An Azure landing zone costs nothing to license: the reference architecture and the accelerator that deploys it are free, and Microsoft ships the Bicep and Terraform implementations as open source. What costs money is what the landing zone switches on, the shared platform services, which at Microsoft’s published pay-as-you-go rates run from roughly $900 a month for a minimal hub with Azure Firewall Standard to $4,000 or more once DDoS protection, log ingestion at volume, and Defender coverage are added, plus the one-time engineering effort to design and deploy it, which is driven by subscription count, identity model, connectivity, and policy depth rather than by any list price.
This guide separates the three numbers a landing zone budget actually contains, prices the platform services from Microsoft’s published rates, and names the design decisions that move the engineering cost. It is written for the infrastructure or platform lead who has to put a landing zone line into a cloud budget, the same programs our Azure development services practice delivers.
Is the Azure Landing Zone Itself Free?
Yes. An Azure landing zone is Microsoft’s reference architecture for an enterprise-ready Azure environment: the management group hierarchy, policy set, identity and network topology, and subscription layout described in the Cloud Adoption Framework. The architecture, the accelerator portal experience, and the Bicep and Terraform modules cost nothing to use. Azure Policy assignments, management groups, and role-based access control, the governance skeleton of the whole design, are also free platform features. Anyone quoting you a license fee for a landing zone is quoting you something else.
The budget starts when the design instantiates services that carry meters, and almost all of that spend concentrates in the connectivity and management subscriptions, the hub of the hub-and-spoke design.
What Do the Platform Services Cost Per Month?
Prices below are Microsoft’s published pay-as-you-go rates for the East US region as of July 2026, monthly figures derived at 730 hours; regional prices vary and reservations discount them, so verify against Azure pricing for your region before budgeting.
| Platform service (typical landing zone hub) | Published rate | Approximate monthly |
|---|---|---|
| Azure Firewall Standard | $1.25 per deployment hour plus $0.016 per GB processed | About $913 plus data |
| Azure Firewall Basic | $0.395 per deployment hour plus $0.065 per GB processed | About $288 plus data |
| Azure DDoS Network Protection | $4.03 per hour per plan | About $2,944 |
| Log Analytics ingestion | $2.30 per GB, pay-as-you-go | Volume-driven |
| Log Analytics retention beyond included | $0.10 per GB per month | Volume-driven |
| Microsoft Defender for Servers Plan 2 | $0.02 per server hour | About $15 per server |
Two of these deserve a decision rather than a default. DDoS Network Protection covers protected resources across the subscription for one plan fee, so it prices sensibly for an estate with many public IPs and poorly for a small footprint, which is exactly why Azure also offers per-IP protection. And log ingestion is the sleeper: at $2.30 per GB, a platform that ships every diagnostic log to a central workspace can generate a monitoring bill that rivals the firewall, so the landing zone’s log-routing design is a cost decision disguised as a plumbing decision.
What Drives the Deployment Cost?
The engineering effort to stand up a landing zone is set by decisions, not by resource counts. The ones that move the number:
- Subscription and management group design. A greenfield single-business-unit layout is days of design; a multi-entity enterprise with segregated workloads, shared services, and chargeback requirements is weeks.
- Identity model. Wiring Azure into an existing Entra ID tenant with clean role design is the base case. Hybrid identity, cross-tenant collaboration, and privileged access redesign each add real work.
- Connectivity. A VPN-connected hub is the low end; ExpressRoute circuits, multi-region hubs, and firewall rule migration from an existing datacenter perimeter are the high end.
- Policy and compliance depth. Applying the default policy baseline is nearly free; mapping policies to a named framework such as NIST 800-171 or FedRAMP, with evidence and exceptions governance, is a compliance project riding inside the platform project.
- Brownfield remediation. The most underestimated line. Moving existing subscriptions under new management groups and policies surfaces every non-compliant resource those subscriptions contain, and someone has to disposition each one.
For defense contractors and other regulated organizations deploying into Azure Government rather than commercial Azure, the same architecture applies with a different service catalog and a compliance overlay; our Azure Government migration page covers that path, and the broader estate work sits with our system integration practice. For CMMC-driven deployments, the compliance program itself is priced in our CMMC compliance cost guide.
Two platform features are worth deploying on day one precisely because they are free: Azure Budgets with alert thresholds on every subscription, and a tagging policy that makes spend attributable to an owner from the first resource. A landing zone that ships without cost attribution guarantees a painful archaeology project later, when finance asks whose workloads the hub is carrying, and retrofitting tags across a grown estate costs far more than enforcing them by policy from the start.
If these decisions are queued up and undecided on your program, a costed design session settles most of them in one pass. Schedule a 30-minute scoping call with a senior Azure engineer.
Where Do Landing Zone Budgets Go Wrong?
Three patterns account for most of the surprises. First, treating the platform services as fixed overhead instead of tiered choices: Firewall Basic versus Standard versus Premium is a threefold price spread, and the right answer depends on inspection requirements, not habit. Second, deferring the log-routing design until after go-live, then discovering the ingestion bill scales with every workload that lands. Third, skipping the brownfield inventory, so the “two-week deployment” inherits an open-ended remediation queue. All three are avoidable with a costed design before anything deploys, which is precisely what a landing zone engagement should produce.
How i3solutions Deploys Azure Landing Zones
i3solutions is a Microsoft Solutions Partner, and i3solutions has completed more than 600 Microsoft platform implementations. i3 plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers, and we treat the landing zone as the governance foundation those migrations land on: design first with the platform services costed per month at published rates, deploy from the open-source modules rather than hand-built portals, and hand over policy, logging, and cost-management documentation your operations team can run without us. Organizations that need to add senior capability to an in-flight cloud program can hire Azure developers from us directly, and our Microsoft consulting services page describes the wider practice.
If you want your landing zone design costed before it deploys, Schedule a 30-minute scoping call and bring your subscription inventory.
Frequently Asked Questions
How much does an Azure landing zone cost to run per month?
At Microsoft’s published East US pay-as-you-go rates, a minimal hub running Azure Firewall Standard starts around $913 a month plus data processing, and a fuller build adds DDoS Network Protection at about $2,944 a month, Defender for Servers at about $15 per server, and Log Analytics ingestion at $2.30 per GB. The spread between a lean hub and a fully instrumented one is several thousand dollars a month, all of it decided by design choices.
Is the Azure landing zone accelerator free?
Yes. The accelerator, the reference architecture, and the Bicep and Terraform implementation modules are free, and the governance primitives they configure, management groups, Azure Policy, and role-based access control, carry no charge. You pay for the metered services the design deploys, chiefly firewall, DDoS protection, logging, and security tooling in the hub.
What is the biggest hidden cost in a landing zone?
Log ingestion. Centralizing diagnostics is core to the design, but at $2.30 per GB a chatty estate can push the monitoring workspace past the firewall as the largest platform line. Deciding per log category what goes to the analytics tier, what goes to cheaper storage, and what is simply not collected is the control, and it belongs in the design phase.
Can we skip Azure Firewall or DDoS Protection to save money?
Sometimes, and it should be a documented risk decision rather than an omission. Small footprints with few public endpoints may reasonably choose Firewall Basic or per-IP DDoS protection, both materially cheaper. What does not work is skipping the decision: an estate that grows into public exposure without a protection plan pays for the incident instead of the meter.
How long does an Azure landing zone take to deploy?
The deployment itself is fast; the accelerator can stand up the architecture in days. The calendar time goes to design and remediation: subscription layout, identity, connectivity, and policy mapping typically take a few weeks of focused work, and brownfield estates add remediation time proportional to how much existing infrastructure must be brought under the new governance.
How does i3solutions approach a landing zone engagement?
Design before deployment, with costs attached: we produce the management group and subscription design, the policy baseline mapped to your compliance requirements, and a per-month platform cost model at published rates, then deploy from the open-source modules and transfer the operational knowledge. The deliverable is an environment your team can govern and a bill your finance team saw coming.
