Creating landing zones

Using subscriptions is a useful way of segregating duties and application workloads. However, if you wish to use that model, you need to consider how this affects your security and governance posture.

For example, you may wish to ensure that all network traffic is routed through a central firewall, or to centralize logging and monitoring. We therefore need to ensure that any new subscription is set up correctly and in line with your overall design strategy.

Defining a landing zone methodology is concerned with leveraging the various Azure components and tools to create consistency and compliance across all your subscriptions in an automated fashion. The latter point is crucial – ideally, your patterns should be implemented automatically with as little manual intervention as possible.

When designing a landing zone, you must keep in mind that it needs to be scalable – changing how landing zone patterns work later can be time-consuming and costly...