Cloud Transformation

Azure Hub-and-Spoke Landing Zone

A Microsoft Entra tenant with management groups and policy, one hub network, and application subscriptions as spokes in two regions.

The landing zone from NGT's Azure service offering, laid out as the Cloud Adoption Framework describes it: a Microsoft Entra tenant with management groups and Azure Policy, a connectivity subscription with the hub virtual network, platform subscriptions for management and identity, and application subscriptions as spokes in more than one region.

ExpressRoutepeeringglobal peeringreplicateOn premisesMicrosoft AzureMicrosoft Entra tenant · management groupsConnectivity subscriptionHub virtual networkManagement subscriptionIdentity subscriptionRegion 1 · application subscriptionsSpoke virtual networkRegion 2 · recoverySpoke virtual networkOn-premises systemsMicrosoft Entra IDManagement groupsAzure PolicyAzure landing zoneLog Analyticsglobal monitoringDefender for CloudCost ManagementExpressRouteAzure FirewallAzure DNSprivate zonesAzure MonitorEntra DomainServicesAKSprivate clusterAzure App ServiceAzure SQL ManagedInstanceAzure Site RecoveryAKSstandbyAzure Backup

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

When to use it

  • Before the first workload moves to Azure
  • Several application teams that need their own subscriptions
  • Rules on regions, encryption or public access that must hold everywhere

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

Cloud Transformation