Landing Zone — Network Foundation

A deliberate topology decision (Virtual WAN or hub-and-spoke), explicit connectivity to on-prem (ExpressRoute, VPN, or none), centralised egress through Azure Firewall or NVA, and a private-DNS architecture that doesn't accrete by accident. The network that workloads will inherit.

An organisational capability that the journey relies on.