Azure landing zones represent well-architected environments that adhere to Microsoft best practices for Azure cloud architecture. These environments provide scalability and facilitate cloud adoption by providing a well-managed foundation for teams to run their workloads. The relationship between Azure landing zones and Terraform is central to modern cloud adoption, because Terraform provides a declarative mechanism to define, version, and automate the construction of those foundations at scale. Deploying Azure landing zones with Terraform requires understanding the official Microsoft Terraform module for Azure Landing Zones, the Azure Verified Modules for Platform landing zone starter module, and the operational patterns described in opinionated guidance that aligns design with the Azure Cloud Adoption Framework.
The practical outcome for organizations is a foundation that is repeatable across business units and environments. When Terraform is used to build a landing zone, platform teams can codify shared services while application teams consume guardrails through GitOps-style workflows. The result is a secure, scalable, and compliant cloud environment where policy enforcement, identity controls, and connectivity are standardized without manual replication.
Azure Landing Zones as Well-Architected Foundations
Azure landing zones provide scalability and facilitate cloud adoption. They provide a well-managed foundation for teams to run their workloads. A landing zone includes a standard set of resources and configurations for security, governance and compliance.
The real-world consequence of this definition is that teams do not start from an empty subscription. They inherit a pre-configured baseline that reduces the risk of inconsistent security posture and accelerates onboarding. The standard set of resources and configurations for security, governance and compliance means that controls are present before workloads arrive, which shortens the time to production and reduces the remediation burden later.
Azure landing zones have several key benefits that are repeatedly referenced in deployment guidance.
- Scalability. Azure landing zones are designed to scale with your organization's needs. This allows for easy expansion and adaptation as your cloud footprint grows.
- Security and compliance. Built-in security controls and compliance policies protect workloads and ensure they meet regulatory requirements.
- Operational efficiency. Azure landing zones provide a standardized environment, which reduces the complexity and operational overhead associated with managing multiple cloud environments.
- Integration and connectivity. Resources for management and connectivity landing zones provide integration between resources, improved user experience and assured policy compliance.
These benefits interconnect. Scalability is enabled by a standardized environment, which in turn makes operational efficiency possible. Security and compliance are embedded rather than retrofitted, and integration and connectivity ensure that management and connectivity landing zones provide a coherent user experience while policy compliance is assured.
Terraform as Infrastructure Automation Engine for Azure Landing Zones
If you are interested in deploying Azure landing zones, Terraform is a good tool to use. The steps outlined in this tutorial, including setting up and authenticating Terraform for Azure, will help you build a well-managed foundation on which to deploy your workloads. Reading and understanding the module will allow you to build a deploy and complex but well-managed landing zone.
Terraform allows for version control, collaboration and automation of your infrastructure deployments within a hosted Git and CI/CD delivery.
Repeatability is achieved because Terraform configurations can be reused across different environments. This ensures consistency and reduces the chance of errors.
Extensibility is achieved because Terraform's modular architecture allows for integration with other tools and services, which extends its functionality.
Using Terraform also allows you to scale and standardize complex resources.
- IAM controls. Terraform lets you define and enforce IAM controls programmatically, providing scalable security governance and compliance across your entire Azure tenant.
- Policy enforcement. By using Terraform, you can enforce policies across many subscriptions and management groups, ensuring consistent security and compliance practices.
- Managed resources. Terraform simplifies the management of resources for connectivity landing zones, providing better integration, improved user experience and assured policy compliance.
The impact of these capabilities is that platform teams can treat infrastructure as code. IAM controls become auditable artifacts rather than ad hoc assignments. Policy enforcement moves from manual review to automated guardrails applied across subscriptions and management groups. Managed resources for connectivity become predictable and repeatable, which improves integration and user experience.
Azure Verified Modules for Platform Landing Zone Starter
The Azure Verified Modules for Platform landing zone (ALZ) (platformlandingzone) starter module deploys the end to end Platform landing zone using Azure Verified Modules. It is fully configurable to meet different scenarios.
This documentation covers the top scenarios and documents all available configuration settings for this module.
We aim to cover 80% of common scenarios. If the particular scenario is not covered here, it may be possible to adjust the configuration settings to match the requirements.
The starter module is significant because it shifts the delivery model from a monolithic blueprint to a modular, verified component approach. Organizations can adopt the platform landing zone end to end without building every component from scratch, and the configuration surface is large enough to address the majority of common scenarios while still allowing adjustments for specific requirements.
Based on continuous feedback from the community, we have adopted a more modular approach to deploying Azure landing zone with Terraform. This new approach is based on Azure Verified Modules (AVM) and is designed to be more flexible.
With the move to using Azure Verified Modules, we have new branding. We are using the following wording to describe the new offerings:
Azure Verified Modules (AVM) for Platform landing zone (ALZ) - Terraform
We received feedback from our community that the following improvements were needed:
You asked us to be able to fully customize the configuration of each component. Examples included defining a custom management group hierarchy, or setting specific settings (and names!) on resources
This feedback loop shaped the current modular design. The ability to define a custom management group hierarchy and set specific settings and names on resources addresses earlier constraints where teams needed a more prescriptive blueprint. Flexibility is now a core design principle.
Platform Landing Zone Versus Application Landing Zone Subscriptions
An Azure landing zone comprises two complementary subscription types, both provisioned and managed through Terraform.
Platform landing zones provide shared, centrally managed services such as identity, connectivity, and governance, to all application workloads. Defined and deployed via Terraform modules, these subscriptions (for example Identity, Management, Connectivity) belong to central teams and enforce global policies to improve consistency and operational efficiency.
Application landing zones provide dedicated subscriptions for individual applications. You pre-provision them through Terraform code and govern them via management-group-level policy assignments. In reference architectures, you'll often see multiple application zones (for example "A1" and "A2" subscriptions), each defined by its own Terraform configuration, with tailored resources and policies.
The distinction creates a separation of concerns. Platform landing zones are centrally owned and deliver shared services. Application landing zones are workload owned and inherit guardrails. Both are provisioned through Terraform, which means the lifecycle of each subscription type is codified, versioned, and auditable.
They leverage the platform landing zone's shared services and integrate additional application-specific resources, tagging, networking, secrets, and deployments through Terraform code, GitOps workflows, and service-mesh tooling (Consul, Vault CSI, Flux/ArgoCD).
This integration pattern shows how Terraform sits at the base of a larger platform engineering stack. Terraform code provisions the landing zone, GitOps workflows deliver application resources, and service-mesh tooling provides runtime governance.
Cloud Adoption Framework Alignment and Critical Focus Areas
Author: David Wright
This document provides an opinionated view on how to use a Terraform-driven blueprint for designing, deploying, and governing Azure landing zones for both the shared-services platform subscriptions and the application specific subscriptions, all aligned to Azure's Cloud Adoption Framework. It establishes clear roles, policies, and automation patterns (using HCP Terraform, Vault, Sentinel, Packer) so platform teams can build a secure, scalable foundation and application teams can consistently onboard workloads with guardrails and GitOps-style workflows.
This document provides a comprehensive guide to designing, deploying, and operationalising Azure Landing Zones using Terraform and the HashiCorp Cloud Platform (HCP). It serves as a structured, opinionated methodology for establishing secure, scalable, and compliant cloud environments.
The document offers prescriptive guidance on architecting Azure Landing Zones, including recommendations for structuring subscriptions and management groups. It emphasises the importance of aligning with the Azure Cloud Adoption Framework to ensure best practices across all design areas.
Key aspects covered include:
- Structuring subscriptions and management groups to support different environments and business units.
- Designing secure, scalable, and compliant environments using Terraform and HCP.
The deployment process details how to use Terraform for setting up the necessary infrastructure.
To construct a landing zone via Terraform, critical focus areas must align with Microsoft Cloud Adoption Framework for Azure best practices across: Account Principles, Architecture Type, Resource Organisation, Management Group Hierarchy, Security and Compliance, and Automation and DevOps
Alignment with the Cloud Adoption Framework ensures that design decisions are not isolated. Account Principles inform who can do what. Architecture Type determines the pattern of landing zones. Resource Organisation and Management Group Hierarchy provide the containment model. Security and Compliance provide the guardrails. Automation and DevOps provide the delivery velocity.
Prerequisites Installation and Authentication for Terraform Azure Deployments
Before you start deploying Azure landing zones using Terraform, you need to set Terraform up and authenticate it.
Install Terraform
To install Terraform, find the appropriate download for your operating system on their download page and extract the executable from the ZIP. From there, open your favorite terminal to the directory where it is downloaded. Test this by running the following command.
bash
.\terraform --version
This example is running version 1.8.5 on Windows.
Authenticating Terraform
This example uses Terraform's AzureRM provider to configure resources in Azure. Create a service principal and use that to authenticate to Azure using PowerShell.
powershell
Connect-AzAccount
powershell
$sp = New-AzADServicePrincipal -DisplayName tf-demo -Role "Contributor"
Then, export several environment variables in the syntax of your shell for authentication
The installation step validates that the Terraform binary is available in the local execution context. The authentication step creates a service principal with Contributor role and establishes an AzureRM provider context for Terraform. Exporting environment variables completes the credential chain so Terraform can authenticate to Azure without interactive login.
Writing the Terraform Configuration Steps
To deploy an Azure Landing Zone using Terraform, use the official Microsoft Terraform module for Azure Landing Zones and complete the following steps.
Step 1
Open an empty folder in VS Code.
Step 2
Create a new file named main.tf. This is the default file name for Terraform configurations, though you can use any file name that uses the TF extension.
Step 3
Define the terraform block in the main.tf file
These steps establish the local development workspace. Opening an empty folder in VS Code provides an isolated project context. Creating main.tf establishes the entry point for Terraform configuration. Defining the terraform block sets provider versions and backend configuration, which is the foundation for reproducible deployments.
The process connects directly to the earlier prerequisites. Once Terraform is installed and authenticated, the configuration files become the source of truth for the landing zone. Version control and CI/CD delivery then operate on these files.
Benefits and Operational Characteristics
The combined capabilities of Azure landing zones and Terraform create operational characteristics that persist throughout the cloud lifecycle.
| Capability | Description |
|---|---|
| Scalability | Azure landing zones are designed to scale with your organization's needs. This allows for easy expansion and adaptation as your cloud footprint grows. |
| Security and compliance | Built-in security controls and compliance policies protect workloads and ensure they meet regulatory requirements. |
| Operational efficiency | Azure landing zones provide a standardized environment, which reduces the complexity and operational overhead associated with managing multiple cloud environments. |
| Integration and connectivity | Resources for management and connectivity landing zones provide integration between resources, improved user experience and assured policy compliance. |
| Terraform Capability | Description |
|---|---|
| Version control, collaboration and automation | Terraform allows for version control, collaboration and automation of your infrastructure deployments within a hosted Git and CI/CD delivery. |
| Repeatability | Terraform configurations can be reused across different environments. This ensures consistency and reduces the chance of errors. |
| Extensibility | Terraform's modular architecture allows for integration with other tools and services, which extends its functionality. |
| IAM controls | Terraform lets you define and enforce IAM controls programmatically, providing scalable security governance and compliance across your entire Azure tenant. |
| Policy enforcement | By using Terraform, you can enforce policies across many subscriptions and management groups, ensuring consistent security and compliance practices. |
| Managed resources | Terraform simplifies the management of resources for connectivity landing zones, providing better integration, improved user experience and assured policy compliance. |
| Subscription Type | Ownership | Purpose |
|---|---|---|
| Platform landing zone | Central teams | Provide shared, centrally managed services such as identity, connectivity, and governance, to all application workloads. Defined and deployed via Terraform modules, these subscriptions (for example Identity, Management, Connectivity) belong to central teams and enforce global policies to improve consistency and operational efficiency. |
| Application landing zone | Application teams | Provide dedicated subscriptions for individual applications. You pre-provision them through Terraform code and govern them via management-group-level policy assignments. In reference architectures, you'll often see multiple application zones (for example "A1" and "A2" subscriptions), each defined by its own Terraform configuration, with tailored resources and policies. |
These tables make the relationships explicit. Landing zone benefits are realized through Terraform capabilities, and subscription types are provisioned through the same Terraform patterns.
Conclusion
Azure landing zones deployed through Terraform represent a convergence of architectural guidance and infrastructure as code. The well-architected environment provided by Azure landing zones is made repeatable through Terraform's version control, collaboration, and automation. The Azure Verified Modules for Platform landing zone starter module provides a fully configurable, end to end platform landing zone that addresses 80% of common scenarios while allowing adjustments for the remainder.
The modular approach driven by community feedback enables full customization of each component, including custom management group hierarchies and specific resource names and settings. Platform landing zones deliver shared services such as identity, connectivity, and governance through centrally owned subscriptions, while application landing zones provide dedicated subscriptions governed via management group level policy assignments. Both are provisioned and managed through Terraform.
Alignment with the Azure Cloud Adoption Framework ensures that design decisions cover Account Principles, Architecture Type, Resource Organisation, Management Group Hierarchy, Security and Compliance, and Automation and DevOps. Prescriptive guidance on structuring subscriptions and management groups to support different environments and business units, combined with automation patterns using HCP Terraform, Vault, Sentinel, and Packer, creates a secure, scalable foundation for platform teams and guardrailed onboarding for application teams.
Prerequisites of installation and authentication establish the execution context. Installing Terraform and testing with .\terraform --version confirms availability. Authenticating via AzureRM provider with a service principal created through Connect-AzAccount and New-AzADServicePrincipal enables programmatic access. Writing the Terraform configuration in main.tf then allows the landing zone to be defined, versioned, and deployed consistently.
The resulting operational model is one where infrastructure is codified, policies are enforced, and workloads are onboarded within a standardized, compliant, and scalable foundation.