Introduction
A Swedish fintech startup operating in a regulated environment needed to establish a secure, compliant cloud foundation on Azure from day one. Rather than incrementally addressing security and governance concerns later, the company chose to invest early in a well-structured cloud platform that clearly separates shared platform responsibilities from application workloads.
The result is a production-ready Azure Landing Zone built with Terragrunt and Azure Verified Modules. Networking, DNS, security, and governance are centrally defined at the platform level and automatically inherited by all workloads, enabling teams to deploy applications quickly without compromising security or compliance.
About the Client
The client is a technology-driven fintech company based in Sweden, operating in a highly regulated domain where auditability, reliability, and strong security controls are mandatory.
Their cloud journey started from a blank slate. The primary goal was to establish a scalable Azure foundation that would allow rapid workload deployment while enforcing secure defaults and consistent governance across environments.
Requirements
From the outset, the client defined a clear set of platform requirements:
- Clear separation between platform infrastructure and workload infrastructure
- Centralized ownership of networking, DNS, and security controls
- Mandatory private connectivity for all PaaS services with automated DNS resolution
- Strict network-level isolation between development and production environments
- Fully auditable, reproducible infrastructure defined as code
Solution Overview
The ITGix Azure Landing Zone is implemented using a three-tier Terragrunt architecture:
- Tenant layer
Manages the management group hierarchy, Azure Policy definitions and assignments, and custom RBAC role definitions. - Platform layer
Provides shared services such as hub networking (Virtual WAN, Azure Firewall, Private DNS Resolver), centralized DNS, container registry, monitoring, and CI/CD agent infrastructure. - Landing zone layer
Provisions per-subscription, per-environment workload infrastructure, including VNets, Key Vaults, Storage Accounts, and Backup Vaults, using a reusable service catalog.
Each layer is deployed using independent Terraform states with explicit dependencies managed by Terragrunt. This approach minimizes blast radius, enables independent upgrades, and provides clear ownership boundaries.
The core design principle is separation of concerns. Platform teams define how traffic flows, how DNS resolves, and which security policies apply. Workloads simply consume a preconfigured, compliant environment.
Architecture
The architecture aligns with the official Azure Landing Zone conceptual model and extends it with opinionated automation:
- Management Groups establish governance and policy inheritance boundaries
- Dedicated Subscriptions isolate platform services from application workloads
- Virtual WAN hub-and-spoke topology centralizes routing, inspection, and DNS resolution
- Azure Policy automates private endpoint DNS integration for PaaS services
Platform Layer
The platform layer forms the foundation that application teams never need to manage directly. It owns connectivity, DNS, security enforcement, and shared services.
Virtual WAN with Secured Hub
The connectivity model is based on Azure Virtual WAN with a secured virtual hub deployed in Sweden Central. All traffic-both internet-bound and inter-spoke-is routed through Azure Firewall using routing intent. Spoke VNets have no implicit trust or connectivity between them, and all traffic is inspected and logged for audit purposes.
The hub includes Azure Firewall with DNS proxy enabled, a Private DNS Resolver, centralized Private DNS Zones for core PaaS services, and a Point-to-Site VPN for secure administrative access.
Private DNS with Policy-Driven Automation
Private endpoint DNS management is fully automated using Azure Policy. All Private DNS Zones are hosted in the connectivity hub, and a platform-wide DeployIfNotExists policy ensures that any new private endpoint is automatically associated with the correct DNS zone.
As a result, when workloads deploy PaaS resources with private endpoints, DNS records are created automatically and resolved through the centralized DNS path. Workload teams do not manage DNS at any level.
CI/CD
Self-hosted CI/CD agents are deployed as Azure Container Apps in the management subscription. Agents scale from zero based on pipeline demand, eliminating idle compute costs. Authentication is handled using User-Assigned Managed Identity integrated with Azure DevOps.
Container images are pulled from a private Azure Container Registry over private endpoint connectivity. Network boundaries are enforced at the firewall level, ensuring each agent pool can access only its intended target environments.
Centralized Monitoring
Azure Monitor and Log Analytics provide centralized telemetry collection across all subscriptions. A dedicated Log Analytics Workspace serves as the single ingestion point, with Microsoft Sentinel layered on top for security analytics and threat detection.
Diagnostic settings are standardized and enforced by the platform, ensuring logs and metrics are available by default without per-workload configuration. Azure Managed Grafana is used for visualization and operational dashboards.
Workload Layer
The workload layer is intentionally minimal and opinionated. It consumes platform capabilities without redefining them.
What a Workload Receives
Each workload environment is provisioned with:
- A VNet pre-connected to the Virtual WAN hub with centralized DNS configuration
- Budget alerts with configurable thresholds and notification channels
- Predefined resource groups for network and managed resources
- User-Assigned Managed Identities for workload authentication
All configuration is defined in a single values.yaml file per environment.
What a Workload Does Not Manage
- DNS configuration
- Firewall rules and segmentation
- Hub connectivity
- Monitoring and diagnostic settings
This allows application teams to focus exclusively on compute, data, and application configuration.
Security and Governance
Security and governance are enforced centrally and inherited by all workloads.
Azure Policy
Policy enforcement is applied through the management group hierarchy. The baseline includes:
- Automated private DNS zone group deployment for core PaaS services
- Subscription-level tagging policies
- Custom RBAC role definitions aligned with least-privilege principles
- Kubernetes security controls enforced through Gatekeeper policies
Identity and Access Management
- Centralized identity using Microsoft Entra ID with MFA and Conditional Access
- Role-Based Access Control with custom roles
- Privileged Identity Management for just-in-time administrative access
- Microsoft Defender for Cloud for continuous security posture management
- Azure Key Vault with private endpoints and deny-by-default network access
Infrastructure as Code
The entire landing zone is defined using Terragrunt and Terraform with a catalog-based structure. Shared configuration is defined once and reused across components, while environment-specific values are provided through YAML files.
Each component maintains its own Terraform state, enabling isolated changes, predictable rollouts, and independent lifecycle management.
Business Outcomes
Platform and Workload Separation by Design
A clear separation of responsibilities between platform and application teams enabled faster development cycles and reduced operational overhead. Application teams can now focus entirely on building and deploying features, while platform capabilities are centrally managed and consistently enforced.
Zero-Configuration Networking and DNS
Automated private DNS management eliminated the need for workload-level networking configuration. Every private endpoint is resolved automatically through policy-driven automation, ensuring consistency, reducing human error, and accelerating onboarding of new services.
Strong and Consistent Environment Isolation
Development and production environments are fully isolated at the network level, with enforced traffic control through centralized routing and firewall policies. This provides predictable security boundaries and reduces the risk of cross-environment impact.
Efficient and Scalable CI/CD Operations
CI/CD pipelines are built on scale-to-zero self-hosted agents, ensuring compute resources are only used when needed. This design significantly improves cost efficiency while maintaining secure, isolated build and deployment environments.
Auditable and Policy-Driven Governance
All governance controls-including policies, RBAC, and security baselines-are defined as code and fully versioned. This provides complete auditability and ensures compliance requirements are consistently enforced across all environments.
Secure-By-Default Cloud Foundation
The platform enforces secure defaults across all workloads, including private endpoints, least-privilege access patterns, and centralized identity management. Security is embedded at the platform level rather than delegated to individual teams, reducing risk and ensuring consistency at scale.
Final Thoughts
The ITGix Azure Landing Zone provides more than a technical baseline-it delivers a proven, secure cloud foundation that enables teams to move faster without compromising governance or compliance. By centralizing decisions around networking, DNS, security, and access control, the platform removes complexity from application teams while ensuring consistent standards across all workloads.
Built on Terragrunt, Azure Verified Modules, and policy-driven automation, the ITGix Azure Landing Zone scales with the organization as it grows. Security, compliance, and operational best practices are embedded by default, allowing new environments and workloads to be onboarded quickly and safely.
With this foundation in place, the client is well positioned to accelerate product development, meet regulatory requirements, and scale confidently on Azure-supported by a landing zone designed for long-term success and operational efficiency.
Expole more of our case studies.