Enterprise landing zones

A landing zone that scales is a repeatable path from "new workload request" to a compliant subscription: a management group placed in the right branch, policy assigned before the first resource lands, and guardrails — tags, budgets, allowed regions — enforced at vending time rather than audited after the fact. For sovereign estates the same pipeline also has to prove, continuously, that the policy assignment it created is still the one in force.

The pattern: create the management group, vend a subscription straight into it from the billing account scope, and assign a tagging policy before the subscription is handed over — so there's no window where a workload subscription exists without governance. Confirm resource and provider versions against Microsoft Learn before using this as-is; subscription vending in particular depends on your billing account type (MCA vs. EA).

Terraform

resource "azurerm_management_group" "corp_sovereign" {
  display_name               = "corp-sovereign"
  parent_management_group_id = data.azurerm_management_group.landing_zones.id
}

# Vend a new workload subscription straight into the Corp landing zone
resource "azurerm_subscription" "workload" {
  subscription_name = "sov-corp-workload-01"
  billing_scope_id  = var.billing_account_scope
  workload          = "Production"
}

resource "azurerm_management_group_subscription_association" "workload_to_corp" {
  management_group_id = azurerm_management_group.corp_sovereign.id
  subscription_id      = azurerm_subscription.workload.id
}

# Tag guardrail enforced at the moment of vending
data "azurerm_policy_definition" "require_tag" {
  display_name = "Require a tag on resource groups"
}

resource "azurerm_policy_assignment" "require_tags" {
  name                 = "require-cost-center-tag"
  scope                = azurerm_subscription.workload.id
  policy_definition_id = data.azurerm_policy_definition.require_tag.id
}

Bicep

resource corpLandingZone 'Microsoft.Management/managementGroups@2023-04-01' = {
  name: 'corp-sovereign'
  properties: {
    displayName: 'corp-sovereign'
    details: {
      parent: {
        id: landingZonesManagementGroupId
      }
    }
  }
}

resource requireTagAssignment 'Microsoft.Authorization/policyAssignments@2024-04-01' = {
  name: 'require-cost-center-tag'
  scope: subscription(workloadSubscriptionId)
  properties: {
    displayName: 'Require a tag on resource groups'
    policyDefinitionId: requireTagPolicyDefinitionId
  }
}