Landing Zone Architecture
for AI Workloads

graph TB
    ROOT["Tenant Root Group"]
    ROOT --> PLATFORM["Platform"]
    ROOT --> LANDING["Landing Zones"]
    ROOT --> SANDBOX["Sandbox"]
    ROOT --> DECOM["Decommissioned"]
    PLATFORM --> MGMT["Management<br/>Log Analytics, Automation<br/>Defender for Cloud"]
    PLATFORM --> CONN["Connectivity<br/>Hub VNet, Firewall<br/>DNS, ExpressRoute"]
    PLATFORM --> ID["Identity<br/>Entra ID, Domain Ctrlrs<br/>Conditional Access"]
    LANDING --> CORP["Corp (Connected)<br/>VNet-peered workloads"]
    LANDING --> ONLINE["Online (Internet)<br/>Public-facing apps"]
    LANDING --> AI["AI & ML<br/>AI Workloads"]
    AI --> AIPROD["AI-Prod<br/>Production AI services"]
    AI --> AIDEV["AI-NonProd<br/>Dev/Test AI services"]
    CORP --> CORPSUB["App Subscriptions"]
    SANDBOX --> SBX["Sandbox Subs<br/>No connectivity"]
    style AI fill:#0d6efd,color:#fff,stroke:#0d6efd
    style AIPROD fill:#198754,color:#fff
    style AIDEV fill:#ffc107,color:#000
    style PLATFORM fill:#6c757d,color:#fff
    style CONN fill:#0dcaf0,color:#000
              

graph TB
    subgraph MGMT_SUB["Management Subscription"]
        LAW["Log Analytics<br/>Workspace"]
        AUTO["Automation<br/>Account"]
        DEF["Defender for<br/>Cloud"]
    end
    subgraph CONN_SUB["Connectivity Subscription"]
        subgraph HubVNet["Hub VNet 10.0.0.0/16"]
            FW["Azure Firewall<br/>Premium"]
            BASTION["Azure Bastion"]
            GW["VPN / ER<br/>Gateway"]
            DNS_RES["DNS Private<br/>Resolver"]
        end
        DNS_ZONES["Private DNS<br/>Zones (8+)"]
    end
    subgraph AI_SUB["AI Landing Zone Subscription"]
        subgraph AIVNet["AI Spoke VNet 10.10.0.0/16"]
            subgraph AI_SVC["AI Services Subnet /24"]
                AOAI["Azure OpenAI"]
                AIS["AI Search"]
                AML["Azure ML"]
            end
            subgraph COMPUTE["Compute Subnet /20"]
                AKS["AKS / App Svc"]
                DBX["Databricks<br/>VNet-injected"]
            end
            subgraph DATA_SUB["Data Subnet /24"]
                ADLS["ADLS Gen2<br/>(x multiple)"]
                ACR["Container<br/>Registry"]
            end
            subgraph PE_SUB["PE Subnet /24"]
                PE["Private<br/>Endpoints (6-12)"]
            end
        end
        KV["Key Vault"]
        AI_MON["App Insights"]
    end
    GW -->|"ExpressRoute /<br/>VPN"| OnPrem["On-Premises"]
    HubVNet -->|"VNet Peering"| AIVNet
    PE --> AOAI
    PE --> AIS
    PE --> AML
    PE --> ADLS
    AI_SVC --> FW
    COMPUTE --> FW
    AI_MON --> LAW
    DEF --> AI_SUB
    DNS_ZONES --> PE_SUB
              

graph TD
    START["Start: New AI Workload"] --> Q1{"Need private<br/>network isolation?"}
    Q1 -->|"No"| Q2{"Production or<br/>PoC / internal?"}
    Q2 -->|"PoC"| P5["Pattern 5<br/>Serverless AI<br/>Online LZ / Sandbox"]
    Q2 -->|"Production"| Q3{"Multiple teams<br/>sharing AI?"}
    Q1 -->|"Yes"| Q4{"Zero Trust /<br/>regulated data?"}
    Q4 -->|"Yes"| P6["Pattern 6<br/>Secure Private AI<br/>Corp LZ"]
    Q4 -->|"No"| Q5{"Data-intensive<br/>with Databricks?"}
    Q5 -->|"Yes"| Q6{"Full ML lifecycle<br/>needed?"}
    Q6 -->|"Yes"| P4["Pattern 4<br/>AI Factory / MLOps<br/>Dedicated AI LZ"]
    Q6 -->|"No"| P7["Pattern 7<br/>Data-Centric Lakehouse<br/>Dedicated AI LZ"]
    Q5 -->|"No"| Q3
    Q3 -->|"Yes"| Q7{"Teams need<br/>full isolation?"}
    Q7 -->|"Yes"| P2["Pattern 2<br/>Decentralized Spoke<br/>App LZ per team"]
    Q7 -->|"No"| Q8{"Teams need own<br/>search / RAG?"}
    Q8 -->|"Yes"| P3["Pattern 3<br/>Hybrid Central-Spoke<br/>Platform + App LZ"]
    Q8 -->|"No"| P1["Pattern 1<br/>Centralized Hub<br/>Platform LZ"]
    Q3 -->|"No"| P1
    style P1 fill:#0d6efd,color:#fff
    style P2 fill:#0dcaf0,color:#000
    style P3 fill:#198754,color:#fff
    style P4 fill:#6f42c1,color:#fff
    style P5 fill:#fd7e14,color:#fff
    style P6 fill:#dc3545,color:#fff
    style P7 fill:#20c997,color:#fff