Architect Details 7 Azure Landing Zone Decisions for 2-Region Enterprise Design
Updated
Updated · InfoWorld · Sep 22
Architect Details 7 Azure Landing Zone Decisions for 2-Region Enterprise Design
2 articles · Updated · InfoWorld · Sep 22
Summary
Seven design choices shaped an enterprise Azure landing zone aimed at making secure, governed environments usable for engineering teams rather than just compliant on paper.
Two Azure regions ran in active-active mode behind Azure Front Door, while Azure Virtual WAN replaced a self-managed hub-and-spoke setup to provide cross-region connectivity and centralized routing.
Palo Alto Cloud NGFW was built into routing from the start, and governance used management groups, subscriptions and risk-based guardrails instead of blanket deny policies that slow developers.
Datadog handled observability, a dedicated cloud SIEM handled security analytics, and GitHub larger runners connected through Azure VNets so CI/CD could reach private resources without reopening public access.
The broader lesson was that a landing zone is an operating model—networking, security, telemetry, deployment and resiliency must work together as a repeatable platform beyond Microsoft’s reference architecture.