We have migrated dozens of organizations to Azure. The ones that did it right started with a Landing Zone. The ones that did not are still cleaning up the consequences three years later.
What Is a Landing Zone?
An Azure Landing Zone is not a product you buy. It is an architecture pattern — a pre-configured, policy-enforced environment that establishes the guardrails your organization needs before the first workload goes live. Microsoft has codified this into the Cloud Adoption Framework (CAF), but the principles are straightforward:
- Management group hierarchy that reflects your organizational structure
- Policy assignments that enforce compliance automatically
- Centralized logging and monitoring from day one
- Network topology that isolates workloads with explicit connectivity rules
- Identity and access model that does not rely on subscription-level admin rights
What Happens Without One
Without a Landing Zone, Azure becomes a free-for-all. Teams provision resources directly in production subscriptions. Networking is improvised per project. RBAC assignments proliferate without a model. Security Center findings go unaddressed because no one owns them.
We have inherited environments with hundreds of orphaned resources, public storage accounts with no access restrictions, and VMs that have not had a security patch applied in eighteen months. Every one of them started as "we just need to get something deployed quickly."
The Canviz Landing Zone Approach
We use Terraform with the Azure CAF module as our starting point, layered with client-specific policy definitions and naming conventions. A typical initial deployment looks like this:
module "enterprise_landing_zone" {
source = "aztfmod/caf/azurerm"
version = "~> 5.7"
global_settings = {
default_region = "canadacentral"
regions = {
region1 = "canadacentral"
region2 = "canadaeast"
}
}
management_groups = var.management_groups
subscriptions = var.subscriptions
azuread_groups = var.azuread_groups
}
The ROI Argument
A properly implemented Landing Zone takes two to four weeks on an initial engagement. We have seen organizations skip it and then spend six to twelve months retroactively applying governance to sprawling, inconsistent environments. The math is not close.
If you are planning an Azure migration or greenfield deployment, this is the conversation to have before you write the first Bicep template.