Management groups & landing zones

Inherited guardrails, secure-by-default subscriptions.

Preventive guardrails only scale when they are applied automatically to every subscription. Management groups plus an Azure Landing Zone give you a hierarchy where policy, RBAC, networking, and logging are inherited, so a new subscription arrives already fenced rather than after a hardening sprint.

Management groups and inherited baselines

Management groups sit above subscriptions and form a tree that policy and RBAC inherit down. Assign your security-benchmark initiative, your logging deployIfNotExists policies, and your break-glass RBAC once at a top-level management group, and every subscription beneath — including ones created next year — gets them automatically. Deny assignments (from Blueprints or managed applications) can lock specific resources so that even a subscription Owner cannot alter them, giving you controls that survive delegated administration.

# Structure: root MG → platform / landing-zones / sandbox MGs → subscriptions.
# Assign the baseline once at the top; it inherits to every subscription below.
az account management-group create --name landing-zones
az policy assignment create --name require-diag \
  --policy "Deploy diagnostic settings to Log Analytics" \
  --scope /providers/Microsoft.Management/managementGroups/landing-zones \
  --location eastus --mi-system-assigned   # deployIfNotExists needs an identity
# New subscriptions moved under landing-zones inherit logging automatically.

Secure-by-default subscriptions

An Azure Landing Zone (Cloud Adoption Framework) is the packaged version: a management-group hierarchy with baseline policies, RBAC, hub-and-spoke networking, and centralized logging pre-applied, provisioned through infrastructure as code. A subscription-vending process then hands teams a subscription that is already fenced — policies enforcing encryption and private networking, diagnostics wired to the logging workspace, Defender enabled — with no window of exposure and no checklist to forget. Security becomes a property of how subscriptions are created.