Landing Zone Generator
Generate a ready-to-use Azure Landing Zone tailored to your org.

Pick a preset, adjust options, click Generate, then download Bicep/Terraform or export ALZ-compatible configs. Everything runs client-side.

What is this?
An interactive CAF-Ready Landing Zone Generator aligned with Microsoft’s Cloud Adoption Framework guardrails. It scaffolds a platform landing zone and app variants (AKS, AVD, SAP, APIM). Your selections are stored only in your browser (localStorage).

How to use it:

1. Preset: Start with Starter, Regulated, or Enterprise
2. Fill in: Organization, Identity, Network, Governance, Security, Ops & Cost, Automation
3. Pick an archetype: AKS, AVD, SAP, or APIM
4. Click Generate: And review the Summary
5. Export: Bicep/Terraform, params.json (ALZ) and .tfvars, plus app snippets
6. Share link: to copy a URL with your config encoded

Next steps:

• Put files in a repo and run via GitHub Actions or Azure DevOps (as selected)
• Align management groups & subscriptions with the Summary
• For Azure Landing Zone, import params.json/.tfvars and extend modules
• Review policies vs. your compliance pack (MCSB, ISO 27001, NIST, CIS, PCI)

Preset

Starter - SMB, quick start Regulated - strong policy set Enterprise - multi subscription, hub and spoke

Organization

Org size* Please choose Solo IT Team Enterprise Subscription model* Please choose Single Multi Regions strategy Primary Primary+DR Multi region

Identity

Entra license P1 P2 Identity source Cloud only Hybrid (AD Connect) RBAC baseline Least privilege Owner restricted Relaxed

Network

Topology* Please choose Flat Hub-and-Spoke Mesh Connectivity* Please choose None Site-to-Site VPN ExpressRoute Private DNS Yes No

Governance and Policy

Policy level* Please choose Basic Standard Strict Allowed regions Tags (comma separated) Subscription vending Manual Automated Compliance pack None Microsoft Cloud Security Benchmark ISO 27001 NIST SP 800-53 CIS Foundations PCI DSS Guardrails Deny creation of Public IPs (subscription)

Security

Defender for Cloud* Please choose Off Essentials Full Key management Platform managed Customer managed Baseline controls Standard High

Ops and Cost

Monitoring Log Analytics Log Analytics + SIEM Backup and DR Azure Backup Azure Backup + ASR 3rd party Monthly budget per subscription (€)* Alerts

Automation

IaC* Please choose Bicep Terraform Pipelines GitHub Actions Azure DevOps None Archetype Foundation AKS AVD SAP APIM

Application LZ: Azure Virtual Desktop (AVD)

Region Host pool type PooledPersonal Load balancing BreadthFirstDepthFirst Max sessions per host Join type Entra ID joinedAD DS (hybrid) joined FSLogix storage Azure FilesAzure NetApp Files Private endpoints YesNo Scaling plan OnOff Scale min hosts Scale max hosts Peak window (HH:MM - HH:MM)

Application LZ: Azure Kubernetes Service (AKS)

Region Private cluster YesNo CNI Azure CNICNI Overlay Ingress NoneNginxAGIC Outbound egress NAT GatewayLoadBalancer Availability zones (e.g. 1,2,3) System node size System node count User node size User node count Workload Identity OnOff Key Vault CSI Driver OnOff ACR integration YesNo ACR name (if enabled) AKS Policy OnOff Network policy AzureCalico Pod Security baselinerestricted

Application LZ: SAP on Azure

Region Deployment pattern Two-tierThree-tierSingle-VM High availability NoneASCS-ERSDB HAFull DB platform HANASQL SAP SID (3 letters) VM size (App) VM size (DB) Availability zones (e.g. 1,2,3) Azure NetApp Files YesNo Backup strategy Azure BackupANF SnapshotsNone SAP Monitor OnOff VNet CIDR Subnet App Subnet DB

Application LZ: API Management (APIM)

Region SKU DeveloperBasicStandardPremium Capacity VNet mode NoneExternalInternal Private endpoints YesNo Availability zones (e.g. 1,2,3) Managed Identity OnOff

Output

Summary

Bicep

Terraform

Application (AVD) – Bicep

Application (AVD) – Terraform

Application (AKS) – Bicep

Application (AKS) – Terraform

Application (SAP) – Bicep

Application (SAP) – Terraform

Application (APIM) – Bicep

Application (APIM) – Terraform