Azure landing zone basics: a hub-and-spoke starting point

A hub-and-spoke topology is the most common starting point for Azure networking. A central hub virtual network hosts shared services, and workload spokes peer to it.

What lives in the hub

• Azure Firewall or a network virtual appliance for egress and inspection
• VPN or ExpressRoute gateways for on-premises connectivity
• Shared DNS and Azure Bastion for administrative access

What lives in the spokes

Each spoke holds one workload or environment, such as a production application or a dev/test subscription. Spokes peer to the hub but not directly to each other, which keeps traffic paths predictable and auditable.

Starting small

Decision	Good default
Address space	Plan non-overlapping ranges up front, with room to grow
Subscriptions	One per workload or environment
Routing	User-defined routes sending egress through the hub firewall
Policy	Azure Policy assigned at a management group, not per subscription

Create the network skeleton

az group create --name rg-hub-eus --location eastus
az network vnet create \
  --resource-group rg-hub-eus \
  --name vnet-hub-eus \
  --address-prefixes 10.0.0.0/22 \
  --subnet-name AzureFirewallSubnet \
  --subnet-prefixes 10.0.0.0/26

Treat this as a skeleton: define naming, tagging and policy before the first production workload lands, because they are far harder to retrofit later.