Complete Azure Landing Zone (CAF Hub & Spoke)

Context

A complete, reference-grade implementation of Microsoft’s Cloud Adoption Framework Azure Landing Zone, built end to end to prove the whole platform, not a single workload. Management groups, governance, networking, identity, and security are all expressed as Terraform with Azure Verified Modules and shipped through secret-free pipelines.

Approach

Platform foundation

• Management-group hierarchy under the tenant root, spanning Platform (Identity, Management, Connectivity, Security), Landing Zones (Corp, Online), plus Decommissioned and Sandbox, with an Azure Policy baseline enforced at the management-group scope (private-endpoint-only, deny public network access on landing zones, required tags).
• Four platform subscriptions (connectivity, identity, management, security), each its own root-module deployment in dependency order.

Network

• Dual-region hub-and-spoke with a primary hub and a geo-paired DR hub, fronted by Azure Firewall Premium (IDPS / TLS inspection), VPN gateway, DNS Private Resolver, and centralized private DNS zones for every privatelink.* service. Hubs joined by global VNet peering; spokes peer to their regional hub with user-defined routes forcing firewall inspection.

Landing zones

• Corp (private): App Service + SQL reachable only through private endpoints, with a geo-paired DR landing zone backed by a Recovery Services Vault.
• Online (internet-facing): workload fronted by Application Gateway WAF v2.

Governance, security & delivery

• Zero Trust controls. Conditional Access (MFA for all admins, no legacy auth, compliant-device), PIM for privileged roles (eligible-only), and policy-enforced private networking.
• Microsoft Sentinel + centralized Log Analytics; dedicated identity and FinOps modules.
• OIDC GitHub Actions with policy-as-code PR gates (OPA/Conftest), so every change is planned and policy-checked before apply, with no long-lived secrets and CMK-encrypted remote state seeded by a one-time bootstrap.

Outcome

A complete CAF landing zone that stands up the entire Azure platform (governance, network, identity, security, and workload landing zones) from versioned, policy-gated, secret-free Terraform. It’s the end-to-end proof a senior architect is expected to own, and a reusable baseline for real engagements.