TL;DR

Planning and strategy set the rules. This post ships a lightweight Landing Zone Generator that turns those rules into Bicep and Terraform starters you can copy, download, and share.

Open the Landing Zone Generator

Previously in this series

Strategy First: Why it matters before any VM

The business case, risks, and measurable outcomes that guide CAF.

Read post

Plan Ready: Adapting your CAF roadmap

Roles, RACI, governance decisions, and the first workloads.

Read post

Who is this for

• MSPs and system integrators who want a repeatable baseline
• Teams preparing migrations that must not drift from governance and security
• Readers who prefer simple choices mapped to CAF design areas

Try the tool

Preset

Starter - SMB, quick start Regulated - strong policy set Enterprise - multi subscription, hub and spoke

Organization

Org size* Please choose Solo IT Team Enterprise Subscription model* Please choose Single Multi Regions strategy Primary Primary+DR Multi region

Identity

Entra license P1 P2 Identity source Cloud only Hybrid (AD Connect) RBAC baseline Least privilege Owner restricted Relaxed

Network

Topology* Please choose Flat Hub-and-Spoke Mesh Connectivity* Please choose None Site-to-Site VPN ExpressRoute Private DNS Yes No

Governance and Policy

Policy level* Please choose Basic Standard Strict Allowed regions Tags (comma separated) Subscription vending Manual Automated Compliance pack None Microsoft Cloud Security Benchmark ISO 27001 NIST SP 800-53 CIS Foundations PCI DSS Guardrails Deny creation of Public IPs (subscription)

Security

Defender for Cloud* Please choose Off Essentials Full Key management Platform managed Customer managed Baseline controls Standard High

Ops and Cost

Monitoring Log Analytics Log Analytics + SIEM Backup and DR Azure Backup Azure Backup + ASR 3rd party Monthly budget per subscription (€)* Alerts

Automation

IaC* Please choose Bicep Terraform Pipelines GitHub Actions Azure DevOps None Archetype Foundation AKS AVD SAP APIM

Application LZ: Azure Virtual Desktop (AVD)

Region Host pool type PooledPersonal Load balancing BreadthFirstDepthFirst Max sessions per host Join type Entra ID joinedAD DS (hybrid) joined FSLogix storage Azure FilesAzure NetApp Files Private endpoints YesNo Scaling plan OnOff Scale min hosts Scale max hosts Peak window (HH:MM - HH:MM)

Application LZ: Azure Kubernetes Service (AKS)

Region Private cluster YesNo CNI Azure CNICNI Overlay Ingress NoneNginxAGIC Outbound egress NAT GatewayLoadBalancer Availability zones (e.g. 1,2,3) System node size System node count User node size User node count Workload Identity OnOff Key Vault CSI Driver OnOff ACR integration YesNo ACR name (if enabled) AKS Policy OnOff Network policy AzureCalico Pod Security baselinerestricted

Application LZ: SAP on Azure

Region Deployment pattern Two-tierThree-tierSingle-VM High availability NoneASCS-ERSDB HAFull DB platform HANASQL SAP SID (3 letters) VM size (App) VM size (DB) Availability zones (e.g. 1,2,3) Azure NetApp Files YesNo Backup strategy Azure BackupANF SnapshotsNone SAP Monitor OnOff VNet CIDR Subnet App Subnet DB

Application LZ: API Management (APIM)

Region SKU DeveloperBasicStandardPremium Capacity VNet mode NoneExternalInternal Private endpoints YesNo Availability zones (e.g. 1,2,3) Managed Identity OnOff

Output

Summary

Bicep

Terraform

Application (AVD) – Bicep

Application (AVD) – Terraform

Application (AKS) – Bicep

Application (AKS) – Terraform

Application (SAP) – Bicep

Application (SAP) – Terraform

Application (APIM) – Bicep

Application (APIM) – Terraform

Open the standalone tool

## Roadmap Next iterations will add Application Landing Zones for AKS, AVD, and AI, plus compliance packs and ALZ compatible exports.