Skip to main content
HybridCloudWorks logoHybridCloudWorks

Landing Zone Builder

Assemble an Azure landing zone one component at a time. Tick a component to add it and its dependencies come with it; untick one and everything that needs it leaves too. Each component explains what it is for and what breaks without it, the diagram redraws as you build, and the Terraform beneath mirrors HashiCorp’s validated pattern for an Azure landing zone using the current Azure Verified Modules, pinned on 2026-09-25. The whole build is in this page’s address, so a landing zone is a link you can send. Nothing here touches a tenant.

Build

Tick a component to add it and whatever it needs; untick one and everything that needs it leaves with it. The build is in this page’s address, so the link is the landing zone.

Platform, built once

The tree of management groups every subscription is placed in.

Unticking it also removes Policy baseline, Management, Connectivity hub, Azure Firewall, Identity, Corp landing zone and Online landing zone.

The Azure Policy assignments the alz architecture makes on each management group.

Needs Management groups and Management.

The Log Analytics workspace and Automation account that collect every subscription’s telemetry.

Needs Management groups.

Unticking it also removes Policy baseline.

The hub virtual network, Bastion and DNS that every landing zone peers into.

Needs Management groups.

Unticking it also removes Azure Firewall, Identity, Corp landing zone and Online landing zone.

The firewall in the hub that every private spoke’s traffic is routed through.

Needs Connectivity hub.

The identity subscription, placed under the Identity group, with its own spoke.

Needs Management groups and Connectivity hub.

Application landing zones, one per team

An application subscription for internal workloads, reached only through the hub.

Needs Management groups and Connectivity hub.

An application subscription that may face the internet and still uses the hub.

Needs Management groups and Connectivity hub.

Options

Where every regional resource is created: the Log Analytics workspace, the hub network, the firewall, the spokes. Management groups and policy are tenant-wide and have no region.

Used by Management groups.

The management group the "alz" root is created under. Leave empty for the tenant root group, which is where the validated pattern puts it; name an existing group to nest the whole tree beneath it.

Used by Management groups.

The IPv4 range the hub virtual network owns. Spokes peer into it, so it must not overlap the spoke range or any on-premises range.

Used by Connectivity hub.

The range every landing zone’s spoke is carved from, one /24 each: corp spokes from the low half, online spokes from the high half, identity at the top of the low half. /8 to /20. It must not overlap the hub; a range that does is moved to the first free fallback (10.1.0.0/16, 10.2.0.0/16, then 172.16.0.0/16) and the build says so.

Used by Identity, Corp landing zone and Online landing zone.

Create the private DNS zones for Azure Private Link services in the hub, linked to the hub network, so private endpoints in spokes resolve by name.

Used by Connectivity hub.

Basic is for small deployments under 250 Mbps; Standard adds threat intelligence and scales; Premium adds TLS inspection and intrusion detection.

Used by Azure Firewall.

Platform component

Management groups

The tree of management groups every subscription is placed in.

A management group is a container above subscriptions, and the tree of them is the skeleton of a landing zone: an "alz" root, a Platform branch for the shared services and a Landing zones branch for the workloads. Policy and role assignments made on a group flow down to every subscription beneath it, so one decision at the root governs hundreds of subscriptions without being repeated. The avm-ptn-alz module reads the "alz" architecture definition and creates the whole tree in one call, and its subscription_placement input is how every other component’s subscription lands in the right group. The architecture carries the policy baseline with it, so selecting only this component deploys the tree with every assignment present but set to DoNotEnforce; selecting Policy is what turns them on. Without the tree, each subscription is its own island: every guardrail has to be assigned again for each one, and nothing stops a new subscription from arriving with none.

In this build
Selected.
Needs
Nothing: this is where a landing zone starts.
Deployed by
Azure/avm-ptn-alz/azurerm version 0.21.0, the latest on the Terraform Registry when checked on 2026-09-25.
Knobs
Azure region and Parent management group.
Diagram

The management group tree with the subscriptions and networks under it, redrawn as you build. Click a box to read about its component; drag to pan, Ctrl + scroll or pinch to zoom.

16 boxes, 1352 by 432 units.
Landing zone diagram: 8 management groups, 1 policy baseline, 1 log analytics workspace, 1 hub virtual network, 3 spoke virtual networks, 1 azure firewall, 1 private dns zones.alzalzPolicy baselinePolicy baselinePlatformPlatformManagementManagementLog Analytics + AutomationLog Analytics + AutomationConnectivityConnectivityHub VNet 10.0.0.0/16Hub VNet 10.0.0.0/16Azure Firewall StandardAzure Firewall StandardPrivate DNS zonesPrivate DNS zonesIdentityIdentityIdentity spoke 10.1.127.0/24Identity spoke 10.1.127.0/24Landing zonesLanding zonesCorpCorpCorp 1 10.1.0.0/24Corp 1 10.1.0.0/24OnlineOnlineOnline 1 10.1.128.0/24Online 1 10.1.128.0/24
  • Management group
  • Policy baseline
  • Log Analytics workspace
  • Hub virtual network
  • Spoke virtual network
  • Azure Firewall
  • Private DNS zones
  • Peering to the hub
Generated Terraform

The files this build becomes, in the shape of the examples the Azure Verified Modules ship. Every module is pinned; the README says what to fill in before a plan.

hcl
# Generated by the HybridCloudWorks Landing Zone Builder for learning. Never applied here.
terraform {
  required_version = ">= 1.12, < 2.0"

  required_providers {
    alz = {
      source  = "azure/alz"
      version = "~> 0.21"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.12"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.35"
    }
    modtm = {
      source  = "azure/modtm"
      version = "~> 0.3"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.9"
    }
  }
}

11 files. Generated for learning and never applied here: this page touches no tenant, and the README in the zip says the same.

The modules behind the files

Four Azure Verified Modules, each pinned to the latest release the Terraform Registry listed on 2026-09-25. The archived hub-networking pattern module is never emitted, and the application landing zone pattern module is not called because it had no published release on that date: a landing zone is a subscription placement plus a spoke from the virtual network module instead.