TailwindTraders VS Enterprise-Scale

You can deploy some of these sample applications in Azure to get a better feel for real world scenarios - https://github.com/Microsoft/TailwindTraders

Most orgs can probably get away with a single subscription for all of their central platform resources. Take a look at this example. You'll need to scroll down the README a bit, but this condenses the network hub, domain controllers, and logging resources into 1 subscription.

good point, there isn’t a built in definition for it. There is a policy definition called ‘deny public ip’ as part of the Enterprise scale landing zones though https://github.com/Azure/Enterprise-Scale/blob/main/docs/ESLZ-Policies.md

i would suggest looking at this: https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/contoso/Readme.md

Take the example from Cloud Adoption Framework enterprise-scale landing zones hub and spoke architecture https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/adventureworks/README.md. It should'nt be all about vnets, but how you really design the landscape especially for the services you have listed. If you plan to have multiple hubs in different regions and you want a spoke vnet in a hub communicate with another spoke in a different hub you could run into transitive routing issues which you would need Azure Route Server or Azure Virtual WAN to solve. Start from the landing zone architectures because these examples would mostly fit your requirements and are desinged to scale.

The example is for a single region deployment. You are mentioning the potential of more services to be in Azure. Where do you get your subscriptions from? Do you have Enterprise Agreement? If so, then it really doesn't matter and you could reference the example desing. Based on the service you determine the destination subscription. If you have multiple teams/partners working on different services then this design is excellent for RBAC. If you have a small team then you could have a maximum of three subscriptions, from the example desing you could put together the management, connectivity and identity subscription and seperate the resources based on resource groups for RBAC. Each new service that you are offering is in the corp or online subscription and you create your services and vnets and peer them on the basis that should the vnet be corp connected or is exposed to the outside. Something like this https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/treyresearch/README.md

Make one for yourself and have a play: https://github.com/Azure/Enterprise-Scale

Roughly inspired by that. I guess you could go much crazier with Azure Firewall, etc...

If you are a little larger company, you should look at the enterprise-scale part (https://github.com/Azure/Enterprise-Scale)