Sovereign Landing Zone

Simple example for deploying the standard Sovereign Landing Zone.

Description

The Sovereign Landing Zone (SLZ) is stacked on top of the core Azure Landing Zone (ALZ) library, and includes additional management groups and sovereign policy initiatives. Both libraries are maintained and provided by Microsoft.

Note that we recommend the next example which adds a local custom override library.

Architecture and Archetypes

The architecture name is slz - as defined in the slz.alz_architecture_definition.json - and has the extended set of architectures needed for Sovereign Landing Zone.

flowchart TD slz["Sovereign Landing Zone (root, sovereign_root)"] slz --> decommissioned decommissioned["Decommissioned (decommissioned)"] slz --> landingzones landingzones["Landing zones (landing_zones)"] landingzones --> confidential_corp confidential_corp["Confidential Corp (confidential_corp)"] landingzones --> confidential_online confidential_online["Confidential Online (confidential_online)"] landingzones --> corp corp["Corp (corp)"] landingzones --> online online["Online (online)"] landingzones --> public public["Public (public)"] slz --> platform platform["Platform (platform)"] platform --> connectivity connectivity["Connectivity (connectivity)"] platform --> identity identity["Identity (identity)"] platform --> management management["Management (management)"] platform --> security security["Security (security)"] slz --> sandbox sandbox["Sandbox (sandbox)"]

Note:

the additional management groups (and corresponding archetypes) under landing_zones for
- confidential_corp
- confidential_online
- public
the additional sovereign_root archetype at the top

Provider block

As per the Azure Landing Zone example, the path and ref arguments point at a semantic version release of the Microsoft maintained platform/slz library.

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      path = "platform/slz"
      ref  = "2025.10.1"
    }
  ]
}

Refer to the main page of aka.ms/alz/library for up to date release version information.

Metadata

Remember that the Sovereign Landing Zone library is stacked on top of the Azure Landing Zone library.

The metadata file for the Sovereign Landing Zone library shows the dependency on the Azure Landing Zone library. The SLZ and ALZ releases are kept (and tested) in lockstep.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
  "name": "SLZ",
  "display_name": "Sovereign Landing Zone",
  "description": "This library provides the reference set of Sovereign Landing Zone (SLZ) policies, archetypes, and management group architecture.",
  "path": "platform/slz",
  "dependencies": [
    {
      "path": "platform/alz",
      "ref": "2025.09.3"
    }
  ]
}

Library

The path and the ref (semantic version) in the provider block form parts of the url to the specific platform and release for the library. For example:

https://github.com/Azure/Azure-Landing-Zones-Library/tree/platform/slz/2025.10.1/platform/slz

The Sovereign Landing Zones library contains the additional assets. The README page has a list of the archetypes, policy definitions, policy assignments and custom RBAC role definitions. This is useful as a reference for your low level design documentation, or a reference when overriding archetypes. Usefully it is a superset of both the Sovereign Landing Zone and Azure Landing Zone repos.

You can get here more naturally by:

aka.ms/alz/library
navigate to platform/slz

By default you will see the information for the most recent release. You can also select a specific release:

click on the main branch drop down
switch to tags
select the release

Note the URL in the address bar.

Architecture file

The slz.alz_architecture_definition.json architecture definition mirrors the mermaid diagram above.

Sovereign Landing Zones architecture

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/architecture_definition.json",
  "name": "slz",
  "management_groups": [
    {
      "archetypes": [
        "root",
        "sovereign_root"
      ],
      "display_name": "Sovereign Landing Zone",
      "exists": false,
      "id": "slz",
      "parent_id": null
    },
    {
      "archetypes": [
        "platform"
      ],
      "display_name": "Platform",
      "exists": false,
      "id": "platform",
      "parent_id": "slz"
    },
    {
      "archetypes": [
        "landing_zones"
      ],
      "display_name": "Landing zones",
      "exists": false,
      "id": "landingzones",
      "parent_id": "slz"
    },
    {
      "archetypes": [
        "public"
      ],
      "display_name": "Public",
      "exists": false,
      "id": "public",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "corp"
      ],
      "display_name": "Corp",
      "exists": false,
      "id": "corp",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "online"
      ],
      "display_name": "Online",
      "exists": false,
      "id": "online",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "confidential_corp"
      ],
      "display_name": "Confidential Corp",
      "exists": false,
      "id": "confidential_corp",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "confidential_online"
      ],
      "display_name": "Confidential Online",
      "exists": false,
      "id": "confidential_online",
      "parent_id": "landingzones"
    },
    {
      "archetypes": [
        "sandbox"
      ],
      "display_name": "Sandbox",
      "exists": false,
      "id": "sandbox",
      "parent_id": "slz"
    },
    {
      "archetypes": [
        "security"
      ],
      "display_name": "Security",
      "exists": false,
      "id": "security",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "management"
      ],
      "display_name": "Management",
      "exists": false,
      "id": "management",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "connectivity"
      ],
      "display_name": "Connectivity",
      "exists": false,
      "id": "connectivity",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "identity"
      ],
      "display_name": "Identity",
      "exists": false,
      "id": "identity",
      "parent_id": "platform"
    },
    {
      "archetypes": [
        "decommissioned"
      ],
      "display_name": "Decommissioned",
      "exists": false,
      "id": "decommissioned",
      "parent_id": "slz"
    }
  ]
}

The architecture files are uniquely identified and standalone. When you specify slz as the architecture_name then it matches against slz.alz_architecture_definition.json. If your module still specified alz then it would still match up against the alz.alz_architecture_definition.json in the underlying Azure Landing Zone library.

Default policy values

Default policy values are defined in alz_policy_default_values.json.

SLZ Policy Default Values

These value are used for consistency across multiple policy and policy initiatives in the archetypes.

Note that you would need to check the same alz_policy_default_values.json file for the underlying Azure Landing Zone library.

ALZ Policy Default Values

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/default_policy_values.json",
  "defaults": [
    {
      "default_name": "private_dns_zone_subscription_id",
      "description": "The subscription id that hosts the private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneSubscriptionId"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "private_dns_zone_resource_group_name",
      "description": "The resource group name that hosts the private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneResourceGroupName"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "private_dns_zone_region",
      "description": "The region short name (e.g. `westus`) that should be used for the region specific private link DNS zones.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dnsZoneRegion"
          ],
          "policy_assignment_name": "Deploy-Private-DNS-Zones"
        }
      ]
    },
    {
      "default_name": "ama_user_assigned_managed_identity_id",
      "description": "The user assigned managed identity id that should be used for the AMA deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-ChangeTrack"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-Monitoring"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-Monitoring"
        },
        {
          "parameter_names": [
            "userAssignedIdentityResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    },
    {
      "default_name": "ama_user_assigned_managed_identity_name",
      "description": "The user assigned managed identity name that is used for the deny action policy to prevent the accidental deletion of the AMA identity.",
      "policy_assignments": [
        {
          "parameter_names": [
            "resourceName"
          ],
          "policy_assignment_name": "DenyAction-DeleteUAMIAMA"
        }
      ]
    },
    {
      "default_name": "ama_vm_insights_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the VM Insights deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-Monitoring"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-Monitoring"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-vmHybr-Monitoring"
        }
      ]
    },
    {
      "default_name": "ama_mdfc_sql_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the SQL MDFC deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    },
    {
      "default_name": "ama_change_tracking_data_collection_rule_id",
      "description": "The data collection rule id that should be used for the change tracking deployment.",
      "policy_assignments": [
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VM-ChangeTrack"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-vmArc-ChangeTrack"
        },
        {
          "parameter_names": [
            "dcrResourceId"
          ],
          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
        }
      ]
    },
    {
      "default_name": "ddos_protection_plan_id",
      "description": "The DDoS protection plan id that should be used for the DDoS protection plan deployment. If this is invalid or you do not use DDoS protection, make sure to change the enforcement mode of the Enable-DDoS-VNET policy to 'DoNotEnforce'.",
      "policy_assignments": [
        {
          "parameter_names": [
            "ddosPlan"
          ],
          "policy_assignment_name": "Enable-DDoS-VNET"
        }
      ]
    },
    {
      "default_name": "log_analytics_workspace_id",
      "description": "The Log Analytics workspace id that should be used for centralized log collection.",
      "policy_assignments": [
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-AzActivity-Log"
        },
        {
          "parameter_names": [
            "logAnalyticsWorkspaceId"
          ],
          "policy_assignment_name": "Deploy-AzSqlDb-Auditing"
        },
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-Diag-LogsCat"
        },
        {
          "parameter_names": [
            "logAnalytics"
          ],
          "policy_assignment_name": "Deploy-MDFC-Config-H224"
        },
        {
          "parameter_names": [
            "userWorkspaceResourceId"
          ],
          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
        }
      ]
    }
  ]
}