The reference architectures are sound but heavy. For a mid-sized regulated organisation, the full enterprise-scale pattern is usually more governance than the team can carry. This is the trimmed version we deploy.
Subscription boundaries that mirror the business
Split by environment and by the thing finance wants a number for. If your board asks what a product line costs to run, the subscription design should answer it without a spreadsheet.
Policy as code, from day one
Retrofitting Azure Policy onto a populated estate is miserable. Deploy the guardrails with the landing zone, even if you start permissive and tighten later.