Yes, you are right Application landing zone will have a subscription with separate vnet and will have only application workload, it can be PaaS Or IaaS Similarly for platform landing zone we will have identity, connectivity and management subscription Which can be one Or different for large enterprises and is also recommended by MS

thanks, you can reach me at sourabh.chhabra777@gmail.com

@@techonlogic Linked in?

Make one video on azure arc

Landing zone is nothing but ur infrastructure at large with all the standard recommendations from MS. So if we talk about security for landing zone, complete security of ur infra comes into picture U can review ur security in security center To configure security for landing zone you need to secure at different level in azure infra, like azure firewall, NSG+ASG, WaF at app gateway and front door. Also all security best practices for vm, web app , db, at vm level and at infra level, eg. Ip whitlisting Use private endpoint for azure to azure traffic n all

@@techonlogic so we need to get to each ALZ component and suggest related security control will this approach good or we have some better approach??

@@vipuldabhi6971 if you want to go deep into best security practice n architecture and the client is mature enough, you can implement azure policies during foundation build and Azure Blueprint U can work on Management Group and implement policies so that you have basic security policies applied to all the subscription inside the Management group

@@techonlogic please share me the approach for policy governance for security control on azure landing zone

@@techonlogic basic security policy can we leverage Azure security benchmark?? On management group?? To assess the security of azure landing zone??

@@sopankumbhare222 hi You can reach out to me at my email id: sourabh.chhabra777@gmail.com