landing-zone-automation

Type: decision

Decision

Automation runs inside each landing zone's own subscription.

Why

Without isolation, all landing zones would share a runtime the platform has no subscription to host.

Violations

• Automation job running from a resource outside the landing zone subscription.

Links

• platform-identity-graph — Automation jobs need to query Entra ID — Graph read permissions are what make that possible.

← Back to knowledge graph