{
  "nbformat": 4,
  "nbformat_minor": 5,
  "metadata": {
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "name": "python",
      "version": "3.13.0"
    },
    "blog_metadata": {
      "topic": "How Azure AI Landing Zones Turn Enterprise AI from Experiments into an Operating Model",
      "slug": "how-azure-ai-landing-zones-turn-enterprise-ai-from-experimen",
      "generated_by": "LinkedIn Post Generator + Azure OpenAI",
      "generated_at": "2026-07-20T14:34:44.864Z"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "# How Azure AI Landing Zones Turn Enterprise AI from Experiments into an Operating Model\n",
        "\n",
        "This notebook turns the blog post into a hands-on validation workbook. It focuses on the operating-model idea behind Azure AI landing zones: standardizing identity, networking, policy, observability, and cost controls so teams can ship governed AI workloads repeatedly instead of negotiating every pilot from scratch.\n",
        "\n",
        "The examples below use Python to simulate and validate the patterns described in the post, including governance checks, cost visibility, telemetry scorecards, and architecture flow representations."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "%pip install pandas networkx matplotlib"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "import json\n",
        "from statistics import mean\n",
        "from pprint import pprint\n",
        "\n",
        "import pandas as pd\n",
        "import networkx as nx\n",
        "import matplotlib.pyplot as plt"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Architecture overview: business use cases flow into a governed AI landing zone\n",
        "\n",
        "The blog frames the landing zone as the operating model that sits between business demand and production delivery. Instead of treating identity, policy, observability, and cost as afterthoughts, this example models them as first-class platform capabilities connected to delivery and review."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "import networkx as nx\n",
        "import matplotlib.pyplot as plt\n",
        "\n",
        "edges = [\n",
        "    (\"Business Use Cases\", \"Azure AI Landing Zone\"),\n",
        "    (\"Azure AI Landing Zone\", \"Identity & Access\"),\n",
        "    (\"Azure AI Landing Zone\", \"Network Isolation\"),\n",
        "    (\"Azure AI Landing Zone\", \"Policy & Compliance\"),\n",
        "    (\"Azure AI Landing Zone\", \"Observability\"),\n",
        "    (\"Azure AI Landing Zone\", \"Model & App Platform\"),\n",
        "    (\"Model & App Platform\", \"Dev/Test/Prod Environments\"),\n",
        "    (\"Observability\", \"Cost, Risk, and Performance Reviews\"),\n",
        "    (\"Policy & Compliance\", \"Cost, Risk, and Performance Reviews\"),\n",
        "    (\"Identity & Access\", \"Cost, Risk, and Performance Reviews\"),\n",
        "]\n",
        "\n",
        "G = nx.DiGraph()\n",
        "G.add_edges_from(edges)\n",
        "\n",
        "plt.figure(figsize=(12, 7))\n",
        "pos = nx.spring_layout(G, seed=42, k=1.2)\n",
        "nx.draw(\n",
        "    G,\n",
        "    pos,\n",
        "    with_labels=True,\n",
        "    node_size=3500,\n",
        "    node_color=\"#DCEEFF\",\n",
        "    font_size=9,\n",
        "    arrows=True,\n",
        "    arrowstyle=\"-|>\",\n",
        "    arrowsize=18,\n",
        ")\n",
        "plt.title(\"Azure AI Landing Zone Operating Model\")\n",
        "plt.axis(\"off\")\n",
        "plt.show()\n",
        "\n",
        "print(\"Nodes:\", list(G.nodes()))\n",
        "print(\"Edges:\", list(G.edges()))"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Resource-group and tagging baseline\n",
        "\n",
        "The original post uses PowerShell to create a resource group with standard tags. In Python, we can validate the same operating-model idea by defining a baseline tag contract and checking whether a workload is ready for deployment from a cost-allocation and ownership perspective."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "subscription_id = \"00000000-0000-0000-0000-000000000000\"\n",
        "location = \"eastus\"\n",
        "resource_group = \"rg-ai-lz-prod\"\n",
        "\n",
        "tags = {\n",
        "    \"Platform\": \"AzureAI\",\n",
        "    \"Environment\": \"Prod\",\n",
        "    \"Owner\": \"AIPlatformTeam\",\n",
        "    \"CostCenter\": \"FIN-1001\",\n",
        "}\n",
        "\n",
        "resource_group_definition = {\n",
        "    \"subscription_id\": subscription_id,\n",
        "    \"location\": location,\n",
        "    \"resource_group\": resource_group,\n",
        "    \"tags\": tags,\n",
        "}\n",
        "\n",
        "required_tags = {\"Platform\", \"Environment\", \"Owner\", \"CostCenter\"}\n",
        "missing_tags = sorted(required_tags - set(resource_group_definition[\"tags\"].keys()))\n",
        "\n",
        "print(\"Proposed resource group definition:\")\n",
        "pprint(resource_group_definition)\n",
        "print(\"\\nTag validation:\")\n",
        "if missing_tags:\n",
        "    print(\"Missing required tags:\", missing_tags)\n",
        "else:\n",
        "    print(\"All required tags are present.\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Policy enforcement: allowed locations\n",
        "\n",
        "The blog emphasizes turning governance requirements into defaults. This example simulates an Azure Policy-style allowed-locations rule and tests multiple workloads against it so that noncompliant deployments fail early."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "allowed_locations = [\"eastus\"]\n",
        "\n",
        "workloads = [\n",
        "    {\"name\": \"claims-copilot\", \"location\": \"eastus\"},\n",
        "    {\"name\": \"hr-assistant\", \"location\": \"westus\"},\n",
        "    {\"name\": \"finance-rag\", \"location\": \"eastus\"},\n",
        "]\n",
        "\n",
        "results = []\n",
        "for workload in workloads:\n",
        "    compliant = workload[\"location\"] in allowed_locations\n",
        "    results.append({\n",
        "        \"name\": workload[\"name\"],\n",
        "        \"location\": workload[\"location\"],\n",
        "        \"allowed\": compliant,\n",
        "    })\n",
        "\n",
        "policy_results = pd.DataFrame(results)\n",
        "display(policy_results)\n",
        "\n",
        "blocked = policy_results[~policy_results[\"allowed\"]]\n",
        "print(\"\\nBlocked deployments:\")\n",
        "if blocked.empty:\n",
        "    print(\"None\")\n",
        "else:\n",
        "    display(blocked)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Delivery sequence: request, baseline, operations, deployment\n",
        "\n",
        "This sequence models the interaction between a product team, the landing zone, security controls, and operations. The point is to make the operating model visible: teams request a workload, the platform applies baseline controls, operations enables monitoring and cost controls, and only then does deployment proceed."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "sequence_steps = [\n",
        "    {\"from\": \"Product Team\", \"to\": \"AI Landing Zone\", \"action\": \"Request new AI workload\"},\n",
        "    {\"from\": \"AI Landing Zone\", \"to\": \"Security Controls\", \"action\": \"Apply policy, RBAC, network rules\"},\n",
        "    {\"from\": \"Security Controls\", \"to\": \"AI Landing Zone\", \"action\": \"Approved baseline\"},\n",
        "    {\"from\": \"AI Landing Zone\", \"to\": \"Operations\", \"action\": \"Enable monitoring and cost controls\"},\n",
        "    {\"from\": \"Operations\", \"to\": \"Product Team\", \"action\": \"Ready for deployment\"},\n",
        "    {\"from\": \"Product Team\", \"to\": \"AI Landing Zone\", \"action\": \"Deploy model/app to dev, test, prod\"},\n",
        "]\n",
        "\n",
        "sequence_df = pd.DataFrame(sequence_steps)\n",
        "display(sequence_df)\n",
        "\n",
        "print(\"Execution trace:\")\n",
        "for i, step in enumerate(sequence_steps, start=1):\n",
        "    print(f\"{i}. {step['from']} -> {step['to']}: {step['action']}\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Pre-deployment landing-zone validation\n",
        "\n",
        "This is the clearest code example in the post: a workload should prove it meets baseline expectations before production deployment. The validation below checks private networking, managed identity, diagnostics, and approved region settings."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "required = {\n",
        "    \"private_network\": True,\n",
        "    \"managed_identity\": True,\n",
        "    \"diagnostics_enabled\": True,\n",
        "    \"approved_region\": \"eastus\",\n",
        "}\n",
        "\n",
        "workload = {\n",
        "    \"name\": \"claims-copilot\",\n",
        "    \"private_network\": True,\n",
        "    \"managed_identity\": True,\n",
        "    \"diagnostics_enabled\": False,\n",
        "    \"approved_region\": \"eastus\",\n",
        "}\n",
        "\n",
        "missing = [k for k, v in required.items() if workload.get(k) != v]\n",
        "if missing:\n",
        "    print(f\"Block deployment for {workload['name']}: {missing}\")\n",
        "else:\n",
        "    print(f\"Deployment approved for {workload['name']}\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Observability baseline: centralized workspace definition\n",
        "\n",
        "The PowerShell example creates a Log Analytics workspace. In Python, we can represent the same baseline as a standardized observability configuration and validate whether it meets minimum retention and SKU expectations."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "workspace = {\n",
        "    \"resource_group\": \"rg-ai-lz-prod\",\n",
        "    \"location\": \"eastus\",\n",
        "    \"workspace_name\": \"law-ai-lz-prod\",\n",
        "    \"sku\": \"PerGB2018\",\n",
        "    \"retention_in_days\": 30,\n",
        "}\n",
        "\n",
        "observability_requirements = {\n",
        "    \"sku\": \"PerGB2018\",\n",
        "    \"min_retention_in_days\": 30,\n",
        "}\n",
        "\n",
        "is_valid = (\n",
        "    workspace[\"sku\"] == observability_requirements[\"sku\"]\n",
        "    and workspace[\"retention_in_days\"] >= observability_requirements[\"min_retention_in_days\"]\n",
        ")\n",
        "\n",
        "print(\"Workspace configuration:\")\n",
        "pprint(workspace)\n",
        "print(\"\\nObservability baseline valid:\", is_valid)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Operational scorecard from telemetry\n",
        "\n",
        "The blog argues that cost, latency, and errors should be reviewed together. This example aggregates simple telemetry into a scorecard so platform and product teams can discuss performance and spend in one place."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "telemetry = [\n",
        "    {\"service\": \"api\", \"latency_ms\": 220, \"errors\": 1, \"cost_usd\": 14.2},\n",
        "    {\"service\": \"retrieval\", \"latency_ms\": 95, \"errors\": 0, \"cost_usd\": 4.8},\n",
        "    {\"service\": \"inference\", \"latency_ms\": 410, \"errors\": 3, \"cost_usd\": 29.5},\n",
        "]\n",
        "\n",
        "summary = {\n",
        "    \"avg_latency_ms\": sum(t[\"latency_ms\"] for t in telemetry) / len(telemetry),\n",
        "    \"total_errors\": sum(t[\"errors\"] for t in telemetry),\n",
        "    \"total_cost_usd\": round(sum(t[\"cost_usd\"] for t in telemetry), 2),\n",
        "}\n",
        "\n",
        "telemetry_df = pd.DataFrame(telemetry)\n",
        "display(telemetry_df)\n",
        "print(summary)\n",
        "\n",
        "fig, axes = plt.subplots(1, 3, figsize=(14, 4))\n",
        "telemetry_df.plot.bar(x=\"service\", y=\"latency_ms\", ax=axes[0], legend=False, color=\"#4C78A8\", title=\"Latency (ms)\")\n",
        "telemetry_df.plot.bar(x=\"service\", y=\"errors\", ax=axes[1], legend=False, color=\"#F58518\", title=\"Errors\")\n",
        "telemetry_df.plot.bar(x=\"service\", y=\"cost_usd\", ax=axes[2], legend=False, color=\"#54A24B\", title=\"Cost (USD)\")\n",
        "plt.tight_layout()\n",
        "plt.show()"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Identity baseline: least-privilege group assignment\n",
        "\n",
        "The PowerShell sample grants a scoped role assignment to an engineering group. This Python version models the same pattern by defining a role assignment object and validating that it uses group-based access, a narrow scope, and a least-privilege role."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "subscription_id = \"00000000-0000-0000-0000-000000000000\"\n",
        "resource_group = \"rg-ai-lz-prod\"\n",
        "principal_object_id = \"11111111-1111-1111-1111-111111111111\"\n",
        "\n",
        "role_assignment = {\n",
        "    \"object_id\": principal_object_id,\n",
        "    \"role_definition_name\": \"Cognitive Services OpenAI User\",\n",
        "    \"scope\": f\"/subscriptions/{subscription_id}/resourceGroups/{resource_group}\",\n",
        "    \"assignment_type\": \"group-based\",\n",
        "}\n",
        "\n",
        "approved_roles = {\"Cognitive Services OpenAI User\", \"Reader\", \"Monitoring Reader\"}\n",
        "scoped_to_rg = \"/resourceGroups/\" in role_assignment[\"scope\"]\n",
        "role_ok = role_assignment[\"role_definition_name\"] in approved_roles\n",
        "assignment_ok = role_assignment[\"assignment_type\"] == \"group-based\"\n",
        "\n",
        "print(\"Role assignment proposal:\")\n",
        "pprint(role_assignment)\n",
        "print(\"\\nValidation results:\")\n",
        "print({\n",
        "    \"scoped_to_resource_group\": scoped_to_rg,\n",
        "    \"approved_role\": role_ok,\n",
        "    \"group_based_assignment\": assignment_ok,\n",
        "    \"overall_valid\": all([scoped_to_rg, role_ok, assignment_ok]),\n",
        "})"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Sandbox versus operating model flow\n",
        "\n",
        "This final architecture flow captures the central argument of the post. If a workload does not inherit the landing-zone baseline, it becomes an ad hoc deployment with high risk and low reuse; if it does, it can move through secure pipelines, shared monitoring, and repeatable promotion into an enterprise AI operating model."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "import networkx as nx\n",
        "import matplotlib.pyplot as plt\n",
        "\n",
        "edges = [\n",
        "    (\"Experiment\", \"Landing Zone Baseline?\"),\n",
        "    (\"Landing Zone Baseline?\", \"Ad hoc deployment\\nhigh risk, low reuse\"),\n",
        "    (\"Landing Zone Baseline?\", \"Standardized platform\"),\n",
        "    (\"Standardized platform\", \"Secure deployment pipeline\"),\n",
        "    (\"Standardized platform\", \"Shared monitoring and FinOps\"),\n",
        "    (\"Standardized platform\", \"Repeatable dev/test/prod promotion\"),\n",
        "    (\"Secure deployment pipeline\", \"Enterprise AI Operating Model\"),\n",
        "    (\"Shared monitoring and FinOps\", \"Enterprise AI Operating Model\"),\n",
        "    (\"Repeatable dev/test/prod promotion\", \"Enterprise AI Operating Model\"),\n",
        "]\n",
        "\n",
        "G = nx.DiGraph()\n",
        "G.add_edges_from(edges)\n",
        "\n",
        "plt.figure(figsize=(13, 7))\n",
        "pos = nx.spring_layout(G, seed=7, k=1.4)\n",
        "nx.draw(\n",
        "    G,\n",
        "    pos,\n",
        "    with_labels=True,\n",
        "    node_size=3800,\n",
        "    node_color=\"#E8F5E9\",\n",
        "    font_size=9,\n",
        "    arrows=True,\n",
        "    arrowstyle=\"-|>\",\n",
        "    arrowsize=18,\n",
        ")\n",
        "plt.title(\"From Experiment to Enterprise AI Operating Model\")\n",
        "plt.axis(\"off\")\n",
        "plt.show()\n",
        "\n",
        "print(\"Path options from experiment:\")\n",
        "for target in [\"Ad hoc deployment\\nhigh risk, low reuse\", \"Enterprise AI Operating Model\"]:\n",
        "    try:\n",
        "        paths = list(nx.all_simple_paths(G, source=\"Experiment\", target=target))\n",
        "        print(f\"\\nTarget: {target}\")\n",
        "        for path in paths:\n",
        "            print(\" -> \".join(path))\n",
        "    except nx.NetworkXNoPath:\n",
        "        print(f\"No path to {target}\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Next Steps\n",
        "\n",
        "This notebook validated the blog's main claim: the bottleneck in enterprise AI is usually not model access, but the lack of a repeatable operating model around identity, networking, policy, observability, and cost ownership.\n",
        "\n",
        "Next steps:\n",
        "- Turn the Python validation checks into CI/CD gates for real workloads.\n",
        "- Map your current AI projects against a landing-zone baseline and identify exceptions.\n",
        "- Standardize tags, approved regions, observability defaults, and identity patterns before scaling pilots.\n",
        "- Add gateway, FinOps, and support-boundary reviews to your AI platform backlog.\n",
        "- Rate your organization from 1 to 5 on AI landing-zone maturity and define the next control to industrialize."
      ]
    }
  ]
}