@Dean Grossfrom what I know, there isn't really a recommended landing zone per se, it is more like creating one ourselves based on what we are trying to achieve by referencing Azure CAF design principles.
Based on what you have shared so far, a dedicated management group (MG) that acts as the "Sandbox" environment does sound like what you are trying to build.
That said, there are still many factors that we need to take into consideration such as:
- Are you building this environment from an existing Azure tenant or it will be an entirely new Azure tenant?
- What kind of boundaries do you plan to have in place?
E.g. Each student can only create one subscription, only a limited set of Azure services that the students can provision and etc.
I would suggest considering the following approach:
- Subscriptions will be managed (Creation/Deletion and etc) by other teams instead of the students themselves
- Grant the students "Owner" RBAC role for experimenting with Azure services, that will allow them to manage all resources in a resource group, such as virtual machines, websites, and subnets
This approach will simplify the governance and management for your Sandbox environment.
To better manage the Sandbox environment, you can implement further controls by making use of Azure Policy at the MG level (in this case, it will be the Sandbox MG) or even the Subscriptions level, depending on the boundaries you would like to have in place.
Lastly, once you have this structure and policies in place, you can make use of Azure Cost Management to apply budgets on respective subscriptions and monitor the overall spending in Cost Management dashboard.
Hope these help and do share your thoughts with me 