# Azure Landing Zones, and What Goes Wrong When You Skip Them

Source: https://elementdigital.com.au/blog/azure-landing-zones/
Published: 2025-09-02

> Most Azure estates were not designed, they accumulated. What a landing zone actually is, what an unplanned estate costs you, and how to fix one in place.

Most Azure estates were never designed. They accumulated.

Somebody needed a virtual machine, so a subscription appeared. A project needed a test environment, so another one did. Three years later there are 14 resource groups, no naming convention anybody can explain, and nobody is sure which subscription the production database is in.

A landing zone is the thing that stops this. It is worth understanding even if you already have the mess, because the fix is the same shape as doing it properly the first time.

## What a landing zone is

It is the environment you deploy into, set up before anything goes in it.

Subscriptions arranged by purpose. Networking laid out with address ranges that do not collide. Identity and role assignments decided. Policy that enforces the rules. Logging pointed somewhere. Tags required, so costs can be attributed to a team.

None of it is exotic. The value is entirely in doing it before there are workloads, because every one of those decisions becomes ten times harder once something is running on top of it.

## What an unplanned estate costs

Four things, in roughly this order of pain.

You stop being able to answer basic questions. Which subscription is this in, who owns it, what does it cost, can we turn it off. In a tidy estate those are lookups that take a minute. In an untidy one they are investigations that take a day.

Security gaps then hide in the seams. Inconsistent role assignments mean somebody always has more access than anyone intended. Monitoring is switched on in the subscriptions somebody remembered and missing from the rest, so your alerting has holes you have no way of seeing.

Costs drift and nobody can attribute them. Without tags you know the bill went up, but not which project caused it, which makes the conversation with the business impossible to have properly.

Networking eventually becomes the blocker. Overlapping address ranges are the classic version. Two subscriptions built a year apart both used 10.0.0.0/16, and now they need to talk to each other. That is a re-addressing project nobody budgeted for.

## Fixing one that already exists

You do not tear it down. You build the target properly and move into it.

Start by mapping what you have. Every subscription, every resource group, what is in it, who uses it and what it costs. This is dull and it is the whole foundation. Skipping it is why remediation projects stall.

Then design the target. Management group structure, subscription boundaries, an address plan with room in it, naming and tagging standards, and the policy set that will enforce them.

Then migrate deliberately, starting with the workloads that are easiest and least critical. Each one you move proves the pattern and gives you something to point at.

Decommission as you go. The temptation is to leave the old resources running until everyone is sure. Six months later you are paying for both, and the old estate has quietly become production again for something.

## Policy is the part that makes it stick

A landing zone without policy decays back into what you had. People are not being difficult. They just deploy the way that works.

Azure Policy enforces the rules without anybody needing to remember them. Require tags. Restrict deployment to approved regions. Block virtual machine sizes nobody should be using. Enforce diagnostic settings so logs go where you expect.

Start with a handful in audit mode so you can see what would have been blocked, then switch them to enforce once the noise is gone.

## The honest cost

Retrofitting a landing zone is more work than building one. Anyone who tells you otherwise has not done it.

The trade is that the alternative compounds. Every month you wait adds workloads, dependencies and cost to the thing you eventually have to untangle. The estates we find hardest to fix are the ones where somebody decided three years ago to deal with it later.

Element Digital does [Microsoft 365 and Azure work](/microsoft-365-azure/) in Hobart and across Tasmania. If your Azure estate grew rather than got designed, [get in touch](/contact/).