High-Level Architecture

graph TB
    subgraph "Azure AD Tenant"
        AAD[Azure Active Directory]
        PIM[Privileged Identity Management]
    end

    subgraph "Management Groups"
        TenantRoot[Tenant Root Group]
        OrgMG[Organization MG]
        PlatformMG[Platform MG]
        LandingZoneMG[Landing Zones MG]
        SandboxMG[Sandbox MG]
    end

    subgraph "Hub Subscription"
        subgraph "Hub VNet (10.0.0.0/16)"
            Firewall[Azure Firewall<br/>Egress filtering]
            Bastion[Azure Bastion<br/>Secure access]
            VPNGw[VPN Gateway<br/>On-premises]
            DNS[Private DNS<br/>Resolver]
        end
        LogAnalytics[Log Analytics<br/>Central monitoring]
    end

    subgraph "Spoke Subscription(s)"
        subgraph "Spoke VNet (10.1.0.0/16)"
            AppSubnet[App Subnet<br/>Web/API tier]
            DataSubnet[Data Subnet<br/>Databases]
            PESubnet[Private Endpoint<br/>Subnet]
        end
    end

    subgraph "On-Premises"
        OnPrem[Corporate Network]
    end

    TenantRoot --> OrgMG
    OrgMG --> PlatformMG
    OrgMG --> LandingZoneMG
    OrgMG --> SandboxMG
    AAD --> PIM

    OnPrem <--> VPNGw
    AppSubnet --> Firewall
    Firewall --> Internet((Internet))
    Bastion --> AppSubnet
    AppSubnet --> DataSubnet
    AppSubnet --> PESubnet
Included with Azure Landing Zone Kit

Ready for the complete Azure Landing Zone Kit?
