Miller Thomson's Azure management group hierarchy implements a four-layer governance model spanning Tenant Root, Core Layer (mt-root with policy anchors), Distribution Layer (platform and landing zone segments), and Access Layer subscriptions. Traffic flows from the Entra ID tenant through mt-root policies controlling allowed locations and resource tagging, then branches into mt-platform services (identity, management, connectivity with Azure Firewall hub) and mt-landingzones workload zones (corporate, online, AVD) segmented by VLAN-style management groups. This architecture demonstrates enterprise-scale Azure governance with clear separation of concerns: platform services handle shared infrastructure while landing zones isolate workload subscriptions, with sandbox and decommissioned scopes for testing and lifecycle management. Fork this diagram to customize your own organization's management group structure, policy inheritance, and subscription allocation strategy. The three-segment distribution (DMZ/Platform, LAN/Landing Zones, WAN/Edge) mirrors traditional network design for familiar governance patterns across hybrid and cloud workloads.