How do you design an Azure Landing Zone for a multi-team enterprise with proper governance, networking, and security?

# Bicep: Hub VNet with Azure Firewall
resource hubVnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'hub-vnet'
  location: location
  properties: {
    addressSpace: { addressPrefixes: ['10.0.0.0/16'] }
    subnets: [
      {
        name: 'AzureFirewallSubnet'
        properties: { addressPrefix: '10.0.1.0/24' }
      }
      {
        name: 'GatewaySubnet'
        properties: { addressPrefix: '10.0.2.0/24' }
      }
    ]
  }
}

# Azure Policy: Require tags
resource policyAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
  name: 'require-cost-center-tag'
  properties: {
    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62'
    parameters: {
      tagName: { value: 'CostCenter' }
    }
    enforcementMode: 'Default'
  }
}

# Azure CLI: Create management group hierarchy
az account management-group create --name Platform --display-name 'Platform'
az account management-group create --name LandingZones --display-name 'Landing Zones'
az account management-group create --name Corp --display-name 'Corp' --parent LandingZones