A large enterprise is setting up a new Azure tenant to host hundreds of workloads across regulated and non-regulated business units. They need centralized identity, management, and networking, standardized guardrails, and clear separation between platform services and application subscriptions. What should you implement?

The Cloud Adoption Framework (CAF) Enterprise-Scale Landing Zone architecture directly addresses the requirements for centralized identity, management, networking, standardized guardrails, and separation. It uses a management group hierarchy to organize subscriptions (e.g., Platform for shared services like Identity, Management, Connectivity; and Landing Zones for applications), Azure Policy for consistent governance and guardrails, and dedicated subscriptions for platform services and application workloads, ensuring clear separation. Using a single subscription for all workloads lacks the necessary separation and scalability for a large enterprise with regulated and non-regulated units. Creating separate Azure AD tenants for dev/test/prod introduces unnecessary complexity for identity management and doesn't align with centralized management goals. Granting Owner access to application teams without a foundational platform leads to unmanaged sprawl and security risks. Relying on deprecated Azure Blueprints is not a viable long-term solution.