Azure Cloud Migrate

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Cloud and DevOps
MIT
Low risk

From the author

Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud Run migration, Fargate to ACA, ECS/Kubernetes/GKE/EKS to Container Apps, Spring Boot to Container Apps, cross-cloud migration.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Cloud Migrate provides a structured, multi-phase workflow for transitioning applications from various cloud platforms to Azure. It focuses on assessing the current architecture, mapping services to Azure equivalents, and performing the necessary code and configuration conversions. The skill ensures a methodical approach by requiring an assessment report before any migration actions occur, and it provides specific guidance for common migration paths such as AWS Lambda to Azure Functions, Heroku to App Service, and Kubernetes to Container Apps.

What it does

Generates comprehensive migration assessment reports for cross-cloud workloads.
Maps source platform services, compute configurations, and dependencies to Azure equivalents.
Provides guidance for converting application code and configuration files.
Audits source code for platform-specific service discovery patterns.
Creates architecture diagrams for both current and target states.
Tracks migration progress and provides resource-level status updates.

When to use it

When planning to migrate workloads from AWS Lambda, Elastic Beanstalk, or Fargate to Azure.
When moving applications from Heroku or Google App Engine to Azure App Service.
When transitioning Kubernetes or Cloud Run deployments to Azure Container Apps.
When you need a structured assessment of migration readiness and effort.

Advantages

Ensures a consistent, step-by-step migration process.
Reduces risk by requiring a detailed assessment report before code changes.
Provides clear mapping between source platform features and Azure services.
Includes specific checks for common migration pitfalls like hardcoded service discovery.

Usage examples

“Assess my current AWS Lambda project for migration to Azure Functions.”: The agent will analyze the Lambda project, map the services to Azure Functions, and generate a migration assessment report in the output directory.
“Migrate my Heroku application to Azure App Service.”: The agent will perform an assessment, guide the conversion of configuration files, and assist in setting up the application for Azure App Service.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-cloud-migrate/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-cloud-migrate.zip -d .agents/skills

Documentation by Microsoft

Azure Cloud Migrate

This skill handles assessment and code migration of existing cloud workloads to Azure.

Rules

Follow phases sequentially — do not skip
Generate assessment before any code migration
Load the scenario reference and follow its rules
Use mcp_azure_mcp_get_azure_bestpractices and mcp_azure_mcp_documentation MCP tools
Use the latest supported runtime for the target service
Destructive actions require ask_user — functions global-rules | app-service global-rules
Report progress to user — During long-running operations (deployments, image pushes), provide resource-level status updates so the user is never left waiting without feedback — see workflow-details.md
Audit service discovery in app code — Kubernetes DNS names (e.g., http://order-service:3001) do not resolve in Container Apps. During assessment, scan source code for hardcoded hostnames/ports in HTTP clients and flag them for env-var-driven URL injection

Migration Scenarios

Source	Target	Reference
AWS Lambda	Azure Functions	lambda-to-functions.md (assessment, code-migration)
AWS Elastic Beanstalk	Azure App Service	beanstalk-to-app-service.md
Heroku	Azure App Service	heroku-to-app-service.md
Google App Engine	Azure App Service	app-engine-to-app-service.md
AWS Fargate (ECS)	Azure Container Apps	fargate-to-container-apps.md (assessment, deployment)
Kubernetes (GKE/EKS/Self-hosted)	Azure Container Apps	k8s-to-container-apps.md
GCP Cloud Run	Azure Container Apps	cloudrun-to-container-apps.md
Spring Boot (Azure Spring Apps/VMs)	Azure Container Apps	spring-apps-to-aca.md

No matching scenario? Use mcp_azure_mcp_documentation and mcp_azure_mcp_get_azure_bestpractices tools.

Output Directory

All output goes to <workspace-root-basename>-azure/ at workspace root, where <workspace-root-basename> is the name of the top-level workspace directory itself (NOT a subdirectory within it). Never modify the source directory.

Steps

Create <workspace-root-basename>-azure/ at workspace root
Assess — Analyze source, map services, generate report using the scenario-specific assessment guide → functions assessment | app-service assessment
Migrate — Convert code/config using the scenario-specific migration guide → functions code-migration | app-service code-migration
Ask User — "Migration complete. Test locally or deploy to Azure?"
Hand off to azure-prepare for infrastructure, testing, and deployment

Track progress in migration-status.md — see workflow-details.md.

Files

ATTRIBUTION.mdAdded by AutoGineer989 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md4.3 KiB
references/services/app-service/app-engine-to-app-service.md7.1 KiB
references/services/app-service/assessment.md5.2 KiB
references/services/app-service/beanstalk-to-app-service.md6.4 KiB
references/services/app-service/code-migration.md5.0 KiB
references/services/app-service/global-rules.md2.8 KiB
references/services/app-service/heroku-to-app-service.md7.5 KiB
references/services/container-apps/assessment-guide.md7.0 KiB
references/services/container-apps/cloudrun-assessment-guide.md2.5 KiB
references/services/container-apps/cloudrun-deployment-guide.md7.9 KiB
references/services/container-apps/cloudrun-to-container-apps.md2.2 KiB
references/services/container-apps/deployment-guide.md9.6 KiB
references/services/container-apps/fargate-assessment-guide.md2.4 KiB
references/services/container-apps/fargate-deployment-guide.md10.1 KiB
references/services/container-apps/fargate-to-container-apps.md4.0 KiB
references/services/container-apps/k8s-to-container-apps.md4.9 KiB
references/services/container-apps/spring-apps-to-aca.md3.8 KiB
references/services/container-apps/spring-assessment-guide.md5.2 KiB
references/services/container-apps/spring-dependency-patterns.md1.2 KiB
references/services/container-apps/spring-deployment-guide.md15.1 KiB
references/services/functions/assessment.md6.3 KiB
references/services/functions/code-migration.md6.0 KiB
references/services/functions/global-rules.md3.3 KiB
references/services/functions/lambda-to-functions.md10.2 KiB
references/services/functions/runtimes/csharp.md5.5 KiB
references/services/functions/runtimes/java.md6.4 KiB
references/services/functions/runtimes/javascript.md8.5 KiB
references/services/functions/runtimes/powershell.md5.0 KiB
references/services/functions/runtimes/python.md6.4 KiB
references/services/functions/runtimes/typescript.md3.5 KiB
references/workflow-details.md2.3 KiB

references/services/container-apps/cloudrun-deployment-guide.md

Deployment: Cloud Run to Container Apps

Prerequisites

Azure CLI 2.53+, gcloud CLI, Docker, ACR, Key Vault, Log Analytics

Phase 1: Image Migration

Bash

set -euo pipefail
GCP_PROJECT="${GCP_PROJECT:-<project>}"
GCP_REGION="${GCP_REGION:-<region>}"
ACR_NAME="${ACR_NAME:-<acr>}"

gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev"
az acr login --name "$ACR_NAME"
for img in "app:v1" "worker:v1"; do
  docker pull "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$img"
  docker tag "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$img" "${ACR_NAME}.azurecr.io/$img"
  docker push "${ACR_NAME}.azurecr.io/$img"
done

PowerShell

$GCP_PROJECT = if ($env:GCP_PROJECT) { $env:GCP_PROJECT } else { "<project>" }
$GCP_REGION = if ($env:GCP_REGION) { $env:GCP_REGION } else { "<region>" }
$ACR_NAME = if ($env:ACR_NAME) { $env:ACR_NAME } else { "<acr>" }

gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev"
az acr login --name $ACR_NAME
@("app:v1", "worker:v1") | ForEach-Object {
  docker pull "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$_"
  docker tag "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$_" "${ACR_NAME}.azurecr.io/$_"
  docker push "${ACR_NAME}.azurecr.io/$_"
}

Phase 2: Infrastructure

Choose ONE path: basic (without VNet) OR VNet-integrated.

Basic (no VNet)

Bash

set -euo pipefail
az group create --name "$RG" --location "$LOCATION"
az monitor log-analytics workspace create -g "$RG" -n "${RG}-logs" -l "$LOCATION"
LOG_ID=$(az monitor log-analytics workspace show -g "$RG" -n "${RG}-logs" --query customerId -o tsv)
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primarySharedKey -o tsv)
az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \
  --logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"

PowerShell

az group create --name $RG --location $LOCATION
az monitor log-analytics workspace create -g $RG -n "${RG}-logs" -l $LOCATION
$workspace = az monitor log-analytics workspace show -g $RG -n "${RG}-logs" | ConvertFrom-Json
$keys = az monitor log-analytics workspace get-shared-keys -g $RG -n "${RG}-logs" | ConvertFrom-Json
az containerapp env create -n "${RG}-env" -g $RG -l $LOCATION `
  --logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey

VNet-Integrated

Bash

set -euo pipefail
az network vnet create -g "$RG" -n "${RG}-vnet" \
  --address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/23
SUBNET_ID=$(az network vnet subnet show -g "$RG" --vnet-name "${RG}-vnet" -n aca-subnet --query id -o tsv)
az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \
  --logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \
  --infrastructure-subnet-resource-id "$SUBNET_ID"

PowerShell

az network vnet create -g $RG -n "${RG}-vnet" `
  --address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/23
$subnet = az network vnet subnet show -g $RG --vnet-name "${RG}-vnet" -n aca-subnet | ConvertFrom-Json
az containerapp env create -n "${RG}-env" -g $RG -l $LOCATION `
  --logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `
  --infrastructure-subnet-resource-id $subnet.id

Phase 3: Secrets & Identity

Bash

set -euo pipefail
az keyvault create --name "$KEY_VAULT" -g "$RG" -l "$LOCATION"
IDENTITY_ID=$(az identity create -n "${RG}-id" -g "$RG" -l "$LOCATION" --query id -o tsv)
PRINCIPAL_ID=$(az identity show --ids "$IDENTITY_ID" --query principalId -o tsv)

# Grant Key Vault access — use RBAC (recommended) or access policies
# Option A: RBAC (default for new vaults)
KV_ID=$(az keyvault show --name "$KEY_VAULT" --query id -o tsv)
az role assignment create --assignee "$PRINCIPAL_ID" \
  --role "Key Vault Secrets User" --scope "$KV_ID"
# Option B: Access policies (if vault uses access-policy mode)
# az keyvault set-policy --name "$KEY_VAULT" --object-id "$PRINCIPAL_ID" --secret-permissions get list

# Migrate secrets without writing them to disk
az keyvault secret set --vault-name "$KEY_VAULT" --name <secret-name> \
  --value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"

# ACR pull access
ACR_ID=$(az acr show --name "$ACR_NAME" --query id -o tsv)
az role assignment create --assignee "$PRINCIPAL_ID" --role AcrPull --scope "$ACR_ID"

PowerShell

az keyvault create --name $KEY_VAULT -g $RG -l $LOCATION
$identity = az identity create -n "${RG}-id" -g $RG -l $LOCATION | ConvertFrom-Json
$principalId = (az identity show --ids $identity.id | ConvertFrom-Json).principalId

# Grant Key Vault access — RBAC (recommended)
$kvId = (az keyvault show --name $KEY_VAULT | ConvertFrom-Json).id
az role assignment create --assignee $principalId `
  --role "Key Vault Secrets User" --scope $kvId

# Migrate secrets without writing them to disk
$secretValue = gcloud secrets versions access latest --secret=<secret-id> --project=$GCP_PROJECT
az keyvault secret set --vault-name $KEY_VAULT --name <secret-name> --value $secretValue
Remove-Variable secretValue

# ACR pull access
$acrId = (az acr show --name $ACR_NAME | ConvertFrom-Json).id
az role assignment create --assignee $principalId --role AcrPull --scope $acrId

Phase 4: Deploy Container App

Bash

set -euo pipefail
SECRET_URI=$(az keyvault secret show --vault-name "$KEY_VAULT" --name db-pw --query id -o tsv)
az containerapp create \
  --name <app-name> -g "$RG" --environment "${RG}-env" \
  --image "${ACR_NAME}.azurecr.io/app:v1" --target-port 8080 --ingress external \
  --cpu 1.0 --memory 1Gi --min-replicas 0 --max-replicas 10 \
  --user-assigned "$IDENTITY_ID" --registry-identity "$IDENTITY_ID" \
  --registry-server "${ACR_NAME}.azurecr.io" \
  --secrets db-pw=keyvaultref:"${SECRET_URI}",identityref:"${IDENTITY_ID}" \
  --env-vars ENV=prod DB_PASSWORD=secretref:db-pw \
  --scale-rule-name http --scale-rule-type http --scale-rule-http-concurrency 80

PowerShell

$secret = az keyvault secret show --vault-name $KEY_VAULT --name db-pw | ConvertFrom-Json
az containerapp create `
  --name <app-name> -g $RG --environment "${RG}-env" `
  --image "${ACR_NAME}.azurecr.io/app:v1" --target-port 8080 --ingress external `
  --cpu 1.0 --memory 1Gi --min-replicas 0 --max-replicas 10 `
  --user-assigned $identity.id --registry-identity $identity.id `
  --registry-server "${ACR_NAME}.azurecr.io" `
  --secrets "db-pw=keyvaultref:$($secret.id),identityref:$($identity.id)" `
  --env-vars "ENV=prod" "DB_PASSWORD=secretref:db-pw" `
  --scale-rule-name http --scale-rule-type http --scale-rule-http-concurrency 80

Configuration Mapping

Cloud Run	Container Apps
`--min-instances 0`	`--min-replicas 0`
`--max-instances 10`	`--max-replicas 10`
`--concurrency 80`	`--scale-rule-http-concurrency 80`
`--cpu 1`	`--cpu 1.0`
`--memory 512Mi`	`--memory 1Gi`

Phase 5: Validation

Bash

FQDN=$(az containerapp show --name <app-name> -g "$RG" --query properties.configuration.ingress.fqdn -o tsv)
curl -I "https://$FQDN/health"
az containerapp logs show --name <app-name> -g "$RG" --tail 100

PowerShell

$app = az containerapp show --name <app-name> -g $RG | ConvertFrom-Json
Invoke-WebRequest -Uri "https://$($app.properties.configuration.ingress.fqdn)/health"
az containerapp logs show --name <app-name> -g $RG --tail 100

Troubleshooting

Issue	Solution
Image pull fails	Verify ACR role: `az role assignment list --assignee $PRINCIPAL_ID --scope $ACR_ID -o table`
App won't start	Check logs: `az containerapp logs show --name <app> -g $RG --tail 100`
Secret not accessible	Verify RBAC: `az role assignment list --assignee $PRINCIPAL_ID --scope $KV_ID -o table`
Scaling not working	Check config: `az containerapp show --name <app> --query properties.template.scale`

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-cloud-migrate · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-cloud-migrate.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Cloud Migrate

Rules

Migration Scenarios

Output Directory

Steps

Files

references/services/container-apps/cloudrun-deployment-guide.md

Deployment: Cloud Run to Container Apps

Prerequisites

Phase 1: Image Migration

Bash

PowerShell

Phase 2: Infrastructure

Basic (no VNet)

Bash

PowerShell

VNet-Integrated

Bash

PowerShell

Phase 3: Secrets & Identity

Bash

PowerShell

Phase 4: Deploy Container App

Bash

PowerShell

Configuration Mapping

Phase 5: Validation

Bash

PowerShell

Troubleshooting

Requirements and compatibility

Security

Attribution and licence

Related skills

Modal

Cloud Infrastructure Network Engineer

Deployment Validation Cloud Architect

Airflow Dag Patterns

Cost Optimization

Hybrid Cloud Networking

Download ZIP