Cloud landing zones
Apply a new cloud baseline to existing workloads gradually
A policy that works for a fresh environment can disrupt older services. Discover dependencies and test the effective change before broad enforcement.
In this article
Compare existing environments with the target
Inventory the controls, access assignments and network dependencies already in use. Identify differences from the proposed baseline and classify them by operational consequence.
Some differences are harmless naming conventions. Others are public access paths, unsupported locations or shared credentials that applications actively depend on.
Do not treat every difference as something safe to overwrite immediately. Establish what the workload does before changing the environment beneath it.
Test with a representative cohort
Choose a small set of workloads that exercise important patterns, including one with background jobs and external integrations. Apply the proposed change through the reviewed platform process.
Run deployment and runtime checks. A policy may permit existing resources to keep running while blocking the next update, so testing only a health endpoint can miss the impact.
Where the provider offers an appropriate audit or assessment mode, use its findings to inform rollout. Understand its coverage rather than assuming it predicts every enforcement result.
Resolve dependencies before expansion
Give workload owners concrete actions for incompatible settings and verify the result. Keep exceptions scoped, owned and time-bound under the organisation's process.
Avoid moving an environment between governance groups without examining inherited effects. The change may alter more controls than the one policy the team intended to introduce.
Record the rollback or recovery procedure for the baseline update. Reverting a policy does not necessarily reverse data or resources already changed by remediation.
Roll out in observable stages
Expand to additional environments with checks for deployment failures, denied runtime actions and support incidents. Pause when the evidence shows an unresolved pattern.
Keep baseline versions and effective assignments discoverable. Operators should be able to determine which environments have adopted the change without inspecting each console manually.
Finish by reconciling approved exceptions and updating the provisioning path for future workloads. A baseline migration is complete when existing services and new environments follow a maintained policy, not when one central configuration file has been updated.
Primary sources
Microsoft: Azure landing zonesAWS: service control policiesReferences checked 11 September 2026.