Disciplines · 02 · Infrastructure
Most of what goes wrong in Azure goes wrong before any workload is deployed. A landing zone built as the apps land — a VNet bolted on here, a public endpoint left there, RBAC figured out later — is one that has to be rebuilt later at a cost the business did not plan to absorb. The cheapest landing zone is the one done properly the first time.
Cloud conversations fail when the framing doesn't match the audience. Three rooms, three different things we most often have to un-teach before anything useful happens.
The usual objection is that the cloud is inherently less secure. In almost every case it isn't — it's just a datacenter you don't have to walk into. The controls are different, not absent. Once the metaphor clicks, the conversation gets productive.
If the app responds, the job feels done — and then someone walks away. We point out that a working endpoint doesn't prove the platform underneath it is set up right. The work still ahead is the platform, not the code.
The question that matters financially is whether it's cheaper to do the landing zone right up front or to go back in two years and unwind what's been built on top of the wrong foundation. It almost never is.
We see the same pattern so often it has a shape to it. No virtual network. Disparate applications wired up to "backend" resources — Azure SQL, storage accounts — over public endpoints. Nothing on a private IP. Nothing that resembles a topology. The team has organized the mess into resource groups and believes that is, in some sense, networking.
It isn't. It's a tag structure. Azure will happily let you run this way for years, and the bill will grow, and the risk will grow with it, because each service is reaching the others the same way your mother's laptop reaches them — over the internet.
There's a lot that could be in a landing zone. These are the six we insist on — the ones that make the rest of the architecture possible and that are painful to add later once workloads depend on them.
Microsoft's Cloud Adoption Framework landing zone diagram is an honest attempt at a complete picture — and for most SMBs it's unreadable. Too many boxes, too much terminology, too little sense of which pieces matter for you. A good engagement ends with that same diagram on a page the client can actually read.
Every CAF module, every reference architecture, every governance control shown at once. Technically complete. Not something you can build a plan from.
The same picture, trimmed to what matters for a business this size. One management group, one hub, three environment subscriptions — and the six pillars that hold it up, labelled. Something you can actually explain to a board.
Nobody calls about a landing zone for its own sake. Infrastructure conversations are almost always downstream of a business decision, a failed attempt, or a quiet suspicion that the current setup isn't where it should be.
"We want to modernize, but the way we're set up on-prem doesn't translate to the cloud — or doesn't work in the cloud at all." The realization that a lift-and-shift isn't going to get them where they want to be. This is almost always where Infrastructure comes first and Migration comes after.
A development team has been spinning up App Services and VMs as the apps need them. They've organized everything into resource groups and believe the environment is structured. It isn't. Someone senior has started asking questions, and nobody on the team has good answers.
An IT team has put some resources into Azure, the business wants to be more cloud-forward, and they want us to look at what's there and say honestly whether they're on the right track — before more gets built on top.
Every engagement wraps with a set of artefacts designed to outlive the project — and, for teams newer to Azure, the shared vocabulary to maintain what they've been handed.
"Resource groups aren't networking. They're folders. A room full of folders isn't an office — and a subscription full of resources talking to each other over the public internet isn't a platform." Why the foundation matters
Connected to
You don't migrate into a mess. The landing zone comes first.
The landing zone is strategy expressed in infrastructure. The roadmap is where both get written.
Private networking is the first security control, not the last.
The shape of the landing zone is the shape of the cloud bill.
Book a call
If you've been building in Azure and the nagging feeling is that it's not quite right — or you're about to start and want to make sure the first decisions are the right ones — that's the conversation to have before more workloads land on top.
Or reach us directly: info@fouronesixit.ca · (647) 371-0400