# Landing zone first: management groups before the first VM Source: https://ai.techclick.in/blog_azure_landing_zone_mg_sub Markdown: https://ai.techclick.in/blog_azure_landing_zone_mg_sub.md Publisher: Techclick Infosec Pvt Ltd CAF landing zone first: management groups, subscriptions, Policy. Do not drop prod VMs in a random sub. Dummy tc-root. ## The ticket Auditor: “Where does pay-api live?” Junior: a subscription named Ram-PayPal with Owner = a Hotmail. No Policy. No MG. That is not a landing zone. That is a credit card with a VM. Quick interview answer An Azure landing zone (CAF Ready) is a pre-provisioned environment: management group hierarchy , subscriptions for platform vs workloads, identity, networking, and Azure Policy so a workload cannot skip the rails. Hub networking sits in a platform/connectivity subscription ( sub-hub ). The app sits in a workload subscription ( sub-spoke-app ) under a landing-zone MG. Do not give standing Owner to a personal account. Hero · hierarchy Policy at the MG. VMs at the leaf. Never the other way around. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Object Job This lab Management group Folder for Policy + RBAC inheritance tc-root → tc-landing / tc-workloads Subscription Billing + deploy scale unit sub-hub (platform), sub-spoke-app (workload) Azure Policy Guardrail (deny / audit / deploy-if-not-exists) Assigned at tc-workloads Resource group Lifecycle of related resources Not a security boundary by itself Dummy CAF tree - tc-root tc-landing → sub-hub tc-workloads → sub-spoke-app Firewall + VPN GW pay-api VM Inherit Policy downward. Do not attach production to the tenant root with Owner. ## How to choose Need Put it Do not Firewall, VPN GW, Bastion sub-hub under tc-landing Inside the app RG “for speed” pay-api sub-spoke-app under tc-workloads A personal subscription Deny public IPs Policy on tc-workloads A sticky note to the intern https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Management groups → tc-root ### Hierarchy tc-root Tenant landing · Policy: allowed locations tc-landing Contains sub-hub tc-workloads Contains sub-spoke-app Owner on sub-spoke-app Entra group wl-owners — not a Hotmail Cancel Save CAF landing zone is MG + sub + Policy. Training mock. ## Runbook #### Side A — tree Portal → Management groups. Confirm sub-spoke-app parent is tc-workloads , not Tenant Root Group. - #### Side B — rails Policy assignments on tc-workloads : allowed locations, no public IP on VMs, require diagnostic settings. Then RBAC: groups, not personal Owners. - #### Side C — prove az account management-group entities list and az policy assignment list . Then deploy. Not before. az · dummy az account management-group entities list -o table # Name Type DisplayName # tc-root ManagementGroup tc-root # tc-landing ManagementGroup tc-landing # tc-workloads ManagementGroup tc-workloads # sub-hub Subscription sub-hub # sub-spoke-app Subscription sub-spoke-app az policy assignment list --scope /providers/Microsoft.Management/managementGroups/tc-workloads -o table ## Four failures ### 1 · Prod VM in a random sub Today’s ticket. No Policy, personal Owner, no hub peer. ### 2 · Everything under Tenant Root One bad Policy assignment becomes a tenant-wide outage. Use intermediate MGs. ### 3 · Owner on a personal ID That person leaves. The sub is now an orphan with a stale MSA. ### 4 · Policy only on the RG Next RG skips it. Assign at MG or subscription. ## How to prove it Close only when 1) Parent MG of each sub is named. 2) Policy is at tc-workloads , not a wish. 3) Owner is a group. 4) pay-api was not created first “to test.” ## Traps Looks like a landing zone Is not A VNet named “hub” No MG, no Policy, personal Owner Blueprints folder from 2019 CAF landing zone is MG + Policy + platform subs Contributor on the whole tenant root Standing god-mode — use groups + PIM later ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A CAF landing zone is primarily… A VNet name MG hierarchy + subscriptions + Policy before workloads One resource group A public IP prefix Correct: b . CAF Ready. Q2 pay-api should land in… A personal subscription with Hotmail Owner sub-spoke-app under tc-workloads GatewaySubnet The Entra tenant object Correct: b . Workload sub. Q3 sub-hub exists so that… Platform networking is separated from the app sub You can skip Policy NSGs become optional Entra is turned off Correct: a . Platform vs workload. Q4 Best place for a deny-public-IP guardrail? A Slack reminder Azure Policy on tc-workloads Only on one NIC FortiGate VIP Correct: b . Policy inherits. Q5 Owner = personal Hotmail on prod is bad because… Hotmail cannot use the portal The person leaves and you inherit an orphan + standing privilege Microsoft forbids Hotmail It disables Policy Correct: b . Failure 3. Q6 First proof before deploying pay-api? Parent MG + Policy assignments Any-any NSG Disable Defender Public IP on the VM Correct: a . Runbook. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — Azure landing zones (Cloud Adoption Framework) . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt