What is an Azure Landing Zone, and when do you need one?
5 min read · Updated on 20 October 2026
When you start in Azure, you often put a few resources in one subscription. That works until more workloads, teams and requirements are added. An Azure Landing Zone gives you a solid foundation from the start.
The definition
The Microsoft Cloud Adoption Framework describes an Azure Landing Zone as a proven and flexible architecture for governing, securing and scaling an Azure environment with multiple subscriptions.
A landing zone consists of two parts:
- The platform landing zone: the central foundation with governance, security and shared resources for all your workloads. You usually have one per Microsoft Entra tenant.
- Workload landing zones (application landing zones in older texts): the environments in which teams build and run their workloads, within the guardrails of the platform. Each workload gets its own landing zone, containing development, test and production.
In practice each landing zone is an Azure subscription. The subscription sits under a management group and inherits its policies and permissions.
The design areas
Microsoft divides the design into eight areas:
- Azure billing and the Microsoft Entra tenant.
- Identity and access management.
- Resource organisation: management groups and subscriptions.
- Network topology and connectivity.
- Security.
- Management: monitoring, operations and recovery.
- Governance: automated auditing and enforcement of policies.
- Platform automation and DevOps.
You do not have to design everything yourself. Microsoft provides standard designs (archetypes) and a standard management group hierarchy. According to Microsoft, these suit most scenarios.
When does it make sense?
Microsoft does not set a fixed minimum. Advice: consider a landing zone when one or more of these points apply.
- You have more than a few workloads in Azure, or that is coming.
- Several teams or suppliers work in the same environment.
- You must meet compliance or security requirements, for example from laws or regulations.
- You want to define in advance which regions, networks and settings are allowed.
You can start small. Microsoft advises centralising capabilities only when this clearly benefits several workloads. When new requirements emerge, you update the policies in the platform landing zone. Build on the existing archetypes and only create new ones when they are truly needed.
Infrastructure as code
Microsoft recommends deploying the platform landing zone with the Platform landing zone accelerator and Azure Verified Modules (AVM). These modules are available for Bicep and Terraform. They provide reusable building blocks and reduce the maintenance of custom code.
There is also a portal version. It is meant for organisations without infrastructure as code expertise. According to Microsoft it is less flexible and harder to update. Microsoft advises moving to infrastructure as code when possible.
Checklist
- List the workloads you have in Azure now and the ones that are coming.
- Record your requirements for each design area.
- Choose Bicep or Terraform with Azure Verified Modules.
- Start with the standard management group hierarchy and only change what is needed.
- Agree how teams request a new landing zone.