Design solutions that align with security best practices and priorities · Topic 3 of 4
Cloud Adoption Framework, Well-Architected and Landing Zones
SC-100 governance: Cloud Adoption Framework stages, the Well-Architected security pillar, Azure landing zones, management groups and Azure Policy.
- 4 min
- CAF stages: Strategy, Plan, Ready, Adopt, Govern, Secure, Manage. CAF is organization level. WAF is workload level.
- WAF pillars: Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency.
- Landing zones use management groups, with platform (identity, management, connectivity) and landing zone (corp, online) groups.
What it is
Two Microsoft frameworks guide how an organization adopts and runs Azure safely.
- The Cloud Adoption Framework for Azure (CAF) is about the organization: the strategy, plans, environment, governance and security that surround cloud use.
- The Azure Well-Architected Framework (WAF) is about each workload: how to design it well across five pillars.
Azure landing zones turn both into a working, governed Azure environment that new workloads can be placed into.
How it works
Cloud Adoption Framework
CAF is organized around adoption stages and cross cutting disciplines.
| Stage | Purpose |
|---|---|
| Strategy | Define motivations and business outcomes |
| Plan | Align people, assets and skills, and plan the adoption |
| Ready | Prepare the environment, with landing zones |
| Adopt | Migrate and modernize or build new workloads |
| Govern | Set policies and controls for cost, security, compliance and resources |
| Secure | Protect against threats across the life cycle, using Zero Trust and defense in depth |
| Manage | Operate with monitoring, resilience and operations |
The Secure methodology covers security strategy, access, security operations, asset protection, security governance and innovation security, including DevSecOps. The Govern methodology uses policy and a governance benchmark to find gaps.
Azure Well-Architected Framework
The WAF has five pillars:
- Reliability
- Security
- Cost Optimization
- Operational Excellence
- Performance Efficiency
The Security pillar gives design principles: plan security readiness, design to protect confidentiality, design to protect integrity, design to protect availability, and sustain and evolve the security posture. It also calls out tradeoffs: stronger security can cost more, slow performance or add operational work, so the architect documents the decision. The Azure Well-Architected Review assessment scores a workload against the pillars and gives recommendations, and Azure Advisor and Defender for Cloud supply related recommendations. Workload guides cover specific services.
Azure landing zones
A landing zone is a prepared Azure environment with identity, networking, governance and security already in place, so application teams can deploy without redesigning controls each time.
The Azure landing zone conceptual architecture uses a management group hierarchy:
| Management group | Contents |
|---|---|
| Platform | Subscriptions for identity, management (logging, monitoring, automation) and connectivity (hub networking, firewalls, DNS) |
| Landing zones | Application subscriptions, often split into corp (private, connected to on premises) and online (internet facing) |
| Sandbox | Experimentation with limited access |
| Decommissioned | Subscriptions awaiting deletion |
Security and governance are applied once, at the top, and inherited:
- Azure Policy assignments and initiatives at management group scope, with effects such as Audit, Deny and DeployIfNotExists or Modify (for example, deploy diagnostic settings, require private endpoints, block public IPs).
- Azure RBAC at management group, subscription and resource group scope, with the platform team owning shared services.
- Microsoft Defender for Cloud plans enabled by policy, and logs sent to a central Log Analytics workspace feeding Microsoft Sentinel.
- A hub and spoke or Virtual WAN network with central firewall inspection.
- Subscription vending so teams get new subscriptions that already conform.
Microsoft provides Azure landing zone accelerators and reference implementations (Bicep and Terraform) to deploy this structure and policy set.
Securing and governing with CAF and WAF together
| Decision | Source |
|---|---|
| Which management group and subscription structure to use | CAF landing zone design |
| Which policies are mandatory for all workloads | CAF Govern with Azure Policy |
| How should this workload handle secrets and network access | WAF Security pillar |
| How to measure drift | Defender for Cloud and Azure Policy compliance |
A worked scenario
A company is moving hundreds of workloads to Azure and wants consistent security. The architect uses CAF Ready and Govern to design a landing zone: platform subscriptions for identity, management and connectivity, a corp management group for private workloads, and policies that deny public IPs on corp, require diagnostic settings and enforce allowed regions. Each workload team then runs a Well-Architected Review, with the Security pillar findings tracked as backlog items.
What to remember for the exam
- CAF stages: Strategy, Plan, Ready, Adopt, Govern, Secure, Manage. CAF is organization level. WAF is workload level.
- WAF pillars: Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency.
- Landing zones use management groups, with platform (identity, management, connectivity) and landing zone (corp, online) groups.
- Governance is applied with Azure Policy and RBAC at management group scope, inherited by subscriptions.
- Policy effects: Audit, Deny, DeployIfNotExists, Modify.
"Apply the same security requirements to every new subscription automatically" means Azure Policy at a management group, plus subscription vending in a landing zone.
How the exam asks about this
- "Assess one workload against best practices." Well-Architected Review.
- "Define the organization's cloud governance and security approach." Cloud Adoption Framework Govern and Secure.
- "Block public IP addresses for all private application subscriptions." A Deny policy at the corp management group.
- "Centralize logs from all subscriptions." A management subscription with a central Log Analytics workspace and Sentinel.
Common mistakes
Confusing CAF and WAF. One is organization wide, the other is per workload.
Applying policy per subscription. Use management groups so it scales.
Treating security as free. WAF expects documented tradeoffs.
Skipping the platform subscriptions. Shared identity, logging and connectivity belong there.
Check yourself
Which framework scores a single workload across five pillars?
The Azure Well-Architected Framework.
Which landing zone management group holds identity, management and connectivity subscriptions?
Platform.
Which Azure Policy effect adds a missing configuration such as a diagnostic setting?
DeployIfNotExists.
Topic 3 of 4 in Design solutions that align with security best practices and priorities
Test yourself on Design solutions that align with security best practices and priorities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.