T Techclick ← All lessons
Cloud · On-prem → Azure / AWS · Lesson 2 of 8

Landing zone: before the first VM, not after

A subscription with a VM in it is not a landing zone. A landing zone is identity + management groups or OUs + hub network + logging — built before pay-api is replicated. Migrating into a dirty personal subscription is how you inherit someone else’s public NSG.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

The ticket

Junior created pay-api in his own Azure subscription last Thursday. No management group. No hub. Activity log retention is 30 days of “whatever.” He calls it the landing zone because the VM pings. It is a dirty subscription.

Quick interview answer

A landing zone is the platform you land into: identity (Entra / IAM Identity Center), hierarchy (Azure management groups or AWS Organizations + OUs), hub network (Azure hub 10.40.0.0/16 or AWS hub 10.50.0.0/16 + TGW), and logging (Log Analytics + Sentinel / org CloudTrail + Security Hub). CAF Ready and AWS Control Tower exist so the first workload VM is not also the first identity, the first firewall, and the first log store.

Hero · platform then workload
Identity, hub and logs built before the pay-api VM
The VM is the last box you draw.
Lab data · dummy only

On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40.

Mental model

PieceAzure (this lab)AWS (this lab)
IdentityTenant techclick-lab.inIAM Identity Center on the org
HierarchyMG tc-root / tc-landing / tc-workloadsOUs Security / Workloads
HubVNet 10.40.0.0/16 · Firewall 10.40.0.4 · VPN GW 203.0.113.50VPC 10.50.0.0/16 · TGW tgw-lab · VGW 203.0.113.60
LoggingLog Analytics + Sentinel in platform subOrg CloudTrail + Security Hub + GuardDuty
Workloadsub-spoke-app spoke 10.41.0.0/16app VPC 10.51.0.0/16
Order of build
1 IdentityEntra / IAM IC 2 MG / OUtc-root · Workloads 3 Hub10.40 / 10.50 4 LoggingSentinel / Trail 5 pay-api VMonly now

Skip a box and you are migrating into a hobby tenant.

https://portal.azure.com
Training mock · not live
Azure portal
HomeManagement groupsVirtual networksAzure MigrateMicrosoft Entra
Management groups → tc-root

Landing zone

tc-root
tc-landing — identity, connectivity, management
tc-workloads — sub-spoke-app
10.40.0.0/16 · Azure Firewall 10.40.0.4
Log Analytics + Sentinel — exists before first VM
Azure CAF landing zone. Training mock. Not a live tenant.

How to choose

Use the Azure series landing (hub 10.40.0.0/16, spoke 10.41.0.0/16) or the AWS series landing (hub 10.50.0.0/16, app 10.51.0.0/16). Do not invent a third CIDR because “migrate is different.” Control Tower / CAF accelerators are optional; the four pieces are not.

Runbook

  1. Side A — hierarchy

    Azure: MG + sub-hub + sub-spoke-app. AWS: org account 111122223333, OU Security, OU Workloads. No pay-api in a user sandbox.

  2. Side B — hub + logs

    Hub VNet/VPC, firewall, VPN GW/VGW object (tunnels next lesson). Sentinel workspace or org CloudTrail + Security Hub receiving before any replica.

  3. Side C — gate the migrate tool

    Azure Migrate project lives in the platform/management sub and targets sub-spoke-app. MGN staging is not the app VPC. Refuse start if either is missing.

gate · dummy
# Azure — must all exist before replicate
# MG tc-workloads → sub-spoke-app
# hub 10.40.0.0/16 peered or via vWAN to spoke 10.41.0.0/16
# diagnostic settings → Log Analytics

# AWS — must all exist before MGN cutover
# OU Workloads · app VPC 10.51.0.0/16 · TGW tgw-lab
# org CloudTrail multi-region · Security Hub enabled

Four failures

1 · Dirty subscription

Public IP leftovers, Owner on a laptop user, no policy. Migrating into it copies the mess around the VM.

2 · Hub after the VM

Then you rebuild peering, UDRs, and private DNS under a change freeze. Build the hub first.

3 · Logs “later”

The first cutover is the first incident. No Sentinel / no CloudTrail means you argue from memory.

4 · Workload in the platform sub

pay-api in sub-hub bypasses the spoke NSG/firewall story. Platform and workload are different subscriptions on purpose.

How to prove it

Close only when

1) MG/OU screenshot exists. 2) Hub CIDR is the Azure or AWS series CIDR. 3) A log query returns something from the platform. 4) The migrate target is sub-spoke-app or the Workloads account — not a sandbox.

Traps

Looks like a landing zoneIs not
A subscription named “Prod”No MG, no hub, no logs
One fat VNet 10.0.0.0/8Collision waiting for on-prem 10.20.30.0/24
Control Tower enrolled, OU emptyYou still have to put the account in Workloads

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

A landing zone is complete when…

Correct: b. Four pieces.
Q2

pay-api should land in…

Correct: a. Workload vs platform.
Q3

This lab’s Azure hub CIDR?

Correct: b. Same as Azure series.
Q4

This lab’s AWS app VPC?

Correct: b. Same as AWS series.
Q5

Migrating into a dirty subscription is…

Correct: b. Ticket.
Q6

Logging must exist…

Correct: b. Failure 3.

On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview

Sources

Related: Azure landing zone · AWS Org / OU.