Enterprise landing zone for Contoso with hierarchical management groups, hub-and-spoke network topology, and production workloads across compute, storage, and data services. Traffic flows from Application Gateway through spoke VNet to App Service Plan and Azure Functions, with centralized monitoring via Log Analytics and Key Vault managing secrets. This architecture demonstrates Azure best practices for governance, security, and scalability in multi-subscription environments. Fork and customize this diagram on Diagrams.so to adapt the management group structure, add additional spokes, or modify firewall rules for your organization. The design supports auto-scaling workloads while maintaining compliance through centralized identity, connectivity, and monitoring controls.