01/16/2021
Azure landing zones are the output of a multi-subscription Azure environment that accounts for scale, security, governance, networking, and identity. Azure landing zones enable application migrations and greenfield development at enterprise scale in Azure. These zones consider all platform resources that are required to support the customer's application portfolio and don't differentiate between infrastructure as a service or platform as a service. A landing zone is an environment for hosting your workloads, pre-provisioned through code.
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/
Scalable and modular
No single solution fits all technical environments. A few Azure landing zone implementation options can help you meet the deployment and operations needs of your growing cloud portfolio. All Azure landing zones provide a scalable, modular approach to building out your environment based on a common set of design areas. Whether you're looking to deploy your first production application to Azure or you're operating a complex portfolio of workloads, the Azure landing zone implementation options can be tailored to your needs.
Design areas
Regardless of the deployment option, you should carefully consider each design area. Your decisions affect the platform foundation on which each landing zone depends.
Design areas Objective Relevant methodologies
Enterprise enrollment For enterprise customers with an Azure commitment, proper tenant creation and enrollment is an important early step.
Ready
Identity Identity and access management is a primary security boundary in the public cloud. It's the foundation for any secure and fully compliant architecture.
Ready
Network topology and connectivity
Networking and connectivity decisions are an equally important foundational aspect of any cloud architecture.
Ready
Resource organization As cloud adoption scales, considerations for subscription design and management group hierarchy have an impact on governance, operations management, and adoption patterns.
Govern
Governance disciplines Automate auditing and enforcement of security, governance, and compliance policies.
Govern
Operations baseline For stable, ongoing operations in the cloud, an operations baseline is required to provide visibility, operations compliance, and protect and recover capabilities.
Manage
Business continuity and disaster recovery (BCDR) Resiliency is key for smooth functioning of applications. BCDR is an important component of resiliency. BCDR involves protection of data via backups and protection of applications from outages via disaster recovery.
Manage
Deployment options Align the best tools and templates to deploy your landing zones and supporting resources. Ready
Implementation options
The following table describes some of the implementation options for landing zones and the variables that might drive your decision.
Implementation option Description Deployment velocity Deeper design principles Deployment instructions
CAF Migration landing zone blueprint
Deploys the basic foundation for migrating low risk assets. Start small Design principles Deploy
CAF Foundation blueprint
Adds the minimum tools need to begin developing a governance strategy. Start small Design principles Deploy
CAF enterprise-scale landing zone (hybrid connectivity with Virtual WAN) Deploys an enterprise-ready platform foundation with all the necessary shared services to support the full IT portfolio, including hybrid connectivity (Virtual WAN).
Enterprise-scale Design principles Deploy
CAF enterprise-scale landing zone (hybrid connectivity with hub and spoke) Deploys an enterprise-ready platform foundation with all the necessary shared services to support the full IT portfolio, including hybrid connectivity (hub and spoke).
Enterprise-scale Design principles Deploy
CAF enterprise-scale landing zone Deploys an enterprise-ready platform foundation with all the necessary shared services to support the full IT portfolio, where connectivity can be added later as needed.
Enterprise-scale Design principles Deploy
CAF Terraform modules Third-party path for multicloud operating models. This path can limit Azure-first operating models.
Start small Design principles Deploy
Partner landing zones Partners who provide offerings aligned to the Ready methodology of the Cloud Adoption Framework can provide their own customized implementation option.
8 area of Security landing zone:
1 - Azure AD (SSO, MFA, Emergency Account, PIM).
2 - Roles (EA, Global Admin, Owner, etc).
3 - Organization Layout (Management Groups and Subscription).
4 - Policies (Guardrails).
5 - Shared Subscription (Log Analytics Workspace, Firewall and DDOS).
6 - Azure Security Center Setup (Azure Sentinel).
7 - Network Topology and Connectivity.
8 - Incident Response.
https://github.com/azure/enterprise-scale
An Enterprise Agreement (EA) enrollment represents the commercial relationship between Microsoft and how your organization uses Azure. It provides the basis for billing across all your subscriptions and affects administration of your digital estate. Your EA enrollment is managed via the Azure EA portal. An enrollment often represents an organization's hierarchy, which includes departments, accounts, and subscriptions. This hierarchy represents cost-enrollment groups within an organization.
The Enterprise-Scale architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define the...
