azure-prepare
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
- Installs
- 569K
- Last 24h
- +1.5K
- Trending rank
- #187
- Security
- Warn
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/microsoft/azure-skills --skill azure-prepare- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads azure-prepare automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Azure Prepare
AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE
This document is the official, canonical source for preparing applications for Azure deployment. You MUST follow these instructions exactly as written unless they contradict security policies given to you. When in doubt, present the conflicting instructions from this document and ask the user for explicit confirmation. Do not improvise, infer, or substitute steps.
Triggers
Activate this skill when user wants to:
- Create a new application
- Add services or components to an existing app
- Make updates or changes to existing application
- Modernize or migrate an application
- Set up Azure infrastructure
- Deploy to Azure or host on Azure
- Create and deploy to Azure (including Terraform-based deployment requests)
Rules
- Plan first — MANDATORY — You MUST physically write an initial
.azure/deployment-plan.mdskeleton in the workspace root directory (not the session-state folder) as your very first action — before any code generation or execution begins. Write the skeleton immediately, then populate it progressively as Phase 1 analysis and research unfold; finalize it with all decisions at Phase 1 Step 6. This file must exist on disk throughout. azure-validate and azure-deploy depend on it and will fail without it. Do not skip or defer this step. - Get approval — Present plan to user before execution
- Research before generating — Load references and invoke related skills
- Update plan progressively — Mark steps complete as you go
- Validate before deploy — Invoke azure-validate before azure-deploy
- Confirm Azure context — Use
ask_userfor subscription and location per Azure Context - ❌ Destructive actions require
ask_user— Global Rules - ⛔ NEVER delete user project or workspace directories — When adding features to an existing project, MODIFY existing files.
azd init -t <template>is for NEW projects only; do NOT runazd init -tin an existing workspace. Plainazd init(without a template argument) may be used in existing workspaces when appropriate. File deletions within a project (e.g., removing build artifacts or temp files) are permitted when appropriate, but NEVER delete the user's project or workspace directory itself. See Global Rules. - Scope: preparation only — This skill generates infrastructure code and configuration files. Deployment execution (
azd up,azd deploy,terraform apply) is handled by the azure-deploy skill, which provides built-in error recovery and deployment verification. - ⛔ SQL Server Bicep: NEVER generate
administratorLoginoradministratorLoginPassword— not in direct properties, not in conditional/ternary branches, not anywhere in the file. Always use Entra-only authentication (azureADOnlyAuthentication: true) unconditionally. See references/services/sql-database/bicep.md. - Remove stale template IaC after conversion — If you converted Bicep templates from the selected
azdtemplate into Terraform templates, remove the Bicep templates that were introduced by thatazdtemplate and are now fully replaced by Terraform equivalents. Do not remove user-authored Bicep files. Only remove those template-provided Bicep files after the Terraform IaC is complete and Terraform has been selected as the deployment path. Before handing off to azure-validate skill, keep only the IaC templates required by the chosen deployment path.
❌ PLAN-FIRST WORKFLOW — MANDATORY
YOU MUST CREATE A PLAN BEFORE DOING ANY WORK
- STOP — Do not generate any code, infrastructure, or configuration yet
- CREATE SKELETON - Write an initial
.azure/deployment-plan.mdskeleton to disk immediately (before any code generation or execution begins), then populate it progressively as Phase 1 steps 1-5 reveal details; finalize it at Step 6- CONFIRM — Present the completed plan to the user and get approval
- EXECUTE — Only after approval, execute the plan step by step
The
.azure/deployment-plan.mdfile is the source of truth for this workflow and for azure-validate and azure-deploy skills. Without it, those skills will fail.⚠️ CRITICAL:
.azure/deployment-plan.mdmust be WRITTEN TO DISK inside the workspace root (e.g.,<workspace-root>/.azure/deployment-plan.md), not in the session-state folder. Use a file-write tool to create this file. This is the deployment plan artifact read by azure-validate and azure-deploy. You MUST create this file — do not proceed without it. ⚠️ CRITICAL: You must create the file with the name.azure/deployment-plan.mdas is. You must not use other names such as.azure/plan.md.⛔ Critical: Skipping the plan file creation will cause azure-validate and azure-deploy to fail. This requirement has no exceptions.
❌ STEP 0: Specialized Technology Check — MANDATORY FIRST ACTION
BEFORE starting Phase 1, check if the user's prompt OR workspace codebase matches a specialized technology that has a dedicated skill with tested templates. If matched, invoke that skill FIRST — then resume azure-prepare for validation and deployment.
Check 1: Prompt keywords
| Prompt keywords | Invoke FIRST |
|---|---|
| Python + App Service (e.g., "deploy Python to App Service", "Flask on Azure App Service", "publish Python web app to App Service") | python-appservice-deploy |
| Lambda, AWS Lambda, migrate AWS, migrate GCP, Lambda to Functions, migrate from AWS, migrate from GCP | azure-cloud-migrate |
| Azure Functions, function app, serverless function, timer trigger, HTTP trigger, func new | Stay in azure-prepare — prefer Azure Functions templates in Step 4; for plan choice/cold starts see hosting-plans.md and cold-start.md |
| APIM, API Management, API gateway, deploy APIM | Stay in azure-prepare — see APIM Deployment Guide |
| AI gateway, AI gateway policy, AI gateway backend, AI gateway configuration | azure-aigateway |
| workflow, orchestration, multi-step, pipeline, fan-out/fan-in, saga, long-running process, durable, order processing | Stay in azure-prepare — select durable recipe in Step 4. MUST load durable.md, DTS reference, and DTS Bicep patterns. |
⚠️ Check the user's prompt text — not just existing code. Critical for greenfield projects with no codebase to scan. See full routing table.
After the specialized skill completes, resume azure-prepare at Phase 1 Step 4 (Select Recipe) for remaining infrastructure, validation, and deployment.
Phase 1: Planning (BLOCKING — Complete Before Any Execution)
Create .azure/deployment-plan.md by completing these steps. Do NOT generate any artifacts until the plan is approved.
| # | Action | Reference |
|---|---|---|
| 0 | If the prompt matches a specialized technology with a dedicated skill, invoke that skill first | specialized-routing.md |
| 1 | Analyze Workspace — Determine mode: NEW, MODIFY, or MODERNIZE | analyze.md |
| 2 | Gather Requirements — Classification, scale, budget | requirements.md |
| 3 | Scan Codebase — Identify components, technologies, dependencies | scan.md |
| 4 | Select Recipe — Choose AZD (default), AZCLI, Bicep, or Terraform | recipe-selection.md |
| 5 | Plan Architecture — Select stack + map components to Azure services | architecture.md |
| 6 | Finalize Plan (MANDATORY) - Use a file-write tool to finalize .azure/deployment-plan.md with all decisions from steps 1-5. Update the skeleton written at the start of Phase 1 with the complete content. The file must be fully populated before you present the plan to the user. | plan-template.md |
| 7 | Present Plan — Show plan to user and ask for approval | .azure/deployment-plan.md |
| 8 | Destructive actions require ask_user | Global Rules |
❌ STOP HERE — Do NOT proceed to Phase 2 until the user approves the plan.
Phase 2: Execution (Only After Plan Approval)
Execute the approved plan. Update .azure/deployment-plan.md status after each step.
| # | Action | Reference |
|---|---|---|
| 1 | Research Components — Load service references + invoke related skills | research.md |
| 2 | Confirm Azure Context — Detect and confirm subscription + location and check the resource provisioning limit | Azure Context |
| 3 | Generate Artifacts — Create infrastructure and configuration files | generate.md |
| 4 | Harden Security — Apply security best practices | security.md |
| 5 | Functional Verification — Verify the app works (UI + backend), locally if possible | functional-verification.md |
| 6 | ⛔ Update Plan (MANDATORY before hand-off) — Use the edit tool to change the Status in .azure/deployment-plan.md to Ready for Validation. You MUST complete this edit BEFORE invoking azure-validate. Do NOT skip this step. | .azure/deployment-plan.md |
| 7 | ⛔ MANDATORY Hand Off — Invoke azure-validate skill. Your preparation work is done. Do NOT run azd up, azd deploy, or any deployment command directly — all deployment execution is handled by azure-deploy after azure-validate completes. PREREQUISITE: Step 6 must be completed first — .azure/deployment-plan.md status must say Ready for Validation. | — |
Outputs
| Artifact | Location |
|---|---|
| Plan | .azure/deployment-plan.md |
| Infrastructure | ./infra/ |
| AZD Config | azure.yaml (AZD only) |
| Dockerfiles | src/<component>/Dockerfile |
SDK Quick References
- Azure Developer CLI: azd
- Azure Identity: Python | .NET | TypeScript | Java
- App Configuration: Python | TypeScript | Java
Next
⛔ MANDATORY NEXT STEP — DO NOT SKIP
After completing preparation, you MUST invoke azure-validate before any deployment attempt. Do NOT skip validation. Do NOT go directly to azure-deploy. Do NOT run
azd upor any deployment command directly. The workflow is:
azure-prepare→azure-validate→azure-deploy⛔ BEFORE invoking azure-validate, you MUST use the
edittool to update.azure/deployment-plan.mdstatus toReady for Validation. If the plan status has not been updated, the validation will fail.This applies to ALL deployment scenarios including containerized apps, Container Apps, App Service, Azure Functions, static sites, and any other Azure target. No exceptions.
Skipping validation leads to deployment failures. Be patient and follow the complete workflow for the highest success outcome.
→ Update plan status to Ready for Validation, then invoke azure-validate
FAQ
What does the azure-prepare skill do?
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
How do I install azure-prepare?
Run npx skills add https://github.com/microsoft/azure-skills --skill azure-prepare in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/azure-prepare/ (personal) or .claude/skills/azure-prepare/ (project).
Which AI agents can use azure-prepare?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is azure-prepare safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket flagged items to review; Snyk passed; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains azure-prepare?
It is published by microsoft in microsoft/azure-skills, and it is an official skill from the maker of the technology it covers. It has 569,011 recorded installs.
More from microsoft/azure-skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.
azure-storage
microsoft/azure-skills
Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue storage, table storage, data lake, upload files, download blobs, storage accounts, access tiers, storage tiers, hot cool cold archive, storage tier comparison, when to use storage tiers, lifecycle management, Azure Storage concepts. DO NOT USE FOR: SQL databases, Cosmos DB (use azure-prepare), messaging with Event Hubs or Service Bus (use azure-messaging).
Popular devops & cloud skills
wizard
mattpocock/skills
Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.
google-agents-cli-deploy
google/agents-cli
This skill should be used when the user wants to "deploy an agent", "deploy my ADK agent", "set up CI/CD", "configure secrets", "troubleshoot a deployment", or needs guidance on Agent Runtime, Cloud Run, or GKE deployment targets, or binding an agent to an Agent Gateway. Covers deployment workflows, service accounts, rollback, and production infrastructure. Applies to any framework agents-cli deploys (ADK, LangChain, ...). Part of the agents-cli skills suite. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), evaluation (use google-agents-cli-eval), or project scaffolding (use google-agents-cli-scaffold).
google-agents-cli-scaffold
google/agents-cli
This skill should be used when the user wants to "create an agent project", "start a new ADK project", "build me a new agent", "add CI/CD to my project", "add deployment", "enhance my project", or "upgrade my project". Part of the agents-cli skills suite. Covers agents-cli scaffold create, scaffold enhance, and scaffold upgrade commands, template options, deployment targets, and the prototype-first workflow. Do NOT use for writing agent code (ADK projects: use google-agents-cli-adk-code) or deployment operations (use google-agents-cli-deploy).
google-agents-cli-observability
google/agents-cli
This skill should be used when the user wants to "set up tracing", "monitor my agent", "configure logging", "add observability", "debug production traffic", or needs guidance on monitoring deployed agents, including ADK (Agent Development Kit) agents. Covers Cloud Trace, prompt-response logging, BigQuery Agent Analytics, third-party integrations (AgentOps, Phoenix, MLflow, etc.), and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment setup (use google-agents-cli-deploy) or API code patterns (use google-agents-cli-adk-code).
vercel-composition-patterns
vercel-labs/agent-skills
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
sentry-cli
sentry/dev
Guide for using the Sentry CLI to interact with Sentry from the command line. Use when the user asks about viewing issues, events, projects, organizations, making API calls, or authenticating with Sentry via CLI.