Gruntwork's Azure Landing Zone and Azure Landing Zones (ALZ) both stand up a governed, multi-subscription Azure foundation. ALZ is Microsoft's conceptual architecture plus a set of accelerators, ready-made deployment options that stand up the platform landing zone through the Azure portal or as Bicep or Terraform code. Gruntwork takes the best practices behind ALZ and combines them with IaC best practices and opinionated defaults, delivered as OpenTofu/Terraform code you own. The result is quick to onboard, fast to value, scalable, and maintainable.
What each one is
Azure Landing Zones (ALZ) is Microsoft's standardized, recommended approach for managing your Azure environment at scale, defined in the Cloud Adoption Framework. It consists of one platform landing zone that provides shared services such as identity, connectivity, and management, and one or more application landing zones for workloads. The conceptual, or reference, architecture is an opinionated target you use as a starting point and tailor, covering the management group hierarchy, identity, network topology, security, governance, and platform automation. Microsoft ships accelerators to deploy it: a portal accelerator with a graphical interface for organizations that lack IaC expertise, and the Azure Landing Zones IaC Accelerator, which deploys and manages the platform landing zone using Bicep or Terraform based on Azure Verified Modules (AVM), with continuous delivery through Azure DevOps or GitHub.
Gruntwork's Azure Landing Zone is an opinionated landing zone delivered as OpenTofu/Terraform code you own. It stands up management groups, Microsoft Entra ID and Azure RBAC, network foundations, and Azure Policy guardrails, with code-driven subscription vending and a GitOps workflow run by Gruntwork Pipelines, Drift Detection, and Patcher. Gruntwork takes the best practices from ALZ and combines them with IaC best practices and Gruntwork's opinionated defaults.
Gruntwork and Azure Landing Zones at a glance
| Capability | Gruntwork Azure Landing Zone | Azure Landing Zones (ALZ) |
|---|---|---|
| What it is | An opinionated Azure landing zone delivered as OpenTofu/Terraform code you own | Microsoft's conceptual architecture plus accelerators for the platform landing zone |
| IaC options | OpenTofu/Terraform | Bicep or Terraform, based on Azure Verified Modules (AVM); a portal option is also available |
| Deployment workflow | PR-driven GitOps with Gruntwork Pipelines: plans run on pull requests, applies run on merge, inside your own GitHub or GitLab runners | Azure portal accelerator, or the IaC Accelerator with continuous delivery through Azure DevOps or GitHub |
| Opinionated defaults | Gruntwork defaults layered on ALZ best practices | Microsoft reference architecture and Azure Verified Modules |
| Day-2 operations | Drift Detection opens a PR when live Azure infrastructure drifts from code; Patcher raises PRs to keep modules up to date | Managed through the accelerator's Bicep/Terraform pipelines |
How Gruntwork builds on ALZ's best practices
Gruntwork is an alternative to ALZ: you use one or the other to stand up your Azure landing zone. At the same time, the best practices behind ALZ carry straight into Gruntwork's landing zone. The management group hierarchy, the connectivity and identity design, and the Azure Policy guardrails that ALZ recommends are the same practices Gruntwork encodes. On top of that, Gruntwork adds IaC best practices and opinionated defaults so the landing zone is quick to onboard and fast to reach production. Microsoft's IaC Accelerator uses Bicep or Terraform on Azure Verified Modules with Azure DevOps or GitHub continuous delivery. Gruntwork delivers its landing zone as OpenTofu/Terraform you own, wired into a ready-made GitOps platform: Gruntwork Pipelines for plan-on-PR and apply-on-merge, Drift Detection that opens remediation PRs, and Patcher for versioned module updates. The published Azure Landing Zone is positioned to cut time to production by 60%.
When to use each
Azure Landing Zones (ALZ)
Use ALZ directly when you want Microsoft's reference architecture deployed with the portal accelerator or with the IaC Accelerator on Bicep or Terraform, staying inside Azure DevOps or GitHub, for Azure alone.
Gruntwork
Use Gruntwork when you want ALZ best practices with opinionated defaults, delivered as OpenTofu/Terraform code you own and run through a GitOps platform with drift remediation and patching, with hands-on onboarding and migration support.
What is Azure Landing Zones (ALZ)?
ALZ is Microsoft's standardized, recommended approach for managing your Azure environment at scale, defined in the Cloud Adoption Framework. It combines a conceptual reference architecture with accelerators, Microsoft's ready-made deployment options that stand up the platform landing zone: a portal accelerator with a graphical interface, and the Azure Landing Zones IaC Accelerator, which deploys it as Bicep or Terraform code.
Is Gruntwork a replacement for ALZ?
Yes. Gruntwork's Azure Landing Zone is an alternative way to deploy an Azure landing zone: instead of using Microsoft's accelerators, Gruntwork stands it up as OpenTofu/Terraform code you own. It takes the best practices behind ALZ and combines them with IaC best practices and Gruntwork's opinionated defaults.
Does ALZ support Terraform, or only Bicep?
Both. The Azure Landing Zones IaC Accelerator deploys and manages the platform landing zone using Bicep or Terraform based on Azure Verified Modules (AVM), and a portal-based option is available for teams without IaC expertise.
