Larry.

I build things

Recent Posts

Security Baseline: Defender for Cloud and Microsoft Sentinel in a Landing Zone

A landing zone without a security baseline is a high-speed vehicle without brakes. You can deploy workloads at record pace, but without a centralized system to detect threats and manage posture, your risk surface grows with every new subscription. In an enterprise environment, security cannot be a …

Apr 8, 2026 Read

CI/CD Pipeline for Your Landing Zone: Deploying Azure Verified Modules with GitHub Actions

Deploying an enterprise landing zone from a local terminal is a single point of failure. It lacks an audit trail, bypasses peer review, and relies on long-lived administrative secrets stored on personal machines. A production-grade foundation requires a GitOps approach, where every change to the …

Apr 8, 2026 Read

Cost Governance in the Landing Zone: Tagging Enforcement, Budgets, and FinOps Automation

“Unlimited scalability” is a selling point for developers and a liability for finance teams — unless the platform enforces guardrails before spend happens. Most organizations discover this mismatch the hard way: a surprise bill at month-end, a scramble to identify who created what, and a …

Apr 8, 2026 Read

Day-2 Operations: Maintaining and Evolving Your Azure Landing Zone

Deploying your landing zone was the easy part. Now you have to live with it.

The most common failure mode in platform engineering is not a bad initial deployment — it is treating the landing zone as a finished project rather than an ongoing product. Azure releases new services and deprecates old …

Apr 8, 2026 Read

Governance at Scale: Writing and Deploying Azure Policies with Terraform and Bicep

In an enterprise landing zone, configuration drift is the primary enemy. You can build a perfect hub-and-spoke network, but if a developer can manually create a Storage Account with a public endpoint or skip diagnostic logging, your governance model has failed. Azure Policy is the enforcement …

Apr 8, 2026 Read

Subscription Vending: Automating New Workload Onboarding with IaC

Cloud adoption at scale fails when the platform team is a manual bottleneck. If onboarding a new application team requires a Jira ticket, three emails, and 10 business days of manual configuration, you haven’t built a platform—you’ve built a bureaucracy. In an enterprise landing zone, we …

Apr 8, 2026 Read

Centralized Monitoring: Log Analytics, Diagnostic Settings, and Azure Monitor Workbooks

If you can’t see it, you can’t govern it. In an enterprise landing zone, observability is not an afterthought—it is the foundation of security and cost management. A fragmented logging strategy, where every application team manages its own Log Analytics Workspace, leads to “Siloed …

Apr 8, 2026 Read

Azure Platform Engineering: The Complete Guide to Building an Enterprise Landing Zone

Cloud adoption at enterprise scale fails when it lacks a foundation. Without a structured landing zone, subscriptions proliferate as unmanaged silos, security policies are applied inconsistently, and networking becomes a chaotic web of peerings and overlapping IP ranges. “Just create a …

Apr 7, 2026 Read

Design Your Azure Management Group and Subscription Hierarchy

The hierarchy is the first thing you build in a landing zone, and it is the hardest thing to change later. Management Groups (MGs) provide a scope above the subscription level, allowing you to apply Azure Policies and RBAC roles that cascade down to every child resource. A well-designed tree enables …

Apr 7, 2026 Read

Hub-and-Spoke Networking for Azure Landing Zones: Azure Firewall, Bastion, and Private DNS

Networking is the nervous system of your landing zone. In an enterprise cloud environment, you cannot allow every application to manage its own internet egress or hybrid connectivity. Ad-hoc networking leads to overlapping IP ranges, uninspected traffic, and a fragmented DNS namespace that makes …

Apr 7, 2026 Read

Identity and Access Architecture for Azure Landing Zones: Entra ID, RBAC, and PIM

Identity is the new perimeter. In a landing zone, network firewalls and VPNs are secondary to the authentication and authorization decisions made at the Entra ID boundary. A single compromised “Owner” account with standing access can bypass every network control you’ve built.

Our …

Apr 7, 2026 Read