Cloud and platform
Azure landing zone for regulated workloads
A management group hierarchy, hub-spoke network, policies and central logging as the foundation for new applications.
Fictional scenario. An example situation that illustrates the approach. It is not a client project and describes no measured results.
Business problem
A fictional financial company creates subscriptions by hand. There are no common policies, the network is fragmented and logs are scattered.
Assumptions
- Microsoft Entra ID is used.
- A team will maintain the platform.
- Infrastructure is described as code.
Constraints
- Data stays in EU regions.
- Public access only through central points.
- Changes go through review.
Reference architecture
Components by stage — an illustration, not a running system and not a certified design.
01Governance
- Management groups
- Azure Policy
- Budgets
02Identity
- Entra ID
- PIM for privileges
03Network
- Hub VNet with a firewall
- Spoke VNets
- Private endpoints
04Monitoring
- Central Log Analytics
- Defender for Cloud
The diagram as a list
| Stage | Components |
|---|---|
| Governance | Management groups, Azure Policy, Budgets |
| Identity | Entra ID, PIM for privileges |
| Network | Hub VNet with a firewall, Spoke VNets, Private endpoints |
| Monitoring | Central Log Analytics, Defender for Cloud |
Interfaces
| From | To | Via |
|---|---|---|
| Spoke | Hub | VNet peering |
| Hub | Internet | Firewall |
| Resources | Logs | Diagnostic settings |
Data flow
- A new subscription is created from a template.
- Policies apply by inheritance.
- Traffic goes through the hub.
- Logs go to a central workspace.
- Deviations are reported.
Security boundaries
- Least privilege and PIM for administrators.
- Policies forbid public IPs without an exception.
- Keys in Key Vault with private access.
Where a person approves
- Policy exceptions.
- New spoke networks and subscriptions.
Delivery phases
01 · Design
Hierarchy, network, identity.
02 · Foundation
Hub, policies, logging as code.
03 · First workload
One spoke with a pilot application.
04 · Expansion
Templates for new teams.
Limitations
- Not a certified architecture.
- Existing resources need migration.
Trade-offs
- Central firewall — control vs cost and latency.
- Strict policies — more exceptions early on.
Related services
Related assessments
Integration patterns used
Workshops and assessments
Facing something similar?
We start with an assessment of where you are and propose a realistic first phase.