AZ-ADMIN-200: Enterprise Landing Zone with Bicep and azd

This lesson introduces the Microsoft Cloud Adoption Framework (CAF) landing-zone model and the vocabulary you need to reason about "enterprise-grade" Azure environments. You will learn what a landing zone is, how CAF's Strategy/Plan/Ready/Adopt/Govern/Manage phases fit around it, why a management-group hierarchy matters for policy inheritance, and how hub-spoke topology maps onto Platform + Application landing-zone subscriptions. You will also see how the Azure Developer CLI (azd) and Azure Verified Modules (AVM) modernize the landing-zone authoring loop. By the end of this lesson you will be able to explain the CAF conceptual landing-zone architecture to a stakeholder and defend why hub-spoke + policy inheritance + azd-based deploys is the right starting posture for a mid-market Azure footprint.

This lesson teaches the modular decomposition every real landing-zone repository uses. You will learn how to consume Azure Verified Modules (AVM) from the public registry, when to publish your own reusable modules to a private Azure Container Registry (ACR), how to version those modules with semantic tags, and how CAF's abbreviations.json and shared naming/tagging conventions reduce copy-paste across environments. By the end of this lesson you will be able to make the correct build-vs-buy call for any given landing-zone concern, publish and consume private modules from ACR with the br: alias, and set up the naming/tagging plumbing that keeps a growing LZ repository sane.

This lesson teaches the three shared-services concerns every enterprise landing zone must get right: private DNS for private endpoints, an RBAC baseline that scales without ad-hoc user assignments, and a Key Vault architecture that keeps secrets close to workloads without leaking them across boundaries. You will learn the per-PaaS privatelink.* zone catalog, why the centralized-hub private-DNS pattern beats per-spoke zones, the "everyone reads via Entra group, never by direct user assignment" rule, and when a workload deserves its own Key Vault vs sharing one. By the end of this lesson you will be able to design a private-DNS + RBAC + Key Vault architecture for a hub-spoke landing zone and defend the decisions in a code review.

This lesson teaches the two governance layers every enterprise landing zone runs: Azure Policy assignments that deny non-compliant deployments at ARM enforcement time, and PSRule.Rules.Azure checks that catch the same problems earlier in the CI pipeline. You will learn where policy assignments belong in the management-group vs subscription hierarchy, three canonical CAF-baseline policies (deny public IP, require tags, restrict VM SKUs), the "policy vs PSRule vs both" decision framework, and how to gate a Bicep PR on PSRule inside GitHub Actions. By the end of this lesson you will be able to design an LZ policy baseline that catches misconfiguration in CI before it reaches Azure, and defend the choice of which rules belong in each layer.