// the find
Azure/caf-terraform-landingzones
This solution, offered by the Open-Source community, will no longer receive contributions from Microsoft. Customers are encouraged to transition to Microsoft Azure Verified Modules for continued support and updates from Microsoft. Please note, this repository is scheduled for decommissioning and will be removed on July 1, 2025.
This is the Microsoft Cloud Adoption Framework (CAF) Terraform landing zones implementation — an opinionated, layered approach to standing up Azure enterprise environments via Terraform. It's aimed at platform engineering teams who need governance, networking, identity, and state management wired together from day one. The repo is officially dead: Microsoft abandoned it in 2024 and it was scheduled for deletion July 1, 2025.
The layered state architecture (launchpad → level 0-4) is genuinely well thought out — each layer reads remote state from the layer below rather than coupling everything into one monster state file. The scenario-based tfvars approach makes it practical to version-control different environment configurations without forking the modules. There's real breadth here: AKS secure baseline, Azure DevOps agent pools, hub-spoke networking, and GitLab agent support are all present as add-ons. The devcontainer setup with rover tooling means a new team member can get a working Terraform environment without fighting local toolchain mismatches.
The repo is abandoned and was supposed to be deleted — you should not adopt this for new projects, full stop. The replacement path (Azure Verified Modules) has a completely different structure, so migration is a rewrite not an upgrade. The 'rover' container abstraction adds a layer of indirection that makes local debugging harder — when something breaks in CI you're debugging inside a container wrapping Terraform wrapping Azure. The community fork at aztfmod is an unknown quantity for long-term maintenance.