landing-zone-resource-group

Type: decision

Decision

Platform-managed landing zone resources live in a single resource group, protected by an Azure Deployment Stack.

Why

A shared resource group blends platform and application resources. No clean boundary exists for teardown, RBAC, or incident management when both share the same scope.

Links

• landing-zone-identity — Managed identity is provisioned inside this resource group and managed by Azure Deployment Stack.
• declarative-resource-lifecycle — Resource group is the Deployment Stack scope — deleteAll tears down every platform-managed resource in one operation.
• landing-zone-monitoring — Log Analytics workspace lives inside this resource group and managed by Azure Deployment Stack.
• landing-zone-vnet — VNet is provisioned inside this resource group and managed by platform Deployment Stack
• landing-zone-automation — Container Apps environment and jobs are provisioned inside this resource group and managed by Azure Deployment Stack

← Back to all decisions