Azure landing zone basics for SMB

Overview

A landing zone is the baseline subscription design—identity, network, governance, and monitoring—before you deploy workloads. For SMB clients, favor simple, documented patterns over enterprise-scale complexity unless they are merging into a holding company standard.

Minimum viable layers

• Management group or subscription hierarchy aligned to dev/test/prod (or at least production vs sandbox).
• Entra ID RBAC with PIM or break-glass for owners; no personal accounts as subscription admins.
• Network: hub-spoke or single vNet with segmented subnets; Azure Firewall or NVA only where required by compliance or multi-site complexity.
• Policy: deny public blob, require TLS, tag enforcement for Environment, Owner, CostCenter.
• Logging: Diagnostic settings to a central Log Analytics workspace; retain per contractual minimum.

MSP hygiene

Use Infrastructure-as-Code for repeatability; document exceptions in the client runbook. Onboard Defender for Cloud standard tier where budget allows; export secure score monthly to the vCISO pack.

Handoff checklist

Diagram, RBAC group list, policy assignment map, and “who approves subscription owner changes” agreed in writing.