (or NVA), ExpressRoute or VPN gateways, Azure Bastion for secure management access, and private DNS zones for private endpoint resolution.
Each landing zone subscription has one or more spoke VNets peered to the hub. Traffic between spokes goes through the hub firewall — this is the east-west traffic inspection model. Internet-bound traffic from spokes is forced through the hub firewall via User Defined Routes. This model gives your security team a single enforcement point for all network traffic.
Identity and Access Governance
Enterprise-Scale identity design separates platform identity (who manages Azure itself) from workload identity (who manages applications). Platform identity uses Entra ID Privileged Identity Management (PIM) for just-in-time access to management group and subscription-level roles. Workload identity uses managed identities wherever possible — avoiding credential management for application-to-Azure service authentication.
Role assignment discipline matters: assign roles at the lowest scope that satisfies the requirement, use built-in roles before creating custom ones, and use groups rather than individual user assignments to make role management auditable and scalable.
What to Get Right Before Workloads Arrive
- Private DNS zone strategy: Centralise private DNS zones in the hub subscription and link to all spoke VNets before the first private endpoint is deployed
- Log aggregation: Deploy a central Log Analytics workspace at the platform level and configure diagnostic settings via policy before workloads generate logs
- Subscription vending: Automate subscription creation with Bicep or Terraform so new landing zone subscriptions come pre-configured — manual subscription setup does not scale
- Tag policy enforcement: Require cost-centre, environment, and owner tags at resource group creation — retrofitting tags across a large estate is painful
The Landing Zone is a platform investment. The return is measured not in its own cost but in how much faster and safer every workload deployed on it becomes.
