Build a governed foundation before individual workloads arrive. A landing zone connects identity, resource hierarchy, networking, audit evidence, and operating ownership.
Published and sources reviewed: October 26, 2026 · Practical architecture guide
Separate platform and workload responsibilities
A landing zone is more than a collection of deployed services. It establishes how teams obtain environments, which controls apply, where evidence goes, and who handles exceptions. Platform owners maintain shared foundations; workload owners remain accountable for application permissions, data handling, and recovery.
Begin with business requirements: tenant boundaries, data residency, recovery objectives, connectivity, and the teams that will operate the estate. A small organization may need a simpler foundation than a regulated enterprise. Additional accounts or subscriptions create boundaries, but also create operating work.
Compare the organizational building blocks
| Design concern | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| Hierarchy | Organizations, organizational units, accounts | Management groups, subscriptions, resource groups | Organization, folders, projects |
| Foundation direction | Control Tower and governed account provisioning | Platform and workload landing zones | Landing-zone design and enterprise foundations |
| Policy scope | Organization controls plus workload IAM | Azure Policy plus Entra and Azure role assignments | Organization Policy plus IAM |
These are conceptual counterparts, not interchangeable permissions models. Validate inheritance, exceptions, billing boundaries, and service availability separately.
Worked example: onboarding a payment service
Illustrative scenario: a team requests production and test environments. The platform workflow assigns ownership, applies baseline policies, connects approved networks, and directs audit records to a controlled destination. The workload team receives narrowly scoped deployment access and documents its data classification.
Before production, test an allowed deployment and a deliberately disallowed one. Verify the resulting audit records, alert routing, backup restoration, and emergency access procedure. A successful provisioning job is only one acceptance check.
Manage drift and exceptions
Store the foundation definition in version control and review changes with affected owners. Detect changes made outside the pipeline, but distinguish legitimate emergency changes from unauthorized drift. Exceptions need a business reason, compensating controls, an owner, and an expiry date.
Measure onboarding time, baseline coverage, unresolved exceptions, and restoration evidence together. A rapidly provisioned environment without usable logs or an operating owner is not ready.
Implementation checklist
- Assign platform, security, and workload owners.
- Document hierarchy and data-residency decisions.
- Separate production from experimentation.
- Test identity and policy inheritance.
- Verify audit collection and alert ownership.
- Exercise emergency access and restoration.
- Review drift and time-limited exceptions.