This chapter covers the core features and capabilities of Azure Landing Zone Kit.
This kit provides a complete set of Bicep templates to deploy an Azure enterprise landing zone aligned with the Microsoft Cloud Adoption Framework (CAF). Instead of spending weeks translating CAF documentation into IaC, deploy a production-ready landing zone with governance guardrails, hub-spoke networking, identity integration, and centralized logging in hours.
Every template is modular — deploy the full kit or pick individual components for existing environments.
| Template | Purpose |
|---|---|
bicep/main-landing-zone.bicep | Orchestrator that deploys the full landing zone |
bicep/management-groups.bicep | Management group hierarchy for governance |
bicep/hub-network.bicep | Hub VNet with Azure Firewall, Bastion, and VPN Gateway |
bicep/spoke-network.bicep | Spoke VNet with peering to hub and NSG rules |
bicep/policy-assignments.bicep | Azure Policy for compliance enforcement |
bicep/log-analytics-workspace.bicep | Centralized monitoring and diagnostics |
bicep/identity-baseline.bicep | RBAC role assignments and managed identities |
| Document | Description |
|---|---|
docs/architecture.md | Reference architecture diagram and component breakdown |
docs/governance-guide.md | Azure Policy strategy and management group design |
docs/networking-guide.md | Hub-spoke topology, firewall rules, and DNS design |
docs/security-considerations.md | Security baseline, RBAC, and compliance mapping |
docs/deployment-guide.md | Step-by-step deployment with az CLI |
| File | Description |
|---|---|
scripts/landing_zone_validator.py | Validate deployment readiness and prerequisites |
scripts/policy_compliance_report.py | Generate policy compliance summary from JSON export |
examples/params-enterprise.json | Enterprise deployment parameters |
examples/params-sandbox.json | Sandbox/dev deployment parameters |
az --version)az bicep version)Follow this guide to get Azure Landing Zone Kit up and running in your environment.
# 1. Login and set subscription
az login
az account set --subscription "YOUR_SUBSCRIPTION_ID"
# 2. Validate prerequisites
python scripts/landing_zone_validator.py
# 3. Deploy the management group hierarchy first
az deployment tenant create \
--location eastus2 \
--template-file bicep/management-groups.bicep \
--parameters organizationName=AcmeCorp
# 4. Deploy the full landing zone
az deployment sub create \
--location eastus2 \
--template-file bicep/main-landing-zone.bicep \
--parameters @examples/params-enterprise.jsonTenant Root Group
└── Acme Corp (top-level MG)
├── Platform
│ ├── Connectivity → Hub VNet, Firewall, VPN
│ ├── Identity → Azure AD, RBAC
│ └── Management → Log Analytics, Automation
├── Landing Zones
│ ├── Production → Spoke VNets, workloads
│ └── Non-Production → Dev/test spoke VNets
├── Sandbox → Experimentation (relaxed policy)
└── Decommissioned → Resources pending deletion| Component | Estimated Monthly Cost | Notes |
|---|---|---|
| Azure Firewall (Standard) | $912/mo | Largest cost — use Basic SKU for smaller orgs |
| VPN Gateway (VpnGw1) | $138/mo | Required for on-premises connectivity |
| Azure Bastion (Standard) | $276/mo | Use Basic SKU ($138/mo) for cost savings |
| Log Analytics | $2.76/GB ingested | First 5 GB/day free |
| Hub VNet | Free | VNet itself is free; peering costs per GB |
| Azure Policy | Free | Built-in policies are free |
| Total Platform | ~$1,350/mo | Before spoke workloads |
Get the full Azure Landing Zone Kit and unlock everything.
Get the complete guide with every chapter unlocked, including code samples, diagrams, and best practices.
Access all interactive tools with complete data, all workload profiles, and the full scenario library.
Downloadable source code, configuration files, and working examples from every chapter.
Free updates for life. Every new chapter, tool, and improvement included.