Azure Landing Zone library

Simple example using solely the core Azure Landing Zone library provided by Microsoft.

Description

This is the simplest configuration. Use the core Azure Landing Zone with no additional custom libraries.

Note that we recommend the next example which adds a local custom override library.

Architecture and Archetypes

The architecture name is alz, as defined in the alz.alz_architecture_definition.json.

flowchart TD alz["Azure Landing Zones (root)"] alz --> decommissioned decommissioned["Decommissioned (decommissioned)"] alz --> landingzones landingzones["Landing zones (landing_zones)"] landingzones --> corp corp["Corp (corp)"] landingzones --> online online["Online (online)"] alz --> platform platform["Platform (platform)"] platform --> connectivity connectivity["Connectivity (connectivity)"] platform --> identity identity["Identity (identity)"] platform --> management management["Management (management)"] platform --> security security["Security (security)"] alz --> sandbox sandbox["Sandbox (sandbox)"]

This is the standard set of management groups and their associated archetypes.

Provider block

The path and ref arguments point at a semantic version release of the Microsoft maintained platform/alz library.

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      path = "platform/alz"
      ref  = "2025.09.3"
    }
  ]
}

Refer to the main page of aka.ms/alz/library for up to date release version information.

Metadata

Note that the metadata file for the core Azure Landing Zone library has no dependencies. It is the core and foundational library.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
  "name": "ALZ",
  "display_name": "Azure Landing Zones",
  "description": "This library provides the reference set of Azure Landing Zones (ALZ) policies, archetypes, and management group architecture.",
  "path": "platform/alz"
}

Library

The path and the ref (semantic version) in the provider block form parts of the url to the specific platform and release for the library. For example:

https://github.com/Azure/Azure-Landing-Zones-Library/tree/platform/alz/2025.09.3/platform/alz

The Azure Landing Zones library contains all of the standard assets. The README page has a list of the archetypes, policy definitions, policy assignments and custom RBAC role definitions. This is useful as a reference for your low level design documentation, or a reference when overriding archetypes.

You can get here more naturally by:

aka.ms/alz/library
navigate to platform/alz

By default you will see the information for the most recent release. You can also select a specific release:

click on the main branch drop down
switch to tags
select the release

Note the URL in the address bar.

Architecture file

The alz.alz_architecture_definition.json architecture definition mirrors the mermaid diagram above.

Azure Landing Zones architecture

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/architecture_definition.json",
  "name": "alz",
  "management_groups": [
    {
      "archetypes": [
        "root"
      ],
      "display_name": "Azure Landing Zones",
      "exists": false,
      "id": "alz",
      "parent_id": null
    },
    {
      "archetypes": [
        "platform"
      ],
      "display_name": "Platform",
      "exists": false,
      "id": "platform",
      "parent_id": "alz"
    },
    {
      "archetypes": [
        "landing_zones"
      ],
      "display_name": "Landing zones",
      "exists": false,
      "id": "landingzones",
      "parent_id": "alz"
    },
    {
      "archetypes": [
        "corp"
      ],
      "display_name": "Corp",
      "exists": false,
      "id": "corp",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "online"
      ],
      "display_name": "Online",
      "exists": false,
      "id": "online",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "sandbox"
      ],
      "display_name": "Sandbox",
      "exists": false,
      "id": "sandbox",
      "parent_id": "alz"
    },
    {
      "archetypes": [
        "security"
      ],
      "display_name": "Security",
      "exists": false,
      "id": "security",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "management"
      ],
      "display_name": "Management",
      "exists": false,
      "id": "management",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "connectivity"
      ],
      "display_name": "Connectivity",
      "exists": false,
      "id": "connectivity",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "identity"
      ],
      "display_name": "Identity",
      "exists": false,
      "id": "identity",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "decommissioned"
      ],
      "display_name": "Decommissioned",
      "exists": false,
      "id": "decommissioned",
      "parent_id": "alz"
    }
  ]
}

Default policy values

Default policy values are defined in alz_policy_default_values.json.

Policy Default Values

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/default_policy_values.json",
  "defaults": [
    {
      "default_name": "private_dns_zone_subscription_id",
      "description": "The subscription id that hosts the private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneSubscriptionId"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "private_dns_zone_resource_group_name",
      "description": "The resource group name that hosts the private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneResourceGroupName"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "private_dns_zone_region",
      "description": "The region short name (e.g. `westus`) that should be used for the region specific private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneRegion"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "ama_user_assigned_managed_identity_id",
      "description": "The user assigned managed identity id that should be used for the AMA deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-ChangeTrack"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-Monitoring"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-Monitoring"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    },
    {
      "default_name": "ama_user_assigned_managed_identity_name",
      "description": "The user assigned managed identity name that is used for the deny action policy to prevent the accidental deletion of the AMA identity.",
      "policy_assignments": [
        {
          "parameter_names": [
            "resourceName"
          ],
          "policy_assignment_name": "DenyAction-DeleteUAMIAMA"
        }
      ]
    },
    {
      "default_name": "ama_vm_insights_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the VM Insights deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-Monitoring"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-Monitoring"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-vmHybr-Monitoring"
        }
      ]
    },
    {
      "default_name": "ama_mdfc_sql_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the SQL MDFC deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    },
    {
      "default_name": "ama_change_tracking_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the change tracking deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-ChangeTrack"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-vmArc-ChangeTrack"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
        }
      ]
    },
    {
      "default_name": "ddos_protection_plan_id",
      "description": "The DDoS protection plan id that should be used for the DDoS protection plan deployment. If this is invalid or you do not use DDoS protection, make sure to change the enforcement mode of the Enable-DDoS-VNET policy to 'DoNotEnforce'.",
      "policy_assignments": [
        {
          "parameter_names": [
            "ddosPlan"
          ],
          "policy_assignment_name": "Enable-DDoS-VNET"
        }
      ]
    },
    {
      "default_name": "log_analytics_workspace_id",
      "description": "The Log Analytics workspace id that should be used for centralized log collection.",
      "policy_assignments": [
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-AzActivity-Log"
        },
        {
          "parameter_names": [
            "logAnalyticsWorkspaceId"
          ],
          "policy_assignment_name": "Deploy-AzSqlDb-Auditing"
        },
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-Diag-LogsCat"
        },
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-MDFC-Config-H224"
        },
        {
          "parameter_names": [
            "userWorkspaceResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    }
  ]
}

These value are used for consistency across multiple policy and policy initiatives in the archetypes.