Network in Azure Landing Zone

Question

Network in Azure Landing Zone

Ed7 96

Hello,

We are building Azure landing zones based on CAF, and I would like to understand how feasible it is to separate the sandbox connectivity to not go to the hub but all traffic to go via firewall! Our worry is that sandbox connected to the hub could be prone for accidental connectivity to other services. I am not sure we should be connecting the sandbox to the hubs at all.

And separeted prod and non prod in a different vwan not in the same.

Based on landing zones experience what have people done in the past? what would you recommend? Are there any best practices/blogs that explain this well?

0 comments

1 answer

Your answer

Answer 1

Hello @Ed7

This is a common concern when designing enterprise Azure Landing Zones. In most implementations, the sandbox is still connected to the hub (or Virtual WAN hub), but it's isolated through routing, network security, and Azure Firewall policies, rather than by completely disconnecting it.

A few recommendations that align with the Cloud Adoption Framework (CAF):

Keep sandbox subscriptions/workloads in their own management group and spoke VNet.
Force all north-south and east-west traffic through Azure Firewall using User-Defined Routes (UDRs) or Virtual WAN routing intent where applicable.
Deny lateral connectivity by default and explicitly allow only the services required for development and testing.
Use Network Security Groups (NSGs) and Azure Firewall Policy to prevent accidental access to production or shared services.
If your organization has strong isolation requirements (for example, regulatory or security boundaries), separate Virtual WAN hubs for Production and Non-Production is a common enterprise pattern. It provides independent routing, security policies, and operational boundaries, although it increases cost and management overhead.

In practice, most enterprises don't isolate a sandbox by removing hub connectivity altogether—they isolate it by implementing strong policy and routing controls. Disconnecting the hub often makes centralized services such as DNS, monitoring, identity, and outbound security inspection more difficult to manage.

Microsoft provides good guidance in these references:

Azure Cloud Adoption Framework – Enterprise-scale Landing Zones: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/
Azure Virtual WAN architecture guidance: https://learn.microsoft.com/azure/virtual-wan/
Enterprise-scale networking topology and connectivity: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-topology

Out of curiosity, are you using Azure Virtual WAN secured hubs or a traditional hub-and-spoke architecture with Azure Firewall? The recommendation differs slightly depending on the connectivity model.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.