Generate Azure landing zone diagrams from text

What Is an Azure Landing Zone Diagram?

An Azure landing zone is a pre-configured Azure environment that follows the Cloud Adoption Framework (CAF) with governance, networking, identity, and security baked in from day one. Rather than a single flat subscription, it is a modular design meant to scale as you add workloads. The diagram captures how management groups nest under the Tenant Root Group, where subscriptions sit in that hierarchy, which Azure Policies are assigned at each scope, and how hub-spoke VNet topology connects platform services to application workloads. Management groups form the backbone of the hierarchy. The Tenant Root Group sits at the top, and up to six levels of management groups can nest beneath it, though CAF recommends keeping the tree shallow — typically Platform, Workload (often split into Corp and Online), Sandbox, and Decommissioned. Governance flows downward: a policy or role assigned at a parent scope is inherited by every subscription and resource below it, so a deny-public-IP policy placed on the Workload group covers every application subscription at once. The diagram makes this inheritance visible by drawing each group as a nested container, with policy assignments annotated on the scope where they live. CAF treats the subscription as a unit of management, billing, and scale — a model often called subscription democratization. Instead of cramming everything into one subscription and hitting resource limits, each workload team gets its own application landing zone subscription and scales by adding more subscriptions, not by resizing. The design separates platform landing zones — the shared foundation delivered by the Identity, Management, and Connectivity subscriptions (DNS, monitoring, Log Analytics, Entra ID, and hub networking) — from application landing zones, the workload-specific subscriptions that consume those shared services. Rendering that split clearly is one of the hardest parts of a landing zone diagram to draw by hand. Networking usually follows one of two topologies. Traditional hub-spoke centers on a self-managed hub VNet in the Connectivity subscription that hosts Azure Firewall, an ExpressRoute or VPN gateway, and Azure Bastion; spoke VNets peer to the hub and use User Defined Routes to force egress through the firewall. Azure Virtual WAN is the alternative — a Microsoft-managed hub with built-in routing that suits organizations with many branch sites or a global footprint. The generator can draw either: describe a hub VNet and it wires up peering and route tables, or describe a Virtual WAN hub and it lays out the managed topology. Building any of this manually is tedious. You need to represent a tree of management groups (Platform, Workload, Sandbox, Decommissioned), show subscription placement, draw VNet peering between hub and spoke networks, attach Azure Firewall with route tables forcing traffic through the firewall, and annotate Entra ID integration for identity. Diagrams.so automates all of it. Describe your hierarchy in plain English and the AI maps each management group to a container, places subscriptions inside, and draws hub-spoke peering with User Defined Routes pointing to the firewall private IP. The generator distinguishes platform landing zones (shared services like DNS, monitoring, and identity) from application landing zones (workload-specific subscriptions). Governance is expressed through Azure Policy. Individual policies and initiatives (grouped sets of policies) are assigned at management group, subscription, or resource group scope, and their effect — deny, audit, deployIfNotExists, or modify — determines whether a non-compliant resource is blocked, flagged, or auto-remediated. Diagramming these assignments lets reviewers trace which guardrails apply where before anything is deployed. RULE-02 enforces official Azure icons for Azure Firewall, ExpressRoute, Azure Policy, Entra ID, and Azure Monitor. RULE-06 groups resources by management group scope. Opinionated mode enforces the CAF-recommended hierarchy. Architecture warning WARN-04 fires when spoke VNets lack NSGs on their subnets. WARN-02 catches application landing zones exposing public IPs without WAF. WARN-01 flags single-region hub deployments without geo-redundancy. VLM visual validation detects overlapping policy labels on dense hierarchies. The .drawio output opens in Draw.io, VS Code, or Confluence for landing zone design reviews.

Key components

• Management group hierarchy tree from Tenant Root Group through Platform, Workload, Sandbox, and Decommissioned groups
• Subscription placement containers showing each subscription nested under its management group with naming conventions
• Azure Policy assignments at management group scope with initiative labels (e.g., Azure Security Benchmark, CIS)
• Hub VNet with Azure Firewall Premium in AzureFirewallSubnet, ExpressRoute or VPN Gateway in GatewaySubnet, and Azure Bastion
• Spoke VNets peered to hub with User Defined Routes (0.0.0.0/0 next-hop Azure Firewall private IP)
• Entra ID integration showing tenant-level identity with Conditional Access Policies and PIM role assignments
• Platform landing zone separation: Identity, Management, and Connectivity subscriptions as distinct containers
• Architecture warnings for missing NSGs (WARN-04), public endpoints without WAF (WARN-02), and single-region hub (WARN-01)

How to generate with AI

1. 1

   Describe your landing zone hierarchy

   Write your Azure tenant structure in plain English. Be specific about management group names and subscription placement. For example: 'Tenant Root Group at the top. Under it, Platform management group containing three subscriptions: sub-identity (Entra ID Domain Services, Conditional Access), sub-management (Log Analytics workspace, Azure Monitor, Microsoft Defender for Cloud), sub-connectivity (hub VNet 10.0.0.0/16 with Azure Firewall Premium and ExpressRoute to on-premises). Workload management group containing Corp and Online child groups. Corp has sub-app-prod and sub-app-dev. Online has sub-web-prod. Sandbox management group with sub-sandbox-01. Azure Policy: deny public IPs assigned at Workload scope, audit unencrypted storage at Tenant Root Group.'

2. 2

   Select architecture type and Azure provider

   Choose 'Architecture' as the diagram type and 'Azure' as the cloud provider. Diagrams.so loads the official Microsoft Azure Icon Set with icons for management groups, subscriptions, Azure Firewall, ExpressRoute, Entra ID, and Azure Policy. Enable opinionated mode to enforce CAF-aligned hierarchy layout with platform services on the left and application workloads on the right.

3. 3

   Generate and review

   Click generate. The AI produces .drawio XML with a management group tree, subscription containers, hub-spoke network topology with VNet peering arrows, Azure Firewall route tables, and policy assignment annotations. Architecture warnings flag spokes without NSGs (WARN-04), exposed public endpoints (WARN-02), and single-region hubs (WARN-01). VLM visual validation catches overlapping labels. Download as .drawio for editing, or export to PNG or SVG for CAF design review sessions.

Example prompt

Example diagrams from the gallery

Fork

Azure

Azure Landing Zone (Enterprise-Scale)

Azure Landing Zone (Enterprise-Scale) — AZURE architecture diagram. Fork, remix, or download as .drawio on Diagrams.so.

Community

55810

Fork

Azure

USACE Azure IL4 and IL5 Combined Authorization Boundary

USACE Azure IL4 and IL5 Combined Authorization Boundary — AZURE architecture diagram. Fork, remix, or download as .drawio on Diagrams.so.

Community

41204

Fork

Azure

Create An Sap Solution Architecture Diagram In Draw.

Create An Sap Solution Architecture Diagram In Draw. — AZURE architecture diagram. Fork, remix, or download as .drawio on Diagrams.so.

Community

22700

Fork

Azure

Azure RAG Pipeline - Blob to Copilot Studio

Azure RAG Pipeline - Blob to Copilot Studio — AZURE architecture diagram. Fork, remix, or download as .drawio on Diagrams.so.

Community

21705

Azure Landing Zone vs AWS Control Tower vs GCP Organization Hierarchy

Each cloud provider structures multi-account governance differently. Azure uses management groups with Azure Policy. AWS uses Organizations with Service Control Policies and Control Tower guardrails. GCP uses organizations, folders, and Organization Policies. The hierarchy depth, policy inheritance model, and networking differ across all three.

When to use this pattern

Use an Azure landing zone diagram when designing or documenting your Azure tenant governance structure. It's the right choice for CAF adoption workshops, subscription vending strategy reviews, and Azure Policy compliance audits. The diagram shows stakeholders how management groups enforce policy inheritance, where subscriptions live, and how hub-spoke networking routes traffic through Azure Firewall. Concrete scenarios include migrating off a single flat subscription into a CAF-aligned, multi-subscription structure, where the diagram becomes the target-state map the platform team builds toward. It helps during security and compliance reviews — SOC 2, ISO 27001, or an internal audit — by making policy guardrails and network isolation boundaries auditable at a glance. It is valuable when onboarding a new business unit or integrating an acquired company, since each needs its own application landing zone subscriptions placed under the right management group. Reach for it when you are weighing a move from classic hub-spoke to Azure Virtual WAN as your branch count grows, or preparing a design review with a Microsoft FastTrack engineer or CSP partner who expects to see the hierarchy and connectivity model up front. If you only need to document a single application's infrastructure, use an Azure architecture diagram instead. If your focus is purely on VNet connectivity without the governance hierarchy, an Azure networking diagram fits better. Landing zone diagrams are most valuable during initial cloud adoption or when onboarding new business units that need their own subscription structure.

Frequently asked questions

Related diagram generators