The management group hierarchy, the subscriptions inside it, and the naming and tagging decisions that are nearly free on day one and painful to change later. Deploy the whole shape at once, and keep management groups for inheritance, never for workloads.
The reproducible pre-deployment audit: subscriptions, address space, connectivity, access, Secure Score baseline, and the on-premises DNS forwarder check that saves you from the hardest problem to diagnose after go-live.
Every sub-2k organization arrives at a landing zone from one of three starting points, and which one you are in decides what to build first, what to leave alone, and what to be afraid of.
A landing zone is not a thing you deploy. It is the set of decisions you make before any workload exists, and here is the right-sized version of them for an organization under about two thousand dollars a month in Azure.
The operations surface in practice: install an extension, wire monitoring with the Azure Monitor Agent, run a PowerShell script on a machine from Azure, open a session with no inbound port, and set the local blocklist that lets a server refuse all of it.
The cloud end has no honeytoken test, so it is proven differently: standing checks that the surface is populated, the telemetry is flowing, and the risk exchange is compounding, run once to certify and again each quarter.
The cloud half of Defender for Identity lights up on licensing, with no workspace, no connection, and no switch. The discipline is not standing it up, it is knowing what is automatic, what you still connect, and how you confirm a surface you never had to build.
The capstone: Arc is not a replacement for the domain but the management plane that lets a server outlive its dependence on one. How to sort a fleet between the two, and where the larger shrinking-AD story goes next.
