The reference architecture is comprehensive and implementing all of it before your first workload is a good way to spend six months delivering nothing.
Microsoft's landing zone guidance is genuinely good and genuinely large. Teams read it end to end, scope a foundation programme, and surface half a year later with an immaculate platform and no applications on it. Meanwhile a delivery team has quietly built production in a subscription nobody governs.
Build these before the first workload
- Management group hierarchy and subscription topology — expensive to change once resources exist
- Identity and RBAC model, including how pipelines authenticate; retrofitting workload identity is painful
- Network topology and address space planning — overlapping ranges are a multi-year regret
- Diagnostic and log routing to a central workspace, on from day one so you have history when you need it
- A small set of enforced policies: allowed regions, mandatory tags, no public storage
These can wait
- Comprehensive policy coverage — start with a handful that matter and grow with evidence
- Elaborate cost allocation before you have meaningful spend to allocate
- Multi-region everything, when you do not yet have a single-region service anyone depends on
- Full automation of subscription vending while you are still creating one a quarter
The sequencing principle
Build what is expensive to retrofit. Defer what is cheap to add later. Address space, identity and management group structure are foundations; most of the rest is furniture, and furniture can be moved once you know how people use the room.