Azure Landing Zone Review

0 / 14 in place · 0%

Structure and governance

A management group hierarchy exists and reflects how you governNot everything dumped in the root or the default group.
Azure Policy enforces your guardrails automaticallyAllowed regions, required tags, denied public exposure, applied by inheritance.
Subscriptions are organised by purpose, not by accidentPlatform, landing zones, and sandbox separated deliberately.
Tagging is enforced, not just encouragedCost centre, owner, and environment tags are how you make spend accountable.

Identity and access

Role assignments follow least privilegeScoped to the right level, granted through groups, reviewed regularly.
Privileged access to Azure is just-in-timePrivileged Identity Management on the roles that can change the estate.
Break-glass accounts exist and are protectedTwo emergency accounts, excluded from Conditional Access, closely monitored.

Network and connectivity

The network topology is deliberateHub-and-spoke or Virtual WAN, not a flat sprawl of peered networks.
Segmentation and network security groups are in placeWorkloads isolated, east-west traffic controlled.
Public exposure is the exception and is reviewedPrivate endpoints preferred, public IPs justified and monitored.

Security and operations

Defender for Cloud is on and its recommendations are workedA secure score trend with an owner, not a dashboard nobody opens.
Diagnostic and activity logs flow to a central workspaceRetained long enough for investigation, ideally into Sentinel.
Cost management has alerts and budgetsSpend anomalies should reach a human before they reach finance.
Backup and recovery are configured and testedA backup you have never restored is a hope, not a plan.

If your foundation is missing several of these, retrofitting is real work, but far cheaper than the incident or the cost overrun that a missing guardrail eventually causes. We run landing zone reviews and remediation as a defined engagement.

Get a free posture assessment Talk to our team

Azure Landing Zone Review

Structure and governance

Identity and access

Network and connectivity

Security and operations

Keep going

Microsoft 365 Security Checklist

Copilot Readiness Assessment

Want this run against your real environment?