Introduction

In today’s blog post, I’m excited to delve into my personal reflections and design approaches that I’ve discovered while crafting and structuring Azure solutions. I trust that you’ll find some of these insights intriguing and valuable for your own endeavours.

Azure Project lifecycle

Based on my experience, architects typically play diverse roles across various project stages. This can encompass tasks like creating design outputs, active participation during the development phase, or offering essential direction and oversight.

Illustrated in the diagram below is a sample lifecycle of an Azure project, commencing from the Sales stage and culminating in Production. This visual representation outlines inputs, outputs, and interconnections forged throughout the project’s journey, facilitating a clearer understanding of the intricate relationships at play.

Design Considerations

In discussions around Azure “design” and architecture, it’s important to recognize that the specifics can significantly vary based on the nature of the Azure project at hand. For a greenfield deployment, the following key areas merit careful consideration:

Subscriptions:
Determine whether a single subscription or multiple subscriptions are optimal for the project’s scope.

Management Groups and Subscriptions:
Define the structure of management groups and subscriptions to establish a well-organized hierarchy.

Identity:
Assess the existence of an Azure AD and how it integrates with the project’s identity needs.

Shared Services:
Identify any essential Application Services that need to be shared across all project resources.

On-Premises Connectivity:
Evaluate connectivity options such as ExpressRoute or VPN to link on-premises resources with Azure.

Perimeter Security:
Consider the deployment of Application Gateways, Firewalls, and related measures to ensure perimeter security.

Monitoring and Logging:
Determine whether integration with existing monitoring and logging tools is necessary.

Security and Governance:
Delve into Azure Sentinel, Security Centre, RBAC, security policies, and other measures to ensure robust security and governance.

3rd Party Services:
Identify the need for third-party services like firewalls or SIEMs.

Regulatory Compliance:
Ascertain which industry regulations (PCI-DSS, GDPR, etc.) the solution must adhere to.

Regional and Data Residency:
Address regional and data residency requirements to meet compliance standards.

Disaster Recovery and Backup:
Develop a strategy for disaster recovery and backup tailored to the project’s needs.

Incident Management:
Consider incident management processes to effectively address and mitigate any disruptions.

Migration vs. Cloud-Native:
Determine whether the project involves migrating on-premise applications or building cloud-native solutions.

To aid in these design considerations, Microsoft offers valuable resources like the Cloud Adoption Framework and Azure landing zone conceptual architecture. These frameworks serve as excellent starting points, ensuring foundational elements are established, and fostering confidence in moving forward with the project.

About Framework

Do you already know about the Microsoft Cloud Adoption Framework?

It is a proven guidance designed to assist you in developing and implementing the business and technology strategies needed for your company to be successful in the cloud. The framework offers best practices, data and resources that cloud developers, IT experts and business decision makers need to achieve their desired business outcomes. This standardized approach also helps to ensure greater coordination between company and technological strategies.

Understand the lifecycle:

Azure Enterprise Scale Landing Zone

An Azure landing zone is the output of a multi-subscription Azure environment that accounts for scale, security governance, networking, and identity. An Azure landing zone enables application migration, modernization, and innovation at enterprise-scale in Azure.

Enterprise-scale is an architecture approach and reference implementation that enables effective construction and operationalization of landing zone in Azure, at scale and aligned with Azure Roadmap and Microsoft Cloud Adoption Framework

It’s a mature, scaled-out target architecture intended to help organizations operate successful cloud environments that drive their business while maintaining best practices for security and governance.

• A reference architecture
• Recommended patterns vetted by engineering
• Adaptable to accommodate customer requirements
• Accelerates onboarding of new workloads by removing governance blockers
• Consistent policy based framework
• Built using native tooling (Azure Policy and Management Groups)

Enterprise Scale fits within the ‘Ready’ phase of Cloud Adoption Framework.

The foundation of the architecture is a set of core design principles that serve as a compass for subsequent design decisions across critical technical domains.

Azure landing zone — Design Principles

• Subscription Democratization

Subscriptions should be used as a unit of management and scale aligned with business needs and priorities to support business areas and portfolio owners to accelerate application migrations and new application development.

• Management Group Organization

A scalable Management Group hierarchy aligned to core platform capabilities, allowing to operationalize at scale using centrally managed Azure RBAC and Azure Policy where platform and workloads have clear separation.

• Policy-driven Governance

Use Azure Policy to provide guardrails and ensure continued compliance with your organization’s platform and the applications deployed onto it. Azure Policy also provides independence and a secure, unhindered path to the cloud

• Single control and management plane

Azure provides a unified and consistent control plane which is subject to role-based access and policy-driven controls. This applies across all Azure resources and provisioning channels. Azure can be used to establish a standardized set of policies and controls for governing the entire enterprise estate.

• Application-centric service model

Focus on application-centric migrations and development rather than pure infrastructure lift-and-shift migrations, such as moving virtual machines. The design choices shouldn’t differentiate between old and new applications, infrastructure as a service (IaaS), or platform as a service (PaaS) applications.

Azure landing zone architecture

This architecture represents scale and maturity decisions based on a wealth of lessons learned and feedback from customers who have adopted Azure as part of their digital estate.

With an Azure Landing Zone, you’re creating a framework for your organization that enables you to efficiently perform and manage your cloud migration. Within a landing zone, you’ll select the parameters or guardrails that will be used to determine how to use your data and application in the cloud.

Azure Landing Zone Design Areas

These design areas represent how the operating model is supported in the cloud. These design areas describe what to consider before deploying a landing zone.

What will be deployed?

• A scalable Management Group hierarchy aligned to core platform capabilities, allowing you to operationalize at scale using centrally managed Azure Policy where platform and workloads have clear separation.
• Azure Policies that will enable autonomy for the platform and the landing zones.
• An Azure subscription dedicated for Management and Monitoring, which enables core platform capabilities at scale using Azure Policy such as:
• A Log Analytics workspace and an Automation account
• Diagnostics settings for Activity Logs, VMs, and PaaS resources sent to Log Analytics
• An Azure subscription dedicated for Identity in case your organization requires to have Active Directory Domain Controllers in a dedicated subscription
• Landing zone subscriptions for Production and connected applications and resources, including a virtual network that will be connected to the hub via VNet peering
• Azure Policies for workload connected landing zones, which include:

— Diagnostics settings for Activity Logs, VMs, and resources sent to Log Analytics

— Enforce VM monitoring (Windows & Linux)

— Enforce VMSS monitoring (Windows & Linux)

— Enforce VM backup (Windows & Linux)

— Enforce secure access (HTTPS) to storage accounts

— Prevent IP forwarding

— Prevent inbound RDP from internet

— Ensure subnets are associated with NSG

Azure Landing Zones — Deployment Flow

Implementation options

For organizations where this conceptual architecture fits with the operating model and resource structure they plan to use, there’s a ready-made deployment experience called the Azure landing zone accelerator.

The accelerator is an Azure-portal-based deployment that will provide a full implementation of the conceptual architecture, along with opinionated configurations for key components such as management groups and policies.

Microsoft offers two implementation options for landing zones:

• Start small and expand.
• Enterprise-scale:

[ https://github.com/Azure/Enterprise-Scale ]

[https://github.com/Azure/ALZ-Bicep]

Conclusion

Starting a new Azure project from scratch is a difficult task, but I recommend to start with small, get the fundamentals right and learn to iterate swiftly.

I hope you’ve found this post useful.

Useful links

• Azure pricing calculator — calculate costs for Azure services.
• Cloud Adoption Framework — more focused on strategy and adoption. But still an excellent resource for landing zones, best practices etc.
• Azure Well-Architected Framework — guiding design principles
• Reference Enterprise-Scale architectures