Landing Zone

The landing zone is the tenant's foundation: the root of trust, the management group hierarchy, and the process that produces ready-to-use subscriptions. It follows the Microsoft Cloud Adoption Framework (CAF) enterprise-scale pattern.

Read these pages in the order the tenant is built:

1. Tenant Root Bootstrap: the Day-0, human-gated sequence that takes an unmanaged tenant to a working root of trust, with central state storage and the first platform identities.
2. Management Group Hierarchy: the management group tree that decides where policy is applied, who can reach which subscriptions, and how cost and compliance are reported.
3. Subscription Vending: the process that turns a billing scope into a fully configured, pipeline-ready subscription for a workload team.

Related:

• Security Model: which parts of the landing zone are Tier 0 and must be delivered through Lane A.
• Azure Access Management: the groups and identities that get access to the landing zone.
• Microsoft CAF: Azure landing zone conceptual architecture