Azure Landing Zone (CAF)
A solid, governed and automated Azure landing zone
The landing zone is the foundation of everything you will run on Azure. I design, assess and industrialize landing zones aligned with the Cloud Adoption Framework (CAF), so your teams ship fast without giving up security, governance or cost control.
Who is it for?
CIOs and platform teams starting on Azure, inheriting a legacy tenant that needs a reset, or converging many subscriptions towards an enterprise standard (banking, insurance, media, energy).
What I deliver
- Management group hierarchy, subscription strategy, naming and tagging conventions
- Hub-and-spoke or Virtual WAN topology: Azure Firewall, private DNS, Private Endpoints, ExpressRoute/VPN
- Identity and access: Entra ID, RBAC, PIM, managed identities, least privilege
- Governance as code: Azure Policy, initiatives, Defender for Cloud, budgets and cost alerts
- Full industrialization in Terraform or Bicep with GitHub Actions / Azure DevOps pipelines
- Architecture documentation, runbooks and knowledge transfer to the platform team
Method in 4 steps
- 1
Audit and workshops
Inventory of subscriptions, management groups, network and identities; gaps measured against the CAF; separate workshops with security, network, operations and FinOps to set the constraints (regulatory, on-premises connectivity, disaster recovery).
Deliverable: Prioritized gap report and validated requirements
- 2
Design and decisions
Management group hierarchy, hub-and-spoke or Virtual WAN topology, address plan (AVNM, IPAM), RBAC and PIM model. Every choice is traced in an ADR, reviewed with your CISO.
Deliverable: Architecture file and ADRs
- 3
Build with IaC
Terraform or Bicep modules, GitHub Actions or Azure DevOps pipelines with federated identity, Azure Policy as code, Checkov and tfSec checks. Deployed environment by environment, without interrupting production.
Deliverable: Deployed landing zone, versioned pipelines and policies
- 4
Handover
Runbooks, pair code reviews, operations workshops. The platform team ships the first changes itself before the engagement ends.
Deliverable: Runbooks and an autonomous platform team
Proof points
-87%
deployment lead time (3 days to 4 hours) on an enterprise program thanks to platform automation
Multi-region DR
automated disaster-recovery strategies through Infrastructure as Code
Governance by design
policies, security and FinOps built into the foundation, not bolted on later
Cost, timeline and deliverables of a typical engagement
Three formats, from the shortest to the most complete. Durations are orders of magnitude observed on my engagements; the exact scope and quote are set after the first 30-minute call, within 48 hours.
5 to 10 days
Assessment of an existing landing zone
Gap report prioritised against the CAF, remediation plan estimated in days, debrief with the platform, security and network teams.
3 to 6 weeks
Landing zone design
Architecture document (management groups, network, identity, governance), traced decisions (ADR), naming and tagging plan, estimate of recurring Azure costs.
2 to 4 months
Full industrialisation
Landing zone deployed with Terraform or Bicep through GitHub Actions or Azure DevOps, policies and budgets in place, runbooks, and a platform team that ships the first changes on its own.
Fixed price for assessment and design, capped time-and-materials for industrialisation. The daily rate and conditions (remote, on site, duration) are stated in the proposal. No licence resale and no managed services: you own the code and the tenant.
- Knowledge transfer included at every step (pair reviews, workshops, documentation)
- Terraform/Bicep code delivered in your repository, under your licence
- Weekly progress review with decision makers
Frequently asked questions
Can you work on an existing landing zone?
Yes. I assess what exists (governance, networking, identity, security, cost), prioritize the gaps against CAF and industrialize the remediation path without disrupting production workloads.
Terraform or Bicep?
Both. It depends on your ecosystem (multi-cloud, in-house skills, existing tooling). I am Terraform Associate certified and a former Microsoft MVP for Azure Infrastructure as Code.
How long does a landing zone engagement take?
An assessment takes 1 to 2 weeks. A complete, industrialized landing zone handed over to your teams usually takes 2 to 4 months depending on the network and regulatory scope.
Do you work with internal security and network teams?
Always: a landing zone is a cross-team project. Design workshops include the CISO, networking, operations and FinOps so decisions hold over time.
Discuss this with me
A first 30-minute call is free and without commitment.
Other services
Related articles
Hands-on Azure, AKS, FinOps and agentic AI write-ups published on blog.smartcloudarchitect.fr.
All articles on the blog· 9 min read
FinOps de l'IA agentique : mesurer jetons, coûts et outils par personne, équipe et modèle· 12 min read
Des MCP d'entreprise pour les agents : Azure MCP Server, Microsoft Learn et une couche tickets avec approbation humaine· 12 min read
« Agent Ready » : onboarder une équipe sur une plateforme agentique, sans ticket et avec des droits bornés· 11 min read
Garde-fous IA portables : NeMo Guardrails derrière agentgateway, en fail-closed