Listen to this Post
Introduction:
Microsoft’s latest update to the Azure Enterprise-Scale Landing Zone (ESLZ) architecture introduces pivotal changes that redefine cloud governance and security. This overhaul provides a clearer separation of duties, enhancing both operational clarity and security posture. For cybersecurity and IT professionals, understanding these structural shifts is critical for implementing a robust, compliant, and resilient cloud environment.
Learning Objectives:
- Understand the architectural separation between Platform and Application Landing Zones and its security benefits.
- Learn to deploy and configure the new dedicated Security subscription and segregated Log Analytics workspaces.
- Master key Azure CLI and PowerShell commands to audit, enforce, and maintain the new landing zone security controls.
You Should Know:
1. Architectural Separation for Enhanced Security
The core update is the logical and physical separation of Platform and Application resources. This isolation is a fundamental security principle, limiting blast radius and providing clear boundaries for access control and policy assignment.
Azure CLI Command to List Subscriptions by Category:
az account list --query "[].{Name:name, Id:id, Tags:tags}" --output table
Step-by-step guide:
This command lists all your Azure subscriptions and their associated tags. In the new ESLZ, subscriptions are tagged (e.g., `platformType = platform` or application). Run this to audit your current estate and identify subscriptions that need to be re-tagged or reconformed to the new model. It is the first step toward understanding your resource distribution.
2. Provisioning the Dedicated Security Subscription
A dedicated Security subscription is now a cornerstone of the architecture, intended to centralize security resources like Microsoft Sentinel, Microsoft Defender for Cloud, and Key Vaults. This prevents conflicts of interest and provides a clean boundary for SecOps teams.
Azure PowerShell Command to Create a New Subscription:
New-AzSubscription -OfferType MS-AZR-0017P -EnrollmentAccountName "<enrollment-account-name>" -Name "ESLZ-Security-Subscription"
Step-by-step guide:
This PowerShell cmdlet creates a new subscription under your Enterprise Agreement (EA). Replace `
3. Configuring Segregated Log Analytics Workspaces
The update mandates separate Log Analytics workspaces for platform and security logs. This separation is crucial for data integrity, cost management, and compliance (e.g., ensuring security audit logs are immutable and tamper-resistant).
Azure CLI Command to Create a New Workspace:
az monitor log-analytics workspace create --resource-group "ESLZ-Security-RG" --workspace-name "Security-Logs-Workspace" --location "eastus" --tags platformType=platform purpose=security
Step-by-step guide:
This command creates a new Log Analytics workspace specifically for security logs within your Security subscription’s resource group. The tags are critical for policy enforcement. Use this workspace to connect all Microsoft Defender for Cloud plans and Sentinel data connectors, ensuring a clean separation from platform operational logs.
4. Enforcing Compliance with Azure Policy
Governance is enforced through Azure Policy definitions and initiatives. The reference implementations include new policies to automatically enforce tags and audit compliance with the separated landing zone design.
Azure CLI Command to Assign a Policy Initiative:
az policy assignment create --name 'Enforce-ESLZ-Tagging' --display-name 'Enforce ESLZ Mandatory Tagging' --scope "/subscriptions/<subscriptionId>" --policy-set-definition "/providers/Microsoft.Authorization/policySetDefinitions/<ESLZ-Initiative-ID>"
Step-by-step guide:
This command assigns a built-in policy initiative to a specific subscription. You must obtain the correct Policy Initiative ID from the ESLZ reference documentation. This assignment will automatically audit or deny the creation of resources without the mandatory `platformType` and `purpose` tags, enforcing the new schema.
5. Implementing Network Security Controls
The platform landing zone houses shared network infrastructure like Azure Firewall, Hub Virtual Networks, and DNS. Application landing zones spoke off this hub, enforcing traffic inspection and filtering through the central firewall.
Azure CLI Command to Peer a Spoke VNet to the Hub:
az network vnet peering create --name "spoke-to-hub-peer" --resource-group "App-LandingZone-RG" --vnet-name "App-VNet" --remote-vnet "/subscriptions/<Hub-Sub-ID>/resourceGroups/<Hub-RG>/providers/Microsoft.Network/virtualNetworks/Hub-VNet" --allow-vnet-access --allow-forwarded-traffic
Step-by-step guide:
This command creates a virtual network peering from an application spoke VNet to the central hub VNet. The `–allow-forwarded-traffic` parameter is essential to allow network traffic to flow through the central hub’s firewall for inspection and logging, a key security control in the hub-and-spoke model.
6. Managing Identity and Access Governance
With the clear separation, Role-Based Access Control (RBAC) can be more precisely scoped. Platform teams get access to the Platform subscription, while application teams are confined to their respective Application subscriptions.
PowerShell Command to Get Role Assignments at Subscription Scope:
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id> | Select-Object DisplayName, RoleDefinitionName, ObjectType
Step-by-step guide:
This PowerShell cmdlet lists all role assignments for a given subscription. Regularly run this audit command on your Platform and Security subscriptions to ensure no overly permissive roles (e.g., Owner, Contributor) are assigned to user accounts outside of your privileged identity management system.
7. Automating Deployment with Bicep/ARM
The entire ESLZ is designed for Infrastructure as Code (IaC) deployment. The reference implementations provide Bicep and ARM templates to automate the provisioning of this entire secure environment.
Bash Command to Deploy the ESLZ Bicep Template:
az deployment sub create --location 'eastus' --template-file './eslz/main.bicep' --parameters './parameters/eslz-parameters.json'
Step-by-step guide:
This command initiates a subscription-level deployment of the main ESLZ Bicep file. You must have the Bicep CLI installed and configured. Before running, meticulously review the parameters file to define your subscription names, network address spaces, and security settings. This automates the creation of a compliant, secure foundation.
What Undercode Say:
- Centralized security logging is non-negotiable for modern threat hunting. The dedicated Security subscription is a monumental shift that prevents adversaries from pivoting to critical security tools if a single application subscription is compromised.
- The Platform/Application separation enforces the principle of least privilege by design. It creates natural boundaries that drastically reduce the attack surface and simplify compliance reporting.
This architectural update moves Azure closer to a true zero-trust network model. By mandating logical separation through subscriptions, Microsoft is forcing a security-first mindset that many organizations previously struggled to implement organically. The built-in policy definitions are the most valuable component, providing guardrails that make it difficult to deploy insecure resources. This is a proactive measure against the rising tide of cloud-based attacks, moving security from a bolt-on to a built-in feature.
Prediction:
The structural and philosophical changes in this landing zone update will become the baseline for all major cloud providers within 24 months. This will significantly raise the floor for cloud security, forcing attackers to develop new TTPs (Tactics, Techniques, and Procedures) that focus on identity compromise and lateral movement within these more constrained environments. Consequently, we predict a sharp increase in attacks targeting Azure AD and privileged access management systems as the network perimeter becomes increasingly obsolete.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Markuslintuala Azure – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
