Amazon Web Services → Microsoft Azure
Azure equivalent of AWS Control Tower
AWS Control Tower maps to Azure landing zones from the Cloud Adoption Framework, deployed with the portal accelerator, Bicep, or Terraform, plus subscription vending modules.
About AWS Control Tower
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Sets up and governs a multi-account landing zone on Organizations and Identity Center, with account vending and preventive, detective, and proactive controls. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Landing zone setup and account vending | Azure landing zones (Cloud Adoption Framework) | Partial match |
Multi-account governance & guardrails(1)
Landing zone setup and account vending Partial match
AWS Control Tower maps to Azure landing zones from the Cloud Adoption Framework, deployed with the portal accelerator, Bicep, or Terraform, plus subscription vending modules. Azure Blueprints, an older option, retires January 31, 2027.
- Managed service vs. reference. Control Tower is a managed service that builds and maintains the landing zone, detects drift, and vends accounts through Account Factory. Azure landing zones are a reference architecture with deployable code that you own and update.
- Controls. Control Tower ships preventive (SCP), detective (Config), and proactive (CloudFormation hook) controls. Azure landing zones apply a curated set of Azure Policy assignments.