Generated banner for Azure App Onboard
Generated logo for Azure App Onboard

Azure App Onboard

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Workflow
  • Cloud and DevOps
  • MIT
  • Low risk
  • Has scripts

From the author

End-to-end orchestrator: from a business idea, app idea, or existing app to running Azure deployment with cost estimates and pre-deploy approval. Analyzes your app, auto-detects the right Azure services, scaffolds infrastructure code, and deploys — tailored to your app, not a template. Handles moving existing apps to Azure without rewriting or with minimal changes. WHEN: bring your app to Azure, plan my app, cost to run, is my code ready to deploy, deploy my app to the cloud, deploy all my services, what Azure services do I need, plan my Azure deployment, deploy my new app to Azure, one-click deploy, I have an app and want it on Azure, migrate my app to Azure, help me get started, build an app, no code yet, starter project. DO NOT USE FOR: use azd for deployment(use azure-deploy), optimizing existing costs (use cost-optimization), code readiness checks only (use azure-app-onboard-prereq).
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure App Onboard is a comprehensive workflow agent designed to take a business idea or an existing codebase and transition it to a running Azure deployment. It automates the entire lifecycle from initial discovery and architecture planning to infrastructure scaffolding and final deployment. The skill is built to be intelligent and tailored, analyzing the specific requirements of your application rather than relying on generic templates. It includes built-in approval gates for both the architecture plan and the final deployment, ensuring you maintain control over costs and resource configuration throughout the process.

What it does

  • Analyzes your application code or business idea to determine the optimal Azure service stack.
  • Generates custom infrastructure-as-code (IaC) files tailored to your specific application needs.
  • Provides detailed cost estimates for the proposed Azure infrastructure before deployment.
  • Executes the deployment of resources directly to your Azure subscription.
  • Handles the migration of existing applications to Azure with minimal code changes.
  • Provides a structured, step-by-step onboarding experience for developers of all experience levels.

When to use it

  • When you have an application and want to deploy it to Azure but are unsure which services to use.
  • When you need to migrate an existing application to the cloud without a complete rewrite.
  • When you require a cost estimate for your infrastructure before committing to a deployment.
  • When you need guided, end-to-end assistance for setting up a new Azure project.
  • When you want to verify if your current codebase is ready for a cloud deployment.

Advantages

  • Eliminates guesswork by auto-detecting the right Azure services for your specific stack.
  • Reduces manual effort by automating the scaffolding of infrastructure-as-code.
  • Ensures transparency with mandatory approval gates for architecture and deployment.
  • Provides cost visibility early in the planning phase.
  • Supports a wide range of scenarios from greenfield projects to existing app migrations.

Usage examples

“I have a Python web app and want to deploy it to Azure. Can you help me get started?”
The agent will initiate the discovery phase, scan your codebase, propose an architecture, and guide you through the deployment process.
“I need to move my existing application to Azure, but I'm not sure what services I need. Can you plan this for me?”
The agent will analyze your app's requirements, suggest the appropriate Azure services, and provide a cost estimate for your approval.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/azure-app-onboard/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-app-onboard.zip -d .agents/skills

Documentation by Microsoft

Azure App Onboard

⛔ Every repo goes through the full pipeline (Steps 1–10). No exceptions. Do not skip steps, refuse, or short-circuit based on what you recognize. Follow the Workflow table below sequentially — read each step's references before acting.

Quick Reference

PropertyValue
Best forDevelopers who know what to build but not which Azure services to use
InputsBusiness idea or existing codebase, budget/scale preferences (optional)
OutputsArchitecture plan, cost estimate, IaC files, deployed Azure resources
PhasesDiscover → Architect → Scaffold → Deploy (self-contained, no external skill calls)

When to Use This Skill

  • Deploy existing code without knowing which Azure services to use

  • Check if your existing code is ready to deploy to Azure

  • Move an existing app to Azure without rewriting or with minimal changes

  • Get cost estimates before committing to infrastructure

  • Understand architecture decisions and rejected alternatives

  • Get answers to Azure architecture or service selection questions (e.g., "What database should I use?")

  • Get guided Azure onboarding without prior experience

When NOT to Use

ScenarioUse Instead
Run azd up or execute an existing deploymentazure-deploy
Optimize existing Azure spendcost-optimization from the optional azure-cost plugin
Generate Bicep/Terraform for a known architectureazure-prepare
Validate infrastructure or run preflight checksazure-validate
Troubleshoot a running Azure deploymentazure-diagnostics
Deploy to or manage AKS/Kubernetes directlyazure-kubernetes
Look up or list existing Azure resourcesazure-resource-lookup

If cost-optimization is unavailable, explain that it is provided by the optional azure-cost plugin and direct the user to their client's supported plugin installation flow; do not imply the handoff completed.

Pipeline Rules

⛔ You MUST read references/pipeline-rules.md at the start of every AppOnboard session. It contains approval gates, phase lifecycle, session artifacts, deploy-as-is, and security baseline rules.

Workflow

⛔ Deploy recovery: After deploy gate approval OR before any az deployment/az webapp deploy/az acr build — if you haven't read deploy/PHASE.md, read .copilot-azure/sessions/{id}/deploy-checklist.md first, then deploy/PHASE.md. ⛔ NEVER invoke {"skill": "azure-deploy"} — that is a DIFFERENT skill for a DIFFERENT workflow.

⛔ Post-scaffold transition (MANDATORY): Immediately after scaffold-manifest.json is written, YOUR NEXT ACTION MUST be Step 8 (Deploy Approval Gate) — NOT a summary report, NOT a "here are the generated files" message, NOT a completion signal. Confirm context.json has completedPhases: [...,"scaffold"] + currentPhase: "deploy" (update it yourself if the scaffold subagent didn't). Re-read approval-gates.md § Deploy Gate if evicted from context (scaffold reference loading is heavy), then present the exact prompt: "🚀 Ready to deploy? (Yes / Run manually / Edit plan / Cancel)". This gate is the LAST content in your response — wait for the user's reply.

#StepActionReference
1Session check + Azure loginCreate/resume session, verify Azure CLI auth, resolve subscription + user identity⛔ You MUST read session-protocol.md
2Scope triageCheck azd markers, triage question. Empty workspace or code-only (no infra) → Step 3 directly.⛔ Read intent-gathering.md § Scope Triage
3Prereq scan⛔ Skip if completedPhases includes "prereq". Otherwise: invoke {"skill": "azure-app-onboard-prereq"}. Write prereq-output.json, update context.json. Halt if: overallHealth: "blocked" OR routeToSkill set.
4Gather intentPresent prereq results, confirm stack + Azure services, ask remaining questions.⛔ Read intent-gathering.md § After Prereq Returns
5Plan architectureWrite prepare-plan.json.⛔ You MUST read prepare/PHASE.md
6Scaffold approval gateDisplay plan for user approval BEFORE generating any files.⛔ Read approval-gates.md § Scaffold Gate
7ScaffoldGenerate IaC, self-review. Write scaffold-manifest.json. Update context.json.⛔ You MUST read scaffold/PHASE.md
8Deploy approval gateDisplay validation summary. ⛔ After approval: FIRST read deploy-checklist.md → deploy/PHASE.md. NEVER {"skill": "azure-deploy"}.⛔ Read approval-gates.md § Deploy Gate
9DeployExecute IaC, health-check. Write deploy-result.json.⛔ You MUST read deploy/PHASE.md
10HandoffSurface deployment identity, cleanup commands, next steps.⛔ You MUST read handoff-protocol.md

Error Handling

ErrorRemediation
Phase failsHalt, report phase + error. User decides: retry, skip, abort.
MCP server unavailableSkip affected checks, add disclaimer to costEstimate.assumptions[] and every approval gate.
Missing RBACReport required role + az role assignment command.

Shared references: MCP tools (cross-phase tool parameters) | IaC resources (Azure resource docs for troubleshooting)

Files

deploy/references/code-deployment-swa.md

Code Deployment — Static Web Apps

Static Web Apps — Content Deployment (Step 6c)

Deploy content using the SWA CLI with deployment token.

Pre-check: Verify swa CLI is installed: npx --yes @azure/[email protected] --version. If not available, install: npm install -g @azure/[email protected].

⛔ Pre-deploy: Build the frontend if SPA source (not pre-built HTML). Check if the SWA component directory has a package.json (or equivalent manifest) with a build script. If yes, detect the package manager from the lockfile (package-lock.json → npm, yarn.lock → yarn, pnpm-lock.yaml → pnpm, bun.lock/bun.lockb → bun; default to npm if no lockfile) and run:

cd {component-path}   # e.g., web/
{pm} install           # npm install, yarn install, pnpm install, etc.
{pm} run build         # npm run build, yarn build, pnpm build, etc.

The deploy path should point to the build output directory — read the framework config to determine the output dir (vite.config.* → build.outDir, next.config.* → .next/ or out/, CRA → build/; default to dist/). If no package.json exists (plain HTML/CSS/JS), deploy the source directory directly — no build needed.

⛔ This is NOT optional for SPA frameworks. Raw JSX/TSX/Vue/Svelte source files cannot be served by SWA — the app must be compiled to static HTML/JS/CSS first. Skipping the build produces a broken deployment.

⛔ Pre-deploy: Update frontend config with deployed backend URLs. If prereq-output.json.cloudSdkSwaps[] mapped cloud SDK endpoints (AWS API Gateway, GCP Cloud Functions) to Azure equivalents, the frontend config file (config.ts, .env, environment.ts) still references the original cloud URLs. After IaC deploy (Step 6), read deploy-result.json.endpoints[] to get the deployed Azure backend URLs. Update the frontend config with these URLs before running swa deploy. This is a string replacement in the config file — NOT a code rewrite. Do NOT defer as a post-deploy step — the SWA will show a broken page if the frontend calls non-existent AWS/GCP endpoints.

StepCommandNotes
1. Get token$token = az staticwebapp secrets list --name {swa} -g {rg} --query "properties.apiKey" -o tsv 2>$nullStore in variable first — do NOT pass inline. ⛔ On Windows, use 2>$null (not 2>&1) — Azure CLI Python warnings corrupt -o tsv output
2. Set env var$env:SWA_CLI_DEPLOYMENT_TOKEN = $token⛔ Use env var ONLY — do NOT pass --deployment-token $token as CLI arg (leaks token in process args / transcript)
3. Copy to temp$tempDir = "C:\temp\swa-deploy"; Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue; New-Item -ItemType Directory -Path $tempDir -Force | Out-Null; Copy-Item -Path .\* -Destination $tempDir -Recurse -Exclude @('.git','.copilot-azure','node_modules','.azure','infra')⛔ MANDATORY on Windows — $env:TEMP often contains spaces (e.g., C:\Users\Jane Doe\AppData\Local\Temp). Always use a short, space-free path on the FIRST attempt — do NOT use $env:TEMP and retry. On macOS/Linux, use /tmp/swa-deploy instead. If a build step ran: copy the build output directory (e.g., {component}/dist/) instead of the entire workspace — Copy-Item -Path {component}\dist\* -Destination $tempDir -Recurse.
4. Deployswa deploy $tempDir --app-name {swaName} --env production⛔ --app-name is MANDATORY — without it, the SWA CLI launches an interactive "create new project?" prompt that fails in automation. {swaName} = the SWA resource name from prepare-plan.json.naming.resources[]. SWA CLI reads SWA_CLI_DEPLOYMENT_TOKEN from env var automatically — do NOT pass --deployment-token flag (leaks token in command args)
5. Clean upRemove-Item -Recurse -Force $tempDirClean temp dir after successful deploy

⛔ az staticwebapp deploy does NOT exist — the correct CLI is swa deploy (from @azure/static-web-apps-cli).

Fallback: Direct StaticSitesClient Upload

If swa deploy fails (binary crash, path errors on Windows), use the underlying StaticSitesClient.exe directly:

# Find the binary bundled with @azure/static-web-apps-cli
$swaCliPath = (Get-Command swa).Source | Split-Path -Parent
$client = Get-ChildItem -Path $swaCliPath -Recurse -Filter "StaticSitesClient*" | Select-Object -First 1

# Upload from PARENT directory with relative paths (avoids "identical to artifact folder" error)
Push-Location (Split-Path $tempDir -Parent)
& $client.FullName upload --app (Split-Path $tempDir -Leaf) --apiToken $token --skipAppBuild true
Pop-Location

⛔ Run from a PARENT directory with a relative --app path. Running from inside the app directory causes StaticSitesClient to error with "Current directory cannot be identical to or contained within artifact folders."

Finalize deploy-result.json (after swa deploy succeeds)

⛔ swa deploy succeeding is NOT the end of the deploy phase. SWA finalizes through the generic Step 8 (see deploy-checklist-template.md §"Before handoff (Step 8)") — overwrite the deploy-result.json skeleton IN PLACE with the full DeployResult contract, not a status+subscriptionId stub. Only the values Step 8 can't derive on the SWA path are below:

  • Hostname — swa deploy produces no ARM endpoint output, so fetch it: $swaHost = az staticwebapp show -n {swa} -g {rg} --query defaultHostname -o tsv

  • endpoints[] — [{ name, url: "https://$swaHost", healthStatus: "healthy" }] (HTTP GET https://$swaHost/ → 2xx confirms healthy)

  • resourceIds[] — include the Microsoft.Web/staticSites resource id

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs Node.js

Security

What our scanner noticed· Low risk

  • Instructions that use the network
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-skills/skills/azure-app-onboard · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-app-onboard.zip