When a landing zone is not ready for guests

A landing zone can look complete in a console and still refuse the first production guest. In planning workshops we look for a handful of failure modes that show up only when an application team arrives with real traffic and real identity needs.

Quiet blockers

• Network paths that work for bastion hosts but not for the batch windows applications actually use
• Logging destinations nobody monitors after 18:00
• Backup policies that exist as policy text without a restore that has been timed
• Shared services accounts that still belong to a former contractor

A useful test

Invite one non-critical application team to deploy a throwaway service using only the published landing-zone documentation. Time how long they spend asking the platform group for exceptions. Every exception is a sentence missing from the plan of record.

Planning before pride

It is cheaper to amend diagrams in a planning workshop than to explain a failed first wave to a steering committee. Readiness is not a badge; it is a set of paths your people have already walked once.