Skip to main content

Azure Landing Zone Build

A governed Azure landing zone, built in code and handed over to your team.

We build or rebuild your Azure landing zone as infrastructure-as-code: hub-spoke network, identity and security baseline, policy guardrails, and cost controls. You get a foundation that passes audit and that your team can extend without us.

Investment
From €35,000
Duration
6–10 weeks
Format
Remote-first, on-site for design

At a glance

Investment
From €35,000
Duration
6–10 weeks
Format
Remote-first, on-site for design
Markets served
DACH and Benelux

Who it's for

  • An assessment found your landing zone was set up once and has drifted, and you want it rebuilt to a baseline that holds.
  • You are about to put production or AI workloads on Azure and need the foundation governed before they land.
  • You want the landing zone in code, not click-ops, so the next change is a pull request, not a ticket.
  • You are consolidating landing zones after an acquisition or a divestment, and the two estates need one governance model, not two.
  • A cyber insurance renewal or a customer security questionnaire now asks for evidence of policy-as-code, and your current setup cannot produce it.

Scope and format

Six to ten weeks, remote-first with on-site sessions for the design phase. We design and build a hub-spoke landing zone against Microsoft's Cloud Adoption Framework pattern, in Terraform: management groups and subscription topology, Entra ID and RBAC, network with firewall and private endpoints, Azure Policy guardrails to your compliance baseline, Key Vault and secrets, logging, and cost controls. The team leads, with hub-spoke landing zones at 85 percent Terraform IaC and 94 percent CIS across subscriptions behind them. We work in your tenant and hand over the code, the pipelines, and the runbook.

What you get

Landing zone in Terraform

Management groups, subscriptions, and the hub-spoke network, all in version-controlled IaC.

Identity and access baseline

Entra ID, RBAC, and privileged access set to least privilege and enforced in code.

Policy and security guardrails

Azure Policy to your compliance baseline, with CIS benchmark coverage measured on handover. The team's benchmark on comparable builds is 94 percent CIS coverage across subscriptions.

Network and connectivity

Firewall, private endpoints, and hybrid connectivity over ExpressRoute or VPN where you need it.

Pipelines, monitoring, and cost controls

CI/CD for the IaC, logging to your SIEM, and budgets and alerts set per subscription.

Sovereign region configuration

Where data residency is a requirement, the landing zone configured and documented in the Germany West Central Azure region, not assumed from the default.

Handover and runbook

Documentation and a working session so your team owns and extends the platform.

Pricing

Value-based and scoped per engagement, from €35,000. We price against the size of your estate and the compliance baseline you need, and fix the figure before we start.

If you ran an Azure Architecture Review or a Microsoft Landscape Assessment with us in the last eight weeks, that fee comes off this engagement.

Where your data sits

The build runs in your tenant, in the Azure region you are bound to. Access is least-privilege and scoped to the engagement. Where data residency matters, the landing zone is configured in the Germany West Central Azure region, and we sign your data processing agreement before we start.

Governance & compliance

  • Built in your tenant and your region, with data residency enforced in the landing zone.
  • Least-privilege access, scoped to the engagement.
  • Azure Policy guardrails set to your compliance baseline, with CIS coverage measured on handover.
  • A signed data processing agreement before kickoff.
Read our governance approach

Common questions

How long does it take?

Six to ten weeks, depending on the size of the estate and the compliance baseline.

Greenfield or an existing landing zone?

Both. We build a new one or remediate an existing one up to baseline. The Azure Architecture Review tells the two apart before we quote.

Which IaC do you use?

Terraform by default. We can work in Bicep if your team has standardised on it.

Do we own it afterwards?

Yes. You get the code, the pipelines, and a runbook, plus a working session so your team can extend it without us.

Who does the work? Senior engineers, or a delivery team we never meet?

Senior engineers scope, build, and hand over the landing zone directly. There is no junior bench and no handoff partway through.

We already run a dozen subscriptions with different owners. Can you bring that under one landing zone without downtime?

Yes. We move existing subscriptions into the management group hierarchy one at a time, so production workloads keep running while the baseline goes in underneath them.

What does 'governance in code' mean in practice?

Every policy, role assignment, and network rule lives in the Terraform repo, not the portal. Changes go through a pull request and CI/CD, so the baseline cannot drift silently again.

What happens to workloads already running while you rebuild the landing zone?

They keep running. We build the new management group and policy structure alongside the old one and migrate subscriptions across on a schedule you approve, not in one cutover.

Do you support a multi-cloud or hybrid setup, or Azure only?

The landing zone itself is Azure. Where ExpressRoute or VPN connects it to on-premises or another cloud, that connectivity is part of the network deliverable.

What ongoing support is included after handover?

The build includes the handover session and runbook. Ongoing operation is the reliability retainer if you want us to keep running it, or your own team using the runbook if you do not.

Request the engagement