Azure Cloud Adoption Framework (CAF) & Azure Landing Zones

Azure's global backbone powers the cloud by connecting data centers, fiber networks, and subsea cables across 60 regions. Region pairs and availability zones enable availability and fault tolerance.

Explore Azure regions, availability zones, and geographies along the global backbone, and use filters for GDPR, HIPAA, PCI DSS, and other standards, plus a virtual data center tour.

Explore the Azure resource hierarchy from the root management group through subscriptions and resource groups to resources, and learn how governance, inheritance, and RBAC enable secure, cost-aware, scalable workloads.

Explore Azure subscription types: free, student, pay-as-you-go, and enterprise agreements. Understand billing and access rules, including credit card requirements and eligibility, for learning and deployment scenarios.

Explain that Entra ID tenants are separate from Azure resources. Show how Entra ID provides identity services for human and managed identities and applications.

Create an Azure subscription by choosing free or pay-as-you-go options, sign in with a Microsoft account, access 12 months of popular services, 55 services always free, and 200 USD credit.

Explore the Azure resource hierarchy and set up your environment by managing management groups and subscriptions. Create a new management group, rename a subscription, and create a resource group.

Configure a subscription budget in Azure Cost Management, set monthly thresholds, and enable alerting on actual or forecasted spending with email notifications.

Explore Microsoft's Azure cloud adoption framework (CAF), a high-level guide aligning business and technology through strategy, plan, ready, migrate, innovate, with governance, secure, manage, and landing zones.

Compare the Azure Well-Architected framework and the Azure Cloud Adoption Framework to see how WAF guides a single workload with five pillars, while CAF aligns business strategy with cloud adoption.

Discover how an Azure landing zone provides scalable, modular blueprints with subscriptions as core pillars, ensuring security, identity, cost efficiency, and repeatable migration across applications.

Learn the design principles of Azure landing zones, covering tenant and billing management, identity and access management, network topology, resource organization, and governance through automation.

Explore the Microsoft Azure landing zone architecture and its complexity, then learn step by step in upcoming videos by breaking down each area to reveal the big picture.

Enterprise enrollment requires setting up a billing account, department profiles, accounts, and an invoice section before issuing the first subscription, with a 1:1 app-to-subscription mapping.

Explore identity and access management as the foundation of cloud security within the Azure landing zones, detailing on-premises Active Directory integration, Azure identity, and privileged identity management.

Learn how a platform DevOps team automates landing zones using pipelines and code, provisioning subscriptions, roles, and policies with Azure DevOps or GitHub Enterprise to scale cloud deployments.

Differentiate platform landing zones from application landing zones in Azure. Platform zones provide shared services in a subscription; application zones host individual applications with governance via management groups.

Architect management groups and subscriptions across the intra organization from the tenant root Contoso, detailing platform and landing zones, plus decommissioned and sandbox subscriptions.

The management subscription in platform landing zones hosts automation accounts and a log analytics workspace to enable monitoring, change tracking, and inventory across cost, identity, policies, and defender for cloud.

Explain identity subscription in azure landing zones, including VNet region one with DNS and UDR, domain controllers or Azure AD Domain Services, and governance, policies, and monitoring across regions.

Explore the Azure connectivity subscription, including Azure DDoS protection, Azure DNS, ExpressRoute circuits, and Azure Firewall policies, and understand hub virtual networks, scaling, peering, cost management, and policy assignments.

Identify the first subscription in the application landing zones, focusing on platform team hosted capabilities and distinguishing platform landing zones from application landing zones, named landing zone P1.

Provide a dedicated subscription for an application in landing zone A2, leveraging platform shared services for connectivity, identity, and monitoring, enabling scalable deployment across future subscriptions.

Explore the sandbox subscription as a developer playground with a defined baseline for cost management, security, and network monitoring to support proofs of concept and testing, not intended for production.

Learn how to create a free Azure subscription, choose between free and pay-as-you-go, provide personal details, and access portal.azure.com to start building in Azure.

Ensure prerequisites to deploy the enterprise scale accelerator: global admin, elevated user access administrator rights, and a tenant root scope Azure RBAC role assignment via Cloud Shell.

Demonstrates deploying the Azure landing zone accelerator to establish an enterprise landing zone with GUI deployment of 174 resources, governance guardrails, monitoring, networking, and compliance configurations.

Conclude the course by reviewing the cloud adoption framework and how to deploy and implement Azure landing zones through the landing zone accelerator, clarifying each component.

Celebrate finishing the course and explore more Azure and cybersecurity learning, subscribe to Azure and cybersecurity newsletters, and connect on LinkedIn or X via the resources section.