Azure Landing Zone

digraph azlz {
  rankdir=TB;
  graph [bgcolor=transparent];
  node [shape=box, style="rounded,filled", fontname=Inter, fontsize=10];

  Root [label="Tenant Root Group", fillcolor="#fce7f3"];
  Platform [label="Platform MG", fillcolor="#fef3c7"];
  Mgmt [label="Management subscription", fillcolor="#dbeafe"];
  Conn [label="Connectivity\n(hub VNet, ExpressRoute, firewall)", fillcolor="#dbeafe"];
  Identity [label="Identity\n(AD DS, MS Entra)", fillcolor="#dbeafe"];

  Landing [label="Landing Zones MG", fillcolor="#fef3c7"];
  Corp [label="Corp subscriptions\n(internal apps)", fillcolor="#dcfce7"];
  Online [label="Online subscriptions\n(internet-facing apps)", fillcolor="#dcfce7"];

  Decom [label="Decommissioned MG"];
  Sbx [label="Sandbox MG"];

  Root -> Platform;
  Platform -> Mgmt; Platform -> Conn; Platform -> Identity;
  Root -> Landing;
  Landing -> Corp; Landing -> Online;
  Root -> Decom; Root -> Sbx;
}