# Landing zone: before the first VM, not after Source: https://ai.techclick.in/blog_migrate_landing_zone_first Markdown: https://ai.techclick.in/blog_migrate_landing_zone_first.md Publisher: Techclick Infosec Pvt Ltd Landing zone first: identity, MG/OU, hub, logging before the first VM. Dirty subscription is not a landing zone. ## The ticket Junior created pay-api in his own Azure subscription last Thursday. No management group. No hub. Activity log retention is 30 days of “whatever.” He calls it the landing zone because the VM pings. It is a dirty subscription. Quick interview answer A landing zone is the platform you land into : identity (Entra / IAM Identity Center), hierarchy (Azure management groups or AWS Organizations + OUs), hub network (Azure hub 10.40.0.0/16 or AWS hub 10.50.0.0/16 + TGW), and logging (Log Analytics + Sentinel / org CloudTrail + Security Hub). CAF Ready and AWS Control Tower exist so the first workload VM is not also the first identity, the first firewall, and the first log store. Hero · platform then workload The VM is the last box you draw. Lab data · dummy only On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40 . ## Mental model Piece Azure (this lab) AWS (this lab) Identity Tenant techclick-lab.in IAM Identity Center on the org Hierarchy MG tc-root / tc-landing / tc-workloads OUs Security / Workloads Hub VNet 10.40.0.0/16 · Firewall 10.40.0.4 · VPN GW 203.0.113.50 VPC 10.50.0.0/16 · TGW tgw-lab · VGW 203.0.113.60 Logging Log Analytics + Sentinel in platform sub Org CloudTrail + Security Hub + GuardDuty Workload sub-spoke-app spoke 10.41.0.0/16 app VPC 10.51.0.0/16 Order of build - 1 Identity Entra / IAM IC 2 MG / OU tc-root · Workloads 3 Hub 10.40 / 10.50 4 Logging Sentinel / Trail 5 pay-api VM only now Skip a box and you are migrating into a hobby tenant. https://portal.azure.com Training mock · not live Azure portal Home Management groups Virtual networks Azure Migrate Microsoft Entra Management groups → tc-root ### Landing zone Root MG tc-root Platform tc-landing — identity, connectivity, management Workloads tc-workloads — sub-spoke-app Hub VNet 10.40.0.0/16 · Azure Firewall 10.40.0.4 Logs Log Analytics + Sentinel — exists before first VM Cancel Save Azure CAF landing zone. Training mock. Not a live tenant. ## How to choose Use the Azure series landing (hub 10.40.0.0/16 , spoke 10.41.0.0/16 ) or the AWS series landing (hub 10.50.0.0/16 , app 10.51.0.0/16 ). Do not invent a third CIDR because “migrate is different.” Control Tower / CAF accelerators are optional; the four pieces are not. ## Runbook #### Side A — hierarchy Azure: MG + sub-hub + sub-spoke-app . AWS: org account 111122223333 , OU Security, OU Workloads. No pay-api in a user sandbox. - #### Side B — hub + logs Hub VNet/VPC, firewall, VPN GW/VGW object (tunnels next lesson). Sentinel workspace or org CloudTrail + Security Hub receiving before any replica. - #### Side C — gate the migrate tool Azure Migrate project lives in the platform/management sub and targets sub-spoke-app . MGN staging is not the app VPC. Refuse start if either is missing. gate · dummy # Azure — must all exist before replicate # MG tc-workloads → sub-spoke-app # hub 10.40.0.0/16 peered or via vWAN to spoke 10.41.0.0/16 # diagnostic settings → Log Analytics # AWS — must all exist before MGN cutover # OU Workloads · app VPC 10.51.0.0/16 · TGW tgw-lab # org CloudTrail multi-region · Security Hub enabled ## Four failures ### 1 · Dirty subscription Public IP leftovers, Owner on a laptop user, no policy. Migrating into it copies the mess around the VM. ### 2 · Hub after the VM Then you rebuild peering, UDRs, and private DNS under a change freeze. Build the hub first. ### 3 · Logs “later” The first cutover is the first incident. No Sentinel / no CloudTrail means you argue from memory. ### 4 · Workload in the platform sub pay-api in sub-hub bypasses the spoke NSG/firewall story. Platform and workload are different subscriptions on purpose. ## How to prove it Close only when 1) MG/OU screenshot exists. 2) Hub CIDR is the Azure or AWS series CIDR. 3) A log query returns something from the platform. 4) The migrate target is sub-spoke-app or the Workloads account — not a sandbox. ## Traps Looks like a landing zone Is not A subscription named “Prod” No MG, no hub, no logs One fat VNet 10.0.0.0/8 Collision waiting for on-prem 10.20.30.0/24 Control Tower enrolled, OU empty You still have to put the account in Workloads ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A landing zone is complete when… The first VM pings Identity, MG/OU, hub, and logging exist Someone named the subscription Prod ExpressRoute is ordered Correct: b . Four pieces. Q2 pay-api should land in… sub-spoke-app / Workloads OU The engineer’s personal subscription sub-hub next to Azure Firewall On-prem dc01 Correct: a . Workload vs platform. Q3 This lab’s Azure hub CIDR? 10.20.30.0/24 10.40.0.0/16 10.50.0.0/16 10.0.0.0/8 Correct: b . Same as Azure series. Q4 This lab’s AWS app VPC? 10.41.0.0/16 10.51.0.0/16 10.20.30.0/24 203.0.113.60/32 Correct: b . Same as AWS series. Q5 Migrating into a dirty subscription is… Fine if the VM is small Not a landing zone Required by CAF How you skip Sentinel Correct: b . Ticket. Q6 Logging must exist… After the first incident Before the first replica / VM Only if you buy Sentinel Only in the app VNet Correct: b . Failure 3. Check answers Reset On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview ## Sources - Azure CAF — Landing zones . - Azure Architecture Center — Hub-spoke network topology . - AWS Control Tower — Organizations, OUs, landing zone . - Amazon VPC Transit Gateway . - Azure CAF — Migrate (land into a ready zone) . Related: Azure landing zone · AWS Org / OU . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt