Built on: Azure AI Landing Zones by Microsoft
This repository provides a platform team implementation of the Azure AI Landing Zone (AILZ), demonstrating how organizations can extend and customize the upstream AILZ for their specific enterprise requirements.
The Azure AI Landing Zone is Microsoft's enterprise-scale, production-ready reference architecture for deploying secure and resilient AI Apps & Agents solutions in Azure. It:
- Provides an application landing zone foundation for various AI use cases and scenarios
- Is based on Azure Verified Modules (AVM) for Bicep and Terraform
- Aligns with Cloud Adoption Framework AI Scenario
- Follows Well-Architected Framework for AI workloads
- Can be deployed with or without platform landing zones
✅ Secure by default - Private endpoints, managed identities, network isolation
✅ Production-ready - Monitoring, logging, backup, disaster recovery
✅ Extensible - Deploy with or without platform landing zones
✅ Multi-scenario - Chat, Agents, RAG, Document generation, and more
✅ IaC-based - Portal, Bicep, and Terraform implementations
For complete details, see the upstream documentation.
This repository provides example implementations showing how platform teams can customize the Azure AI Landing Zone. It demonstrates:
- Referencing upstream AILZ as a baseline
- Adding corporate standards (naming, tagging, policies, resources)
- Customizing wrappers for specific requirements
- Publishing versioned modules for workload teams
These are reference implementations - adapt the patterns to fit your organization's needs.
/bicep/ # Pristine upstream AILZ (fetched from Microsoft repo)
/platform/infra/my-company/ # Your platform team's customizations
├── main.bicep # Corporate standards & additional resources
├── wrappers/ # Custom wrapper overrides (optional)
└── common/types.bicep # Extended type definitions
/.github/workflows/ # CI/CD pipelines for publishing modules
Two example approaches for publishing your customizations:
Publishes a single Template Spec that workload teams consume.
Features:
- Single Template Spec artifact
- No Azure Container Registry needed
- One GitHub Actions workflow
- Simpler access control (Template Spec RG only)
- Custom wrappers automatically overlayed during build
📖 Full Guide: DEPLOYMENT-FLOW-TEMPLATESPEC.md
Publishes layered modules to Azure Container Registry.
Features:
- Separate base AILZ and platform layer modules
- More composable architecture
- Multiple platform teams can publish independently
- Workload teams can mix and match modules
📖 Full Guide: DEPLOYMENT-FLOW.md
- Azure subscription with Contributor access
- Azure CLI installed
- Bicep CLI installed
- GitHub repository with OIDC federation configured (for CI/CD)
# Fork this repository to your organization
# Via GitHub UI: Click "Fork" button, or via CLI:
gh repo fork <this-repo> --org your-org --clone
cd ailz-platform# Rename "my-company" folder to your company name
mv platform/infra/my-company platform/infra/your-company
# Update all references from "my-company" to "your-company"
# in workflows, docs, and bicep files# Add Microsoft's AILZ as upstream remote
git remote add ailz-upstream https://github.com/Azure/AI-Landing-Zones.git
git fetch ailz-upstream
# Pull latest bicep folder
git checkout ailz-upstream/main -- bicep/
git commit -m "Update to AILZ version X.Y.Z"Set these in Settings > Secrets and variables > Actions:
| Secret | Description |
|---|---|
AZURE_CLIENT_ID |
Service principal client ID (OIDC) |
AZURE_TENANT_ID |
Azure tenant ID |
AZURE_SUBSCRIPTION_ID |
Target subscription ID |
AZURE_LOCATION |
Azure region (e.g., eastus2) |
AZURE_RESOURCE_GROUP |
Main resource group name |
AZURE_TS_RG |
Template Spec resource group |
AZURE_CONTAINER_REGISTRY_NAME |
ACR name (ACR approach only) |
cd bicep
# Set environment variables
export AZURE_LOCATION="eastus2"
export AZURE_RESOURCE_GROUP="rg-platform-test"
export AZURE_TS_RG="rg-platform-templatespecs"
# Run preprovision script
./scripts/preprovision.sh
# Verify deploy folder created
ls -la deploy/Push changes to trigger the workflow:
git add .
git commit -m "Configure platform for your-company"
git pushThe AILZ foundation supports various AI scenarios:
- Chat Applications using Azure AI Foundry
- AI Agents with tool calling and orchestration
- RAG (Retrieval-Augmented Generation) with vector search
- Document Generation and processing
- Conversational Knowledge Mining
- Custom Copilots for domain-specific tasks
See the upstream use cases documentation for details.
This implementation follows:
- Cloud Adoption Framework AI Scenario
- Well-Architected Framework for AI
- Azure Verified Modules standards
These are reference implementations showing example patterns for customizing AILZ. Feel free to:
- Fork and adapt for your organization
- Share improvements via pull requests
- Open issues for questions or bugs
For contributing to the upstream AILZ, see Azure/AI-Landing-Zones.
- Upstream Repository: Azure/AI-Landing-Zones
- AILZ Documentation: aka.ms/ailz
- CAF AI Scenario: aka.ms/caf/ai
- WAF AI Workload: aka.ms/waf/ai
- Azure Verified Modules: aka.ms/avm
This project uses the same license as the upstream Azure AI Landing Zones.
This project may contain trademarks or logos for projects, products, or services. Use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines.