Basic clarification on "corp" vs "online" and landing zone terminology

Architekt 80 Reputation points
2023-03-02T22:07:15.6033333+00:00

So I'm looking at this incredibly complex diagram from the landing zone documentation page located here: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/

Under "Landing zones" they have "SAP", "Corp", and "Online." I don't get what "Corp" and "Online" are supposed to imply. Is "Corp" where you would deploy subscriptions and resources for applications that are used only internally or are not supposed to interface with the public aka internet? If so, does that mean that when I go to launch a product, that I would place it in the "Online" management group? That diagram is overwhelming and the sub-sections don't really help explain use-cases well. Anyway, a simple clarification on what "corp" and "online" are intended for would be welcome, and if I'm wrong that a released to the world product belongs in "online" then could someone please elucidate me as to which management group would make the most sense for it? Thanks!

Community Center | Not monitored
0 comments
Answer accepted by question author
JimmySalian-2011 45,896 Reputation points Volunteer Moderator
2023-03-02T22:55:52.1366667+00:00

Hi Architekt,

It is clearly defined in the section management group, basically deep down the links it list the specific info and what you can deploy under each Landing zones - https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups.

For many organization, the default Corp and Online management groups provide an ideal starting point

User's image

Also there is a Bicep File for this deployment and you can review - https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/managementGroups/managementGroups.bicep

Hope this helps.

JS

==

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rajesh Swarnkar 1,256 Reputation points
    2026-08-21T05:58:35.64+00:00

    Basically the Microsoft document is too vague. The reason they state is because of the nature and requirement related to those zone could differ based on industry and business requirements. I dont buy the argument. The docs could be improved.

    --

    There are two approaches for the implementing the DMZ in cloud :

    1. Centralized approach
    2. Distributed approach

    In centralized approach you implement two sets of the firewalls - One for East-West and other for North-South traffic. The North-south traffic centralizes all the Online related application hosting for across all enterprise. Something outlined in this blog. (You cant find this anywhere on docs) :

    https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/designing-cloud-landing-zones-by-traffic-flow-a-defence%E2%80%91in%E2%80%91depth-dmz%E2%80%91first-archi/4524280

    In the distributed approach, you implement N-number of Online Spoke Vnets and place them in separate subscriptions than the Corp spokes. Then use application delivery services per spoke as onlined in these articles:

    https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall

    https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery

    However, I do not find any places in docs which explains and weighs the implication of the distributed approach has on the operational aspect such as managing the WAF rules, FW rules, NSG rules, 2N Peerings, routing.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.