A landing zone is the governed foundation your workloads land on: the subscription structure, identity model, networking, and policy guardrails set up once so every future project inherits them instead of reinventing them. Microsoft's Cloud Adoption Framework formalizes this into eight design areas. This checklist is the mid-market subset we work through — full enterprise-scale is more than most 50–1,000-person orgs need on day one.
Work top to bottom. Later items assume the earlier ones are in place.
1. Identity and access
- Microsoft Entra ID tenant confirmed as the single identity source.
- Management group hierarchy created (at minimum: a platform group and a workloads group under the tenant root).
- Break-glass emergency accounts created, excluded from conditional access, and stored offline.
- RBAC model designed around groups, not individual assignments. Owner is rare and audited.
- Privileged Identity Management (PIM) enabled for standing-access reduction on privileged roles.
2. Networking
- Address space planned and documented before the first VNet is created — overlaps are painful to unwind later.
- Hub-and-spoke topology decided (hub for shared services, spokes per workload/environment).
- Private DNS strategy chosen for Private Link (see our Private Endpoint DNS explainer).
- Outbound internet path decided (NAT Gateway, Azure Firewall, or forced tunnel).
3. Governance and policy
- A naming and tagging standard published and enforced with Azure Policy.
- A baseline policy set assigned at the management-group level (allowed regions, required tags, denied public IPs where appropriate).
- Diagnostic settings routed to a central Log Analytics workspace by policy, so logging is on by default.
4. Cost and ownership
- Every subscription has a named business owner and a cost center tag.
- Budgets and cost alerts configured per subscription.
- A monthly review cadence agreed — a landing zone drifts without one.
What "done" looks like
A new team can be given a spoke, an RBAC group, and a budget, and start shipping the same day — inside guardrails they cannot accidentally step outside of. If provisioning a new workload still requires a human to manually wire up networking, logging, and policy, the landing zone isn't finished.
For the design decisions behind each item, see our Azure Foundation service.