Nobody publishes this, which is why buyers ask three vendors and get quotes an order of magnitude apart with no way to tell which is serious. We would rather you walked into that conversation informed, even when it costs us the easy sale. Here are the bands we see in the market, what moves a quote up or down, and the questions that expose whether a proposal is scoped or guessed.
First, separate build cost from run cost
Two completely different numbers get called 'the cost of a landing zone'. The build is a one-off engineering project: management group hierarchy, subscription vending, networking, identity, policy baseline, logging and the infrastructure-as-code to reproduce all of it. The run is what Azure invoices you every month afterwards for the platform's own components.
The run cost surprises people more often, because it exists even before a single workload lands. Firewalls, private DNS resolvers, bastion hosts, log ingestion and retention, and any ExpressRoute or VPN circuits are all charged whether or not anything is deployed on top. A minimal platform footprint typically runs a few hundred dollars a month; a hub-and-spoke topology with a managed firewall, full diagnostic logging and long retention runs into the low thousands before workloads. Get an estimate for this in writing during design, not after.
The build: three honest bands
These are engineering-effort bands, quoted as senior engineer-days, because that is what actually varies. Convert at whatever rate your market bears and you will land close to the quotes you receive from firms that scope properly.
- Starter, roughly 15 to 25 engineer-days: a single-region, hub-and-spoke or even flat topology, a handful of subscriptions, Entra ID with sensible defaults, a starter policy set in audit mode, centralised logging, and Terraform or Bicep covering all of it. Appropriate for one product team and a greenfield estate.
- Standard enterprise, roughly 40 to 70 engineer-days: management group hierarchy with environment separation, subscription vending automation, hub-and-spoke with a firewall and private endpoints, policy baseline enforced rather than audited, privileged identity management, a landing-zone pipeline, and documentation the client's own team can operate from.
- Regulated or multi-region, roughly 90 to 150-plus engineer-days: two or more regions with tested failover, control mapping to a named framework, evidence collection for audit, network segmentation defensible to a security review, customer-managed keys, and often a migration factory for the existing estate.
The seven things that actually move the number
- 01Connectivity model. Flat virtual networks are cheap; hub-and-spoke with a managed firewall, forced tunnelling and private endpoints everywhere is where a third of the effort goes on enterprise builds.
- 02Identity starting point. A clean Entra tenant is straightforward. A tenant with fifteen years of history, on-premises synchronisation, guest sprawl and legacy service principals is a project in itself.
- 03Compliance obligations. 'Follow good practice' and 'produce evidence mapped to a named control framework' differ by weeks, mostly in documentation and evidence automation rather than configuration.
- 04Subscription count and vending. Ten subscriptions created by hand is an afternoon. Automated vending with cost tags, budgets, policy inheritance and a request workflow is a fortnight — and it is the difference between a platform and a one-time setup.
- 05Whether migration is in scope. Building an empty landing zone is a fraction of the cost of moving live workloads into it. If a quote seems low, check which one it covers.
- 06Infrastructure-as-code maturity. If the client has no IaC practice, someone has to establish module structure, state management, CI validation and release conventions before the landing zone itself can be written well.
- 07Who operates it afterwards. A build handed to a team that has never run a platform needs enablement, runbooks and a support period. A build handed to an existing platform team needs a walkthrough.
What is usually excluded, and should be named
- Migration of existing workloads, which is almost always a separate programme
- Application-level changes needed to work with private endpoints or managed identity
- Ongoing operations, on-call and patching after handover
- Third-party licences: firewall appliances, monitoring platforms, CNAPP tooling
- The Azure consumption itself, both platform and workload
- Security assessment or penetration testing of the result
Questions that separate a scoped quote from a guess
- 01How many subscriptions, and is vending automated or manual?
- 02Is the policy baseline delivered in audit mode or enforced, and who signs off the exemption process?
- 03What is the estimated monthly Azure run cost of the platform components alone, before workloads?
- 04Is everything delivered as code in our repository, and can we rebuild the environment from it without you?
- 05Which named framework, if any, are controls mapped to, and is evidence collection automated?
- 06What happens in month four when something breaks and the team that built it has moved on?
- 07Is migration in or out of scope, and if out, what is the rough shape of that programme?
A vendor who can answer all seven without hedging has done the thinking. A vendor who cannot has quoted a shape rather than a project, and the difference will show up as change requests.
The cheapest mistake to avoid
Over-building. The most expensive landing zones we are asked to review are the ones built to a reference architecture without reference to the company that has to live in it: five management group tiers for eleven subscriptions, a firewall in front of workloads with no external exposure, policy sets so strict that every team has a standing exemption.
The reference architectures are good, but they are catalogues rather than blueprints. A landing zone should be the smallest thing that makes the next twelve months of work safe and repeatable, with room to grow into the rest. That is usually closer to the starter band than anyone selling you a landing zone would like you to believe.
Take these bands as a way to interrogate a quote rather than as a price list, because the single largest variable is scope clarity and that is set in the first conversation. If you want a second opinion on a proposal you are holding, send it over — we will tell you whether it looks scoped, even if the answer is that you should sign it with someone else.