Azure governance sets repeatable boundaries for where workloads run, who can change them, and which configurations are allowed, audited, or automatically corrected. Management groups organize subscriptions. Azure Policy evaluates resource configuration. Initiatives bundle policies. Landing zones combine identity, hierarchy, networking, management, security, governance, and subscription-vending patterns.
This is a starting pattern, not a mandatory company chart. Keep hierarchy shallow and driven by policy/access differences. Do not mirror every department; reorganizations then become cloud-control-plane migrations.
A policy definition describes a condition and effect. Common effects include audit, deny, modify, append, deployIfNotExists, and auditIfNotExists. An assignment applies a policy/initiative at a scope. Exemptions record approved exceptions. Remediation tasks correct supported existing resources for modify/deploy effects.
Use the following method choices to create an audit-only assignment after selecting a built-in definition or version-controlled custom definition.
Start in audit mode. Measure impact, fix false assumptions, provide an exemption workflow, then move to deny or remediation. An immediate broad deny at the tenant root can block incident response and platform services.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Search Policy → Assignments → Assign policy. Select the narrow test scope, definition or initiative, parameters, and a managed identity only when remediation needs it. Set enforcement to Disabled for the audit phase, add ownership metadata, create the assignment, and review Compliance before enabling enforcement.
Bicep can deploy management-group, subscription, or resource-group policy definitions/assignments at the appropriate scope. Terraform has azurerm_policy_* resources. Keep parameters and exemptions in source control with owners and expiry.
Azure Blueprints is not the foundation for new landing-zone designs. Microsoft guidance moved toward template specs/deployment stacks, Azure Policy, and infrastructure as code. If an existing organization uses Blueprints, plan migration from its artifacts and assignments instead of expanding dependence.
A platform landing zone provides shared identity, connectivity, management, and governance. An application landing zone is a subscription/environment where a workload team deploys within those guardrails. Subscription vending automates creation, placement, budget, network connection, RBAC, diagnostics, and ownership metadata.
Use the Azure Landing Zones reference implementation as a starting point. Customize only from documented requirements and keep upgradeability.
An exemption records scope, policy, reason, compensating control, owner, approval, and expiration. Review it automatically before expiry. Do not weaken the global policy to accommodate one legacy workload.