Microsoft's Cloud Adoption Framework gives you a beautiful diagram of Azure Landing Zones. Neat boxes, clean lines, management groups in perfect hierarchy. What it doesn't tell you is how much pain lies between that diagram and reality.
Here's what I learned implementing landing zones for enterprise workloads.
When leadership says "we need FinOps," what they usually mean is "our cloud bill is too high — make it smaller."
But FinOps isn't about spending less. It's about spending right. Sometimes that means spending MORE — on reserved instances, on better architecture, on tools that prevent waste at scale.
Two of the most powerful governance tools in Azure, and two of the most confused. I've seen teams use RBAC when they need Policy, and Policy when they need RBAC. Here's the clear distinction.
"Should we use AKS or run our own Kubernetes?"
I've had this conversation at least a dozen times. The answer is almost always AKS — but there are legitimate reasons for self-managed. Here's the honest comparison from someone who's run both.
"We follow Zero Trust principles."
I hear this in every security architecture review. But when I ask "show me," the reality is usually a VPN, some network segmentation, and hope.
Zero Trust isn't a product you buy. It's an architecture you build. Here's what it actually looks like when implemented on Azure.
"We're multi-cloud." In most organisations, this really means "we use AWS for some things and Azure for others, and nobody has a unified view of either."
True multi-cloud at enterprise scale is hard. Here's what I learned doing it — and what I'd do differently.