The Architectural Landscape of Azure in the United States
Azure offers more regions in the United States than anywhere else, from East US 2 in Virginia and Central US in Iowa to West US 3 in Arizona, plus the physically isolated Azure Government cloud for federal, state and local workloads and their contractors. That choice is an advantage, but it also means an enterprise landing zone needs deliberate decisions that a generic global template will not make for you.
A US landing zone has to map to the frameworks your workloads answer to (NIST SP 800-53, FedRAMP, HIPAA, PCI DSS or SOC 2), use region pairs that actually meet your recovery objectives, and enforce residency boundaries across subscriptions, resource groups and service tiers.
Enforcing Data Residency with Azure Policy
The single most important safeguard is a management-group policy that blocks resources from being created outside approved US regions:
{
"properties": {
"displayName": "Allow approved US regions only",
"policyType": "Custom",
"mode": "Indexed",
"description": "Restricts resource deployment to approved US Azure regions.",
"policyRule": {
"if": {
"not": {
"field": "location",
"in": ["eastus", "eastus2", "centralus", "westus2", "westus3"]
}
},
"then": {
"effect": "Deny"
}
}
}
}
Network Architecture: Hub-and-Spoke with ExpressRoute
For regulated healthcare, financial and public-sector workloads, routing over the public internet adds latency variability and exposure. The usual pattern pairs Azure Virtual WAN or a hub-and-spoke VNet topology with redundant ExpressRoute circuits in two different peering locations:
- Dual-homed resiliency: Active-active ExpressRoute circuits from two providers at separate peering locations (for example, Ashburn and Chicago) protect against a single carrier or facility outage.
- Centralized firewall inspection: Azure Firewall Premium in the shared Connectivity subscription with TLS inspection and IDPS enabled, and forced tunneling of outbound internet egress through a central inspection point.
- Private Link everywhere: Disable public network access on PaaS services (Azure SQL, Cosmos DB, Storage, Key Vault). Traffic flows over private endpoints, with DNS resolution managed through centralized Azure Private DNS zones.
- Azure Government when required: Workloads subject to FedRAMP High, CJIS, ITAR or DoD impact levels belong in Azure Government, with its own landing zone and identity boundary rather than a commercial subscription with extra policy.