INSIGHTS / CLOUD
Azure landing zones for smaller organisations.
Enterprise-scale landing zone guidance can overwhelm a small team. This article sets out a minimal, secure Azure foundation that a small organisation can run — and a clear path to grow it.
The problem with skipping the foundation
Small organisations often start with a single subscription, owner rights for everyone and resources created by hand. It works until the first security review, cost surprise or new team — and then retrofitting structure is far harder than starting with it.
A minimal viable landing zone
A small foundation captures most of the value of the Cloud Adoption Framework without the overhead.
- Management groups: a root for the organisation with platform and workloads beneath it
- Subscriptions separated by purpose: platform/shared services, production, non-production and a sandbox
- Resource groups aligned to workloads and lifecycle, with consistent naming and tagging
- All of it defined as code (Terraform or Bicep) from day one
Identity first
Identity is the real perimeter in the cloud.
- Microsoft Entra ID groups for role assignments — never individual users
- Privileged Identity Management for just-in-time administrative access
- Two emergency (break-glass) accounts, excluded from Conditional Access lockout and monitored
- Managed identities for workloads and OIDC federation for CI/CD — no stored secrets
Guardrails with Azure Policy
A small set of policies prevents the most common and expensive mistakes: allowed regions, required tags, denial of public storage access, enforced TLS versions, and audit of resources without diagnostic settings. Start in audit mode, then enforce once the estate is compliant.
Visibility and cost control
Send activity and diagnostic logs to a central workspace, enable Microsoft Defender for Cloud's free posture management, and set budgets with alerts on every subscription. Review cost and security recommendations monthly.
Growing up
As the organisation grows, the same structure extends naturally: add a connectivity subscription with hub networking, more workload subscriptions per product or team, and the fuller Azure Landing Zone reference implementation — without re-platforming what already exists.
Contact: contact@nexaarislabs.com