Azure Landing Zones for Aged Care: A Reference Architecture for New Provider Tenants

Aged care providers are standing up new Azure tenants under greater scrutiny than at any point in the sector's history. Reforms to the Aged Care Act, strengthened privacy obligations, and rising expectations around clinical interoperability all mean that a cloud estate assembled without structure will accumulate risk and remediation cost. A landing zone offers a disciplined alternative, giving a provider a pre-configured foundation of governance, identity, networking, and security that is ready to receive workloads from the first day of operation.

This article sets out a sector-specific reference architecture for aged care providers establishing or consolidating their Azure presence. It concentrates on three areas that determine long-term outcomes: connectivity to clinical data through FHIR, identity as the primary security perimeter, and backup and recoverability designed in from the outset. The intent is to describe a blueprint that a technical team can reason about, adapt, and defend to auditors and clinical governance committees alike.

Why a landing zone matters for aged care

An Azure landing zone is an environment provisioned according to a defined set of design principles, typically organised through a management group hierarchy that separates platform services from application workloads. For an aged care provider, this separation matters because clinical systems, corporate workloads, and shared platform services carry different risk profiles and different regulatory weight. Establishing the hierarchy early allows policy, cost management, and access controls to be applied consistently rather than retrofitted across sprawling subscriptions.

The alternative, where subscriptions are created ad hoc as projects arise, tends to produce inconsistent network topologies, duplicated identities, and gaps in logging that only surface during an incident or an audit. A landing zone addresses this by codifying guardrails through Azure Policy, enforcing baseline controls such as encryption, approved regions, and diagnostic logging before any workload is deployed. Providers consolidating multiple legacy environments benefit particularly, because the landing zone becomes the target state into which disparate systems can be migrated in a controlled sequence.

FHIR connectivity for clinical interoperability

Fast Healthcare Interoperability Resources, known as FHIR, is the HL7 standard that underpins modern exchange of clinical information, and aged care providers increasingly need to consume and share it. Medication records, care plans, pathology results, and interactions with My Health Record all rely on structured, standards-based data rather than documents passed between disconnected systems. Azure Health Data Services provides a managed FHIR service that removes much of the operational burden of running a conformant endpoint, including scaling, patching, and persistence of resources.

Within the landing zone, the FHIR service should sit in a dedicated workload subscription with its own network boundary, private endpoints, and tightly scoped access policies. Integration pipelines that transform data from clinical and rostering systems can be built with Azure Functions, Logic Apps, or Data Factory, writing validated resources into the FHIR store while preserving an audit trail of every transaction. Treating clinical data as a first-class workload, governed separately from corporate services, makes it far easier to demonstrate that information is handled in accordance with privacy obligations and clinical governance expectations.

Identity as the security perimeter

In a cloud estate, identity rather than the network boundary is the control that most directly determines who can reach clinical and personal information. Microsoft Entra ID should be configured as the single source of identity for staff, contractors, and the increasingly mobile care workforce that aged care providers depend upon. Conditional access policies, multifactor authentication, and risk-based sign-in controls allow access to be granted on the basis of user, device, and context rather than static credentials alone.

Privileged access deserves particular attention because administrative accounts represent the highest-value target in any environment. Entra Privileged Identity Management enables just-in-time elevation, so that administrators hold standing permissions only when they are actively performing a task, with approval and logging attached to every activation. Aligning these controls with the Australian Cyber Security Centre's Essential Eight, especially the restriction of administrative privileges and the enforcement of multifactor authentication, gives a provider a recognised baseline that is straightforward to explain during assurance activities.

Backup and recoverability from day one

Recoverability is often treated as an operational afterthought, yet for aged care providers it is central to continuity of care and to meeting records retention obligations. Azure Backup and Azure Site Recovery should be incorporated into the landing zone as platform services, with policies that reflect the differing retention and recovery requirements of clinical records, corporate data, and infrastructure. Defining these requirements early, and encoding them as policy, prevents the common situation where critical systems are discovered to have no protection only after data has been lost.

Resilience against ransomware warrants deliberate design rather than reliance on default settings. Immutable backup vaults, soft delete, and multi-user authorisation for deletion operations reduce the likelihood that an attacker who compromises an administrator can also destroy the means of recovery. Regular, documented restore testing is equally important, because a backup that has never been restored is an assumption rather than a control, and auditors and clinical governance bodies will reasonably expect evidence that recovery works.

Bringing the blueprint together

The value of treating FHIR connectivity, identity, and backup as foundational elements is that each reinforces the others within a coherent governance model. A provider that defines its management group hierarchy, applies policy-driven guardrails, and separates clinical workloads can onboard new services with confidence that controls will be inherited rather than negotiated case by case. This consistency shortens the path from decision to deployment and reduces the burden of demonstrating compliance over time.

Providers should approach the landing zone as a living reference architecture that evolves alongside regulatory change and the growth of their digital estate. Documenting design decisions, mapping controls to recognised frameworks, and reviewing the environment on a regular cadence keeps the foundation defensible as circumstances shift. Established from the outset with these principles in mind, an Azure tenant becomes an asset that supports safe, connected care rather than a source of accumulating technical and regulatory debt.

References

• Microsoft Learn: What is an Azure landing zone?
• Microsoft Learn: FHIR service in Azure Health Data Services
• Australian Cyber Security Centre: Essential Eight