IaaS Workloads Landing Zone

**Describe the solution you'd like**

We're starting to migrate the 3.5k on-premises servers to Azure using Azure Migrate, and the first question is where are these going to live?

It feels like the current CAF could be extended with a **IaaS Workloads Landing Zone** defined that's **built to be the target for Azure Migrate** but also any **IaaS VM based workloads** where there's just the one or two servers. Going the whole hog of creating separate Application Landing Zones for a single virtual server to sit in is overkill, we want **a common Application Landing Zone built to house many virtual servers**. We're **looking for guidance on the best way to prep this specific-case Application Landing Zone**, and it would be nice if it could be rolled out as part of the various IaC offerings (we used the [Azure landing zones Terraform module](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale) to prep our CAF).

**Discussion points**

- Should this sit under the Landing Zones management group, and inherit the various Azure Policies from there? Or should it sit out to the side, so that specific Azure Policies applicable to IaaS workloads can be assigned, to limit the risk of breaking applications once migrated in?
- Should we be using a VNet for each VM tier, requiring multiple VNet peering's back to the hub, or just separate the front-end, application, and data tiers using subnets and NSGs?
- Migrated applications often have a SQL database included; can we get a common database service created as part of this IaaS Workloads Landing Zone to be used as the target for the migrated application databases? We're primarily looking at a shared Azure SQL Managed Instance (or pool of instances) for this but might well find we also need a shared SQL Server on VM service due to compatibility issues with some older apps. Again, it'd be nice to have guidance (and indeed code) to help get a robust data layer created designed for IaaS VM workloads.
- And how should the Azure Migrate services be included into this?

Whether this is a job for the CAF/Enterprise-Scale team, or whether it's an off-shoot project for the Azure Migrate/IaaS team I don't know. But seems like this would be a fairly common requirement for most businesses looking to move in to Azure?

Start by reviewing the current Cloud Adoption Framework and the linked Azure landing zones Terraform module. Clarify whether the requested landing zone belongs under Landing Zones, then investigate the policy inheritance, network layout, shared database services, and Azure Migrate integration questions. Done means an agreed IaaS workload landing zone design with guidance and any corresponding IaC scope documented.

Written by the indexing model from the issue text.