Azure landing zone and FinOps re-platforming

This is a pattern we would propose, not an engagement we have delivered. It describes the shape of a re-platforming we would recommend for an estate that grew organically.

The situation this pattern addresses

Years of organic growth tend to produce the same estate: a single flat subscription, no tagging discipline, and a cloud bill nobody can explain to the board. Security tooling is usually present and usually unread, because its alerts go to a shared mailbox rather than a named person.

How we would rebuild it

A hub-and-spoke landing zone with subscription boundaries that mirror how the business actually thinks about cost, so that when the board asks what a product line costs to run, the subscription design answers it without a spreadsheet. Everything deployed from Bicep or Terraform, so the environment can be rebuilt rather than archaeologically maintained.

• Entra ID as the single identity plane, with privileged access reviewed
• Azure Policy deployed with the landing zone — permissive at first, tightened on a schedule
• Tagging enforced at deploy time, because retrofitting tags to a populated estate is miserable
• Sentinel configured so every alert has a named owner, not a distribution list

What good looks like

A monthly cost report that maps to product lines and needs no manual reconciliation, budgets that alert before they surprise anyone, and an estate a new engineer can understand from the Bicep rather than from tribal knowledge.

Where this gets hard

Migration sequencing on a live estate is the entire risk. The landing zone design is largely a known quantity; moving production workloads into it without an outage window nobody will grant you is the part that needs care. The tagging retrofit is the unglamorous majority of the effort and is routinely underestimated.