Skip to content

Azure Tenant Setup for SaaS Startup

Documentation Phase — This repository contains comprehensive guidance for setting up a greenfield Azure tenant for a SaaS startup. Code implementation will follow in a separate phase.

Table of Contents

  1. Context
  2. Architecture Overview
  3. Documentation Structure
  4. Framework References
  5. Quick Start
  6. Key Design Decisions
  7. Contributing

Context

Attribute Value
Scenario Greenfield Azure tenant for SaaS startup
Billing New tenant under existing EA enrollment
Connectivity Cloud-only (no on-premises/hybrid)
Product Type Multi-region SaaS application
Deployment Multi-region (active-active or active-passive)
Compliance SOC 2 Type II, ISO 27001
IaC Tooling Terraform
CI/CD Pipeline GitHub Actions
Accelerator Azure Landing Zones Terraform Module
Date January 2026

Architecture Overview

graph TB
    subgraph "Azure Tenant"
        subgraph "Management Groups"
            TR[Tenant Root Group]
            CR[Company Root]

            TR --> CR

            subgraph "Platform"
                PL[Platform MG]
                ID[Identity]
                MG[Management]
                CN[Connectivity]

                CR --> PL
                PL --> ID
                PL --> MG
                PL --> CN
            end

            subgraph "Workloads"
                LZ[Landing Zones MG]
                PROD[Production]
                NPROD[Non-Production]

                CR --> LZ
                LZ --> PROD
                LZ --> NPROD
            end

            SB[Sandbox]
            DC[Decommissioned]

            CR --> SB
            CR --> DC
        end
    end

    style TR fill:#e1f5fe
    style CR fill:#b3e5fc
    style PL fill:#81d4fa
    style LZ fill:#4fc3f7

Documentation Structure

This documentation is organized into the following sections:

Platform Landing Zones

Document Description
01 - Identity Landing Zone Microsoft Entra ID configuration, PIM, Conditional Access, break-glass accounts
02 - Management Landing Zone Log Analytics, Defender for Cloud, Azure Monitor, Azure Policy, Cost Management
03 - Connectivity Landing Zone Multi-region networking, DNS, DDoS protection, Private Endpoints, Front Door

Organization & Governance

Document Description
04 - EA & Subscription Architecture EA enrollment, management group hierarchy, subscription vending, tagging
05 - Terraform Implementation Guide ALZ module configuration, remote state, multi-region structure
06 - GitHub Actions CI/CD Repository structure, OIDC authentication, workflows, secrets management

Application Teams

Document Description
07 - Application Landing Zone Template Subscription vending, baseline modules, naming conventions, network security
08 - Compliance Baseline SOC 2 / ISO 27001 control mappings, evidence collection, data residency

Implementation Planning

Document Description
09 - Day 1 / Day 2 Prioritization MVP requirements, hardening phases, rollout checklist

Framework References

Quick Start

  1. Review the architecture — Start with 04 - EA & Subscription Architecture to understand the management group hierarchy
  2. Understand identity requirements — Review 01 - Identity Landing Zone for Entra ID setup
  3. Plan the implementation — Use 09 - Day 1 / Day 2 Prioritization for phased rollout
  4. Set up CI/CD — Follow 06 - GitHub Actions CI/CD for pipeline configuration

Key Design Decisions

Decision Choice Rationale
IaC Tool Terraform Team familiarity, multi-cloud capability, strong Azure provider
CI/CD Platform GitHub Actions Native integration, OIDC support, cost-effective for startups
Authentication Workload Identity Federation (OIDC) No secrets to manage, automatic token rotation
Network Topology Hub-spoke per region Simplified for cloud-only, cost-optimized
Firewall NSG-based (Day 1) → Azure Firewall (Day 2) Cost optimization for startup scale
Global Load Balancer Azure Front Door Built-in WAF, global presence, simplified management

Contributing

This documentation is maintained by the platform team. For questions or suggestions:

  1. Open an issue in this repository
  2. Submit a pull request with proposed changes
  3. Contact the platform team via Teams

Next Steps: Begin with 01 - Identity Landing Zone or jump to 09 - Day 1 / Day 2 Prioritization for implementation planning.