Azure Deployment Preflight

GitHubOfficialFirst committed by tmeschterDistributed by GitHub

Skill
Tool integration
Cloud and DevOps
MIT
No issues found

From the author

Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.

— the description by tmeschter

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured preflight validation process for Azure infrastructure deployments. It supports both standalone Bicep files and Azure Developer CLI (azd) projects. By performing syntax checks, permission verification, and what-if impact analysis, it helps identify potential deployment failures or unintended infrastructure changes before they occur. The skill generates a comprehensive Markdown report detailing all findings, errors, and recommended remediation steps.

What it does

Detects project type (azd vs. standalone) and locates relevant Bicep and parameter files.
Validates Bicep template syntax to catch compilation errors early.
Executes what-if analysis to preview resource creation, modification, or deletion.
Performs permission checks and offers a fallback to read-only validation if RBAC is restricted.
Generates a standardized preflight report in the project root.
Provides actionable remediation steps for identified issues.

When to use it

Before executing any infrastructure deployment to Azure.
When reviewing or updating Bicep infrastructure code.
To verify that current credentials have sufficient permissions for a deployment.
To preview the impact of infrastructure changes before applying them.

Advantages

Reduces deployment failures by catching errors before execution.
Provides visibility into infrastructure changes via what-if analysis.
Standardizes the validation process across different project types.
Ensures a complete audit trail of validation results via generated reports.
Handles permission limitations gracefully with fallback strategies.

Usage examples

“Validate my Bicep deployment before I run it.”: The agent detects the project type, runs syntax checks and what-if analysis, and generates a preflight-report.md file summarizing the deployment impact and any issues.
“Check if my infrastructure changes are safe to deploy.”: The agent performs a what-if analysis to list resources that will be created, modified, or deleted, allowing the user to review changes before proceeding.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/github/azure-deployment-preflight/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-deployment-preflight.zip -d .agents/skills

Documentation by tmeschter

Azure Deployment Preflight Validation

This skill validates Bicep deployments before execution, supporting both Azure CLI (az) and Azure Developer CLI (azd) workflows.

When to Use This Skill

Before deploying infrastructure to Azure
When preparing or reviewing Bicep files
To preview what changes a deployment will make
To verify permissions are sufficient for deployment
Before running azd up, azd provision, or az deployment commands

Validation Process

Follow these steps in order. Continue to the next step even if a previous step fails—capture all issues in the final report.

Step 1: Detect Project Type

Determine the deployment workflow by checking for project indicators:

Check for azd project: Look for azure.yaml in the project root
- If found → Use azd workflow
- If not found → Use az CLI workflow
Locate Bicep files: Find all .bicep files to validate
- For azd projects: Check infra/ directory first, then project root
- For standalone: Use the file specified by the user or search common locations (infra/, deploy/, project root)
Auto-detect parameter files: For each Bicep file, look for matching parameter files:
- <filename>.bicepparam (Bicep parameters - preferred)
- <filename>.parameters.json (JSON parameters)
- parameters.json or parameters/<env>.json in same directory

Step 2: Validate Bicep Syntax

Run Bicep CLI to check template syntax before attempting deployment validation:

bicep build <bicep-file> --stdout

What to capture:

Syntax errors with line/column numbers
Warning messages
Build success/failure status

If Bicep CLI is not installed:

Note the issue in the report
Continue to Step 3 (Azure will validate syntax during what-if)

Step 3: Run Preflight Validation

Choose the appropriate validation based on project type detected in Step 1.

For azd Projects (azure.yaml exists)

Use azd provision --preview to validate the deployment:

azd provision --preview

If an environment is specified or multiple environments exist:

azd provision --preview --environment <env-name>

For Standalone Bicep (no azure.yaml)

Determine the deployment scope from the Bicep file's targetScope declaration:

Target Scope	Command
`resourceGroup` (default)	`az deployment group what-if`
`subscription`	`az deployment sub what-if`
`managementGroup`	`az deployment mg what-if`
`tenant`	`az deployment tenant what-if`

Run with Provider validation level first:

# Resource Group scope (most common)
az deployment group what-if \
  --resource-group <rg-name> \
  --template-file <bicep-file> \
  --parameters <param-file> \
  --validation-level Provider

# Subscription scope
az deployment sub what-if \
  --location <location> \
  --template-file <bicep-file> \
  --parameters <param-file> \
  --validation-level Provider

# Management Group scope
az deployment mg what-if \
  --location <location> \
  --management-group-id <mg-id> \
  --template-file <bicep-file> \
  --parameters <param-file> \
  --validation-level Provider

# Tenant scope
az deployment tenant what-if \
  --location <location> \
  --template-file <bicep-file> \
  --parameters <param-file> \
  --validation-level Provider

Fallback Strategy:

If --validation-level Provider fails with permission errors (RBAC), retry with ProviderNoRbac:

az deployment group what-if \
  --resource-group <rg-name> \
  --template-file <bicep-file> \
  --validation-level ProviderNoRbac

Note the fallback in the report—the user may lack full deployment permissions.

Step 4: Capture What-If Results

Parse the what-if output to categorize resource changes:

Change Type	Symbol	Meaning
Create	`+`	New resource will be created
Delete	`-`	Resource will be deleted
Modify	`~`	Resource properties will change
NoChange	`=`	Resource unchanged
Ignore	`*`	Resource not analyzed (limits reached)
Deploy	`!`	Resource will be deployed (changes unknown)

For modified resources, capture the specific property changes.

Step 5: Generate Report

Create a Markdown report file in the project root named:

preflight-report.md

Use the template structure from references/REPORT-TEMPLATE.md.

Report sections:

Summary - Overall status, timestamp, files validated, target scope
Tools Executed - Commands run, versions, validation levels used
Issues - All errors and warnings with severity and remediation
What-If Results - Resources to create/modify/delete/unchanged
Recommendations - Actionable next steps

Required Information

Before running validation, gather:

Information	Required For	How to Obtain
Resource Group	`az deployment group`	Ask user or check existing `.azure/` config
Subscription	All deployments	`az account show` or ask user
Location	Sub/MG/Tenant scope	Ask user or use default from config
Environment	azd projects	`azd env list` or ask user

If required information is missing, prompt the user before proceeding.

Error Handling

See references/ERROR-HANDLING.md for detailed error handling guidance.

Key principle: Continue validation even when errors occur. Capture all issues in the final report.

Error Type	Action
Not logged in	Note in report, suggest `az login` or `azd auth login`
Permission denied	Fall back to `ProviderNoRbac`, note in report
Bicep syntax error	Include all errors, continue to other files
Tool not installed	Note in report, skip that validation step
Resource group not found	Note in report, suggest creating it

Tool Requirements

This skill uses the following tools:

Azure CLI (az) - Version 2.76.0+ recommended for --validation-level
Azure Developer CLI (azd) - For projects with azure.yaml
Bicep CLI (bicep) - For syntax validation
Azure MCP Tools - For documentation lookups and best practices

Check tool availability before starting:

az --version
azd version
bicep --version

Example Workflow

User: "Validate my Bicep deployment before I run it"
Agent detects azure.yaml → azd project
Agent finds infra/main.bicep and infra/main.bicepparam
Agent runs bicep build infra/main.bicep --stdout
Agent runs azd provision --preview
Agent generates preflight-report.md in project root
Agent summarizes findings to user

Reference Documentation

Files

ATTRIBUTION.mdAdded by AutoGineer887 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md7.3 KiB
references/ERROR-HANDLING.md8.7 KiB
references/REPORT-TEMPLATE.md7.3 KiB
references/VALIDATION-COMMANDS.md8.2 KiB

references/ERROR-HANDLING.md

Error Handling Guide

This reference documents common errors during preflight validation and how to handle them.

Core Principle

Continue on failure. Capture all issues in the final report rather than stopping at the first error. This gives users a complete picture of what needs to be fixed.

Authentication Errors

Not Logged In (Azure CLI)

Detection:

ERROR: Please run 'az login' to setup account.
ERROR: AADSTS700082: The refresh token has expired

Exit Codes: Non-zero

Handling:

Note the error in the report
Include remediation steps
Skip remaining Azure CLI commands
Continue with other validation steps if possible

Report Entry:

#### ❌ Azure CLI Authentication Required

- **Severity:** Error
- **Source:** az cli
- **Message:** Not logged in to Azure CLI
- **Remediation:** Run `az login` to authenticate, then re-run preflight validation
- **Documentation:** https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli

Not Logged In (azd)

Detection:

ERROR: not logged in, run `azd auth login` to login

Handling:

Note the error in the report
Skip azd commands
Suggest azd auth login

Report Entry:

#### ❌ Azure Developer CLI Authentication Required

- **Severity:** Error
- **Source:** azd
- **Message:** Not logged in to Azure Developer CLI
- **Remediation:** Run `azd auth login` to authenticate, then re-run preflight validation

Token Expired

Detection:

AADSTS700024: Client assertion is not within its valid time range
AADSTS50173: The provided grant has expired

Handling:

Note the error
Suggest re-authentication
Skip Azure operations

Permission Errors

Insufficient RBAC Permissions

Detection:

AuthorizationFailed: The client '...' with object id '...' does not have authorization 
to perform action '...' over scope '...'

Handling:

First attempt: Retry with --validation-level ProviderNoRbac
Note the permission limitation in the report
If ProviderNoRbac also fails, report the specific missing permission

Report Entry:

#### ⚠️ Limited Permission Validation

- **Severity:** Warning
- **Source:** what-if
- **Message:** Full RBAC validation failed; using read-only validation
- **Detail:** Missing permission: `Microsoft.Resources/deployments/write` on scope `/subscriptions/xxx`
- **Recommendation:** Request Contributor role on the target resource group, or verify deployment permissions with your administrator

Resource Group Not Found

Detection:

ResourceGroupNotFound: Resource group 'xxx' could not be found.

Handling:

Note in report
Suggest creating the resource group
Skip what-if for this scope

Report Entry:

#### ❌ Resource Group Does Not Exist

- **Severity:** Error
- **Source:** what-if
- **Message:** Resource group 'my-rg' does not exist
- **Remediation:** Create the resource group before deployment:
  ```bash
  az group create --name my-rg --location eastus


### Subscription Access Denied

**Detection:**

SubscriptionNotFound: The subscription 'xxx' could not be found. InvalidSubscriptionId: Subscription '...' is not valid


**Handling:**
1. Note in report
2. Suggest checking subscription ID
3. List available subscriptions

---

## Bicep Syntax Errors

### Compilation Errors

**Detection:**

/path/main.bicep(22,51) : Error BCP064: Found unexpected tokens /path/main.bicep(10,5) : Error BCP018: Expected the "=" character at this location


**Handling:**
1. Parse error output for line/column numbers
2. Include all errors in report (don't stop at first)
3. Continue to what-if (may provide additional context)

**Report Entry:**
```markdown
#### ❌ Bicep Syntax Error

- **Severity:** Error
- **Source:** bicep build
- **Location:** `main.bicep:22:51`
- **Code:** BCP064
- **Message:** Found unexpected tokens in interpolated expression
- **Remediation:** Check the string interpolation syntax at line 22
- **Documentation:** https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/diagnostics/bcp064

Module Not Found

Detection:

Error BCP091: An error occurred reading file. Could not find file '...'
Error BCP190: The module is not valid

Handling:

Note missing module
Check if bicep restore is needed
Verify module path

Parameter File Issues

Detection:

Error BCP032: The value must be a compile-time constant
Error BCP035: The specified object is missing required properties

Handling:

Note parameter issues
Indicate which parameters are problematic
Suggest fixes

Tool Not Installed

Azure CLI Not Found

Detection:

'az' is not recognized as an internal or external command
az: command not found

Handling:

Note in report
Provide installation instructions.

If available use the Azure MCP extension_cli_install tool to get installation instructions.
Otherwise look for instructions at https://learn.microsoft.com/en-us/cli/azure/install-azure-cli.

Skip az commands

Report Entry:

#### ⏭️ Azure CLI Not Installed

- **Severity:** Warning
- **Source:** environment
- **Message:** Azure CLI (az) is not installed or not in PATH
- **Remediation:** Install the Azure CLI <ADD INSTALLATION INSTRUCTIONS HERE>
- **Impact:** What-if validation using az commands was skipped

Bicep CLI Not Found

Detection:

'bicep' is not recognized as an internal or external command
bicep: command not found

Handling:

Note in report
Azure CLI may have built-in Bicep - try az bicep build
Provide installation link

Report Entry:

#### ⏭️ Bicep CLI Not Installed

- **Severity:** Warning
- **Source:** environment
- **Message:** Bicep CLI is not installed
- **Remediation:** Install Bicep CLI: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install
- **Impact:** Syntax validation was skipped; Azure will validate during what-if

Azure Developer CLI Not Found

Detection:

'azd' is not recognized as an internal or external command
azd: command not found

Handling:

If azure.yaml exists, this is required
Fall back to az CLI commands if possible
Note in report

What-If Specific Errors

Nested Template Limits

Detection:

The deployment exceeded the nested template limit of 500

Handling:

Note as warning (not error)
Explain affected resources show as "Ignore"
Suggest manual review

Template Link Not Supported

Detection:

templateLink references in nested deployments won't be visible in what-if

Handling:

Note as warning
Explain limitation
Resources will be verified during actual deployment

Unevaluated Expressions

Detection: Properties showing function names like [utcNow()] instead of values

Handling:

Note as informational
Explain these are evaluated at deployment time
Not an error

Network Errors

Timeout

Detection:

Connection timed out
Request timed out

Handling:

Suggest retry
Check network connectivity
May indicate Azure service issues

SSL/TLS Errors

Detection:

SSL: CERTIFICATE_VERIFY_FAILED
unable to get local issuer certificate

Handling:

Note in report
May indicate proxy or corporate firewall
Suggest checking SSL settings

Fallback Strategy

When primary validation fails, attempt fallbacks in order:

Provider (full RBAC validation)
    ↓ fails with permission error
ProviderNoRbac (validation without write permission check)
    ↓ fails
Template (static syntax only)
    ↓ fails
Report all failures and skip what-if analysis

Always continue to generate the report, even if all validation steps fail.

Error Report Aggregation

When multiple errors occur, aggregate them logically:

Group by source (bicep, what-if, permissions)
Order by severity (errors before warnings)
Deduplicate similar errors
Provide summary count at the top

Example:

## Issues

Found **3 errors** and **2 warnings**

### Errors (3)

1. [Bicep Syntax Error - main.bicep:22:51](#error-1)
2. [Bicep Syntax Error - main.bicep:45:10](#error-2)
3. [Resource Group Not Found](#error-3)

### Warnings (2)

1. [Limited Permission Validation](#warning-1)
2. [Nested Template Limit Reached](#warning-2)

Exit Code Reference

Tool	Exit Code	Meaning
az	0	Success
az	1	General error
az	2	Command not found
az	3	Required argument missing
azd	0	Success
azd	1	Error
bicep	0	Build succeeded
bicep	1	Build failed (errors)
bicep	2	Build succeeded with warnings

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs a command-line tool

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by

tmeschter

Publisher

GitHub (Official)

Distributed by

GitHub

Source

github/awesome-copilot · skills/azure-deployment-preflight · commit 797337f

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Contributors

stbenjam, tmeschter

AutoGineer is not affiliated with or endorsed by tmeschter or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-deployment-preflight.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by tmeschter

Azure Deployment Preflight Validation

When to Use This Skill

Validation Process

Step 1: Detect Project Type

Step 2: Validate Bicep Syntax

Step 3: Run Preflight Validation

For azd Projects (azure.yaml exists)

For Standalone Bicep (no azure.yaml)

Step 4: Capture What-If Results

Step 5: Generate Report

Required Information

Error Handling

Tool Requirements

Example Workflow

Reference Documentation

Files

references/ERROR-HANDLING.md

Error Handling Guide

Core Principle

Authentication Errors

Not Logged In (Azure CLI)

Not Logged In (azd)

Token Expired

Permission Errors

Insufficient RBAC Permissions

Resource Group Not Found

Module Not Found

Parameter File Issues

Tool Not Installed

Azure CLI Not Found

Bicep CLI Not Found

Azure Developer CLI Not Found

What-If Specific Errors

Nested Template Limits

Template Link Not Supported

Unevaluated Expressions

Network Errors

Timeout

SSL/TLS Errors

Fallback Strategy

Error Report Aggregation

Exit Code Reference

Requirements and compatibility

Security

Attribution and licence

Related skills

Deployment Strategies Terraform Specialist

Terraform Module Library

Cloud Infrastructure Terraform Specialist

Cicd Automation Terraform Specialist

Terraform Azure Planning

Terratest Module Testing

Download ZIP