Building a solid foundation on Azure: Landing Zones best-practices
summary
Concrete claims and outcomes: Azure Landing Zones use a subscription-per-workload model (subscriptions as isolation, billing and limit scopes), deployed by automation (GitHub Actions/Azure DevOps, managed identities) so teams get a landing zone in minutes. Architecture shows platform subscriptions for connectivity, identity and management, app subs for prod/non-prod, central hub-and-spoke networking with deny-by-default firewall and Azure services (Key Vault, Log Analytics, Sentinel, Application Gateway €260/mo, API Management ~€2,000/mo, Bastion). Processes include subscription vending, RBAC with custom roles and policies, 60‑day decommission retention; result: self-service teams within guardrails.
AI-written summary · about
chapters (17)
- 0:00Azure Landing Zones intro
- 2:56What is a landing zone
- 6:54Why use landing zones
- 10:02Resource organization
- 13:32Landing zone structure
- 16:01App landing zone setup
- 18:11Management groups & subs
- 20:44Subscription vending
- 22:33Naming & tagging
- 24:14RBAC in landing zones
- 27:45Custom roles & conditions
- 29:11Azure Policy enforcement
- 30:55Operating models
- 34:08Networking topologies
- 36:14Virtual WAN services
- 38:01Shared services trade-offs
- 40:07Summary
related talks
50mWhy Landing Zones Matter (What are they and How to Build One)
12mAzure Landing Zone: Accelerating Cloud Transformation
45mThe Automation of a Landing Zone
57mArchitecture in the Azure Cloud
54mMastering Azure Well-Architected: From Pipelines to Perfection
54mBuilding Azure Apps
01h 00mBuilding Resilient Applications In Microsoft Azure
54mBuilding a development environment out of your production deployment