Microsoft Azure - Multi tenant architecture and landing zones

Question

I am new to Microsoft Azure, so it might be a very naive question.

1. At what level landing zones are created? Like are they created on resource group level, subscription level, tenant level or any other level.

2. Also, in a multi tenant architecture, do different tenants share the same landing zone ?

Answer 1

There is no single answer to this. I most cases I see, the landing zones are done per Tenant. A Tenant is an Identity boundary so typically you select a separate tenant because you want some level of separation (e.g., a production tenant vs a development tenant). An Azure AD tenant is a specific instance of Azure AD containing accounts and groups.

I don't see many multitenant instances sharing a landing zone but I have seen them share services via Azure Lighthouse. Microsoft Sentinel is a good example of this. The parent org or main IT Security shop will enable Azure Lighthouse so they can have policies that span multiple tenants and they will stand up a "main" instance of Sentinel which is used to do cross-tenant hunting queries.

Answer 2

My experience is that the terminology around tenants and landing zones is not used consistently everywhere. What I have found helpful is to understand the terms and use them like this.

1. At what level landing zones are created? Like are they created on resource group level, subscription level, tenant level or any other level.

A landing zone defines the set up of the environment for a development team. A "one size fits all" landing zone approach doesn't work very well, especially when teams have very different demands of their cloud environments. For example, an team doing IaaS lift & shift may be very happy with a resource group that gives them a subnet (feels like on-premise), whereas a team developing serverless applications wants a subscription of their own. So you should prepare your AAD tenant to host multiple landing zones, segregated by Management Group structure.

2. Also, in a multi tenant architecture, do different tenants share the same landing zone ?

A tenant defines a unit of isolation in a multi-tenant infrastructure. When applied to azure, we should always clarify what kind of a tenant we're talking about. An "AAD Tenant" is a unit of isolation in the global AAD service (all of Microsoft's customers), whereas a "landing zone tenant" is a customer of your landing zone.

From the IaaS lift&shift landing zone example above, your landing zone may be a subscription with a vnet (shared infrastructure). Each of your customers then receives a tenant in that landing zone in the form of a resource group with a subnet. In the serverless landing zone example, the shared infrastructure is the AAD tenant, management group, policies etc.

So in summary, a landing zone always consists of some shared infrastructure that establishes guard rails about how its tenants can use and consume cloud services and a mechanism for provisioning/deprovisioning tenants in that landing zone.