Azure Enterprise Infra Planner

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Cloud and DevOps
MIT
No issues found

From the author

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill guides users through a 7-phase pipeline to design and deploy Azure infrastructure. It processes workload descriptions to generate Bicep or Terraform code, supporting both greenfield deployments and additive updates to existing environments. The process includes research, planning, user approval, and automated validation using security and syntax checks before deployment.

What it does

Extracts insights from workload descriptions to inform infrastructure planning.
Researches Azure best practices and service-specific documentation.
Generates infrastructure plans and corresponding Bicep or Terraform code.
Validates generated IaC using syntax checks and security scanning tools.
Supports additive deployments for existing environments without modifying referenced resources.
Manages multi-resource topologies including networking, identity, and compliance configurations.

When to use it

When planning Azure infrastructure from a workload or architecture description.
When designing hub-spoke networks, landing zones, or multi-region topologies.
When setting up networking components like VNets, firewalls, and private endpoints.
When generating subscription-scope or multi-resource-group infrastructure code.

Advantages

Follows a structured, gated pipeline to ensure plan approval and code validation.
Integrates security scanning and syntax validation into the generation workflow.
Provides support for referencing existing resources to avoid accidental recreation.
Utilizes specific Azure schema data to ensure accurate resource definitions.

Usage examples

“Plan Azure infrastructure for a hub-spoke network with firewalls.”: The agent initiates the 7-phase pipeline, researching networking best practices and generating the corresponding IaC for the requested topology.
“Architect an Azure landing zone.”: The agent guides the user through requirements extraction and resource planning, resulting in a structured infrastructure plan and Bicep or Terraform files.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-enterprise-infra-planner/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-enterprise-infra-planner.zip -d .agents/skills

Documentation by Microsoft

Azure Enterprise Infra Planner

When to Use This Skill

Activate this skill when user wants to:

Plan enterprise Azure infrastructure from a workload or architecture description
Architect a landing zone, hub-spoke network, or multi-region topology
Design networking infrastructure: VNets, subnets, firewalls, private endpoints, VPN gateways
Plan identity, RBAC, and compliance-driven infrastructure
Generate Bicep or Terraform for subscription-scope or multi-resource-group deployments
Plan disaster recovery, failover, or cross-region high-availability topologies

Quick Reference

Property	Details
MCP tools	`insights_get`, `get_azure_bestpractices_get`, `wellarchitectedframework_serviceguide_get`, `microsoft_docs_fetch`, `microsoft_docs_search`, `bicepschema_get`
CLI commands	`az deployment group create`, `az bicep build`, `az resource list`, `terraform init`, `terraform plan`, `terraform validate`, `terraform apply`, `checkov`
Output schema	schema.md
Key references	workflow.md, waf-checklist.md, resources/, constraints/

Workflow (Start Here)

Follow the step-by-step instructions in workflow.md to execute the 7 phases of infrastructure planning and provisioning.

Architecture

The skill runs a 7-phase, gated pipeline. Input is triaged into one of two flows:

Greenfield — only new requirements; run the phases straight through.
Referenced (brownfield) — the user supplies something that already exists (a live resource / resource group / subscription, IaC or an infra plan, or a requirements doc). The same phases run, plus referenced-workload.md: existing resources are inventoried and referenced (never recreated), the new workload is wired into them, and Phase 7 deploys additively (incremental only — never modifying or destroying the referenced resources).

Every phase advances only after its gate passes. Phase 5 requires explicit user approval; Phase 6 is a hardened, self-verifying gate — the generated IaC must be secure-by-default, pass local validation (az bicep build / terraform validate) with zero errors, pass a checkov security scan with no unresolved high/critical findings, and the skill must show the command output and emit a completion self-check before advancing; Phase 7 requires an explicit, risk-acknowledged deploy confirmation.

flowchart TD
    IN([Input]) --> TRIAGE{Existing infra<br/>referenced?}
    TRIAGE -- "No (greenfield)" --> P1
    TRIAGE -- "Yes (referenced)" --> RW[/referenced-workload.md:<br/>inventory + assign roles<br/>reference, never recreate/]
    RW --> P1

    subgraph PIPE [7-phase gated pipeline]
        direction TB
        P1[Phase 1 · Extract insights] --> P2[Phase 2 · Research best practices]
        P2 --> P3[Phase 3 · Research resources]
        P3 --> P4[Phase 4 · Generate plan]
        P4 --> P5{Phase 5 · Verify<br/>user approves?}
        P5 -- "no" --> P4
        P5 -- "approved" --> P6[Phase 6 · Generate IaC]
        P6 --> VAL{Validate<br/>az bicep build /<br/>terraform validate}
        VAL -- "errors" --> P6
        VAL -- "clean" --> P7{Phase 7 · Deploy<br/>risk-ack confirm?}
    end

    P7 -- "greenfield" --> DEP[az deployment / terraform apply]
    P7 -- "referenced" --> DEPADD[Additive deploy · incremental only<br/>what-if preview · no destroy of<br/>referenced resources]
    DEP --> OUT([Deployed])
    DEPADD --> OUT

    classDef gate fill:#fff3cd,stroke:#d39e00,color:#000;
    classDef ref fill:#e2f0d9,stroke:#548235,color:#000;
    class P5,VAL,P7,TRIAGE gate;
    class RW,DEPADD ref;

Artifacts (written under <project-root>/): .azure/insights.json (Phase 1), .azure/infrastructure-plan.json (Phase 4, status draft→approved→deployed), and infra/main.bicep + infra/modules/* or infra/main.tf + infra/modules/** (Phase 6).

MCP Tools

Tool	Purpose
`insights_get`	Retrieve insights about the user's existing Azure environment to guide planning decisions
`get_azure_bestpractices_get`	Azure best practices for code generation, operations, and deployment
`wellarchitectedframework_serviceguide_get`	WAF service guide for a specific Azure service
`microsoft_docs_search`	Search Microsoft Learn for relevant documentation chunks
`microsoft_docs_fetch`	Fetch full content of a Microsoft Learn page by URL
`bicepschema_get`	Bicep schema definition for any Azure resource type (latest API version)

Error Handling

Error	Cause	Fix
MCP tool error or not available	Tool call timeout, connection error, or tool doesn't exist	Retry once; fall back to reference files and notify user if unresolved
Plan approval missing	`meta.status` is not `approved`	Stop and prompt user for approval before IaC generation or deployment
IaC validation failure	`az bicep build` or `terraform validate` returns errors	Fix the generated code and re-validate; notify user if unresolved
Pairing constraint violation	Incompatible SKU or resource combination	Fix in plan before proceeding to IaC generation
Infra plan or IaC files not found	Files written to wrong location or not created	Verify files exist at `<project-root>/.azure/` and `<project-root>/infra/`; if missing, re-create the files by following workflow.md exactly

Files

ATTRIBUTION.mdAdded by AutoGineer1022 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md6.2 KiB
references/bicep-generation.md5.1 KiB
references/constraints/README.md1.2 KiB
references/constraints/ai-ml.md3.2 KiB
references/constraints/compute-apps.md7.8 KiB
references/constraints/compute-infra.md4.5 KiB
references/constraints/data-analytics.md6.3 KiB
references/constraints/data-relational.md4.9 KiB
references/constraints/messaging.md2.5 KiB
references/constraints/monitoring.md1.7 KiB
references/constraints/networking-connectivity.md6.1 KiB
references/constraints/networking-core.md7.0 KiB
references/constraints/networking-traffic.md4.6 KiB
references/constraints/security.md2.4 KiB
references/deployment.md3.7 KiB
references/pairing-checks.md3.7 KiB
references/phases/1-extract-insights.md2.6 KiB
references/phases/2-research-best-practices.md2.8 KiB
references/phases/3-research-resources.md3.3 KiB
references/phases/4-generate-plan.md792 B
references/phases/5-verify.md814 B
references/phases/6-generate-iac.md2.5 KiB
references/phases/7-deploy.md1.3 KiB
references/referenced-workload.md7.3 KiB
references/resources/README.md1.6 KiB
references/resources/ai-ml.md2.1 KiB
references/resources/compute-apps.md4.0 KiB
references/resources/compute-infra.md2.8 KiB
references/resources/data-analytics.md3.0 KiB
references/resources/data-relational.md2.6 KiB
references/resources/messaging.md2.0 KiB
references/resources/monitoring.md1.5 KiB
references/resources/networking-connectivity.md3.6 KiB
references/resources/networking-core.md4.3 KiB
references/resources/networking-traffic.md2.6 KiB
references/resources/security.md1.5 KiB
references/schema.md3.8 KiB
references/terraform-generation.md4.4 KiB
references/verification.md2.6 KiB
references/waf-checklist.md1.9 KiB
references/workflow.md4.9 KiB

references/phases/3-research-resources.md

Phase 3: Research Resources

The goal of this phase is to research Azure resources before generating the plan.

Step 1 - Resource Refinement

Cross reference WAF

Read WAF cross-cutting checklist. For every checklist item, either:

Add missing resources / harden properties, or;
Document the intentional omission in overallReasoning.tradeoffs and inputs.subGoals.

Insights Integration

Read .azure/insights.json produced by Phase 1 and evaluate each insight against the current workload and sub-goals identified in Phase 2:

If an insight applies, prefer it over defaults — especially for region, SKU tier, security posture, naming, and tagging.
If an insight doesn't apply, document the intentional omission in overallReasoning.tradeoffs.
Insights can shape both resource selection and property configuration.
Track each insight you apply in inputs.insightsApplied so the user can trace why a decision was made.

Mandatory Security rule: only apply a security-related insight if it results in an equal or stronger security posture than the alternatives. A weaker security posture from an insight is only acceptable when the user has explicitly requested it in the initial prompt.

Step 2 - Resource Lookup

Mandatory: Complete this step for every resource before generating the plan. WAF tools from Phase 2 provide architecture guidance, but do not provide ARM types, naming rules, or pairing constraints. This step fills those gaps.

For each resource identified since Phase 1:

Read the relevant resource reference file to get its ARM type, API version, and CAF prefix. Use resources/README.md as the index to help you find the right file (e.g., resources/compute-infra.md for AKS, resources/data-analytics.md for Cosmos DB).
Read the relevant pairing constraint file using constraints/README.md as the index. Each category file is <2K tokens, you must read the whole file for all resources in that category.
Required — for every resource, spawn a general-purpose sub-agent to fetch its naming rules. Pass the naming rules URL from the resource file and instruct the sub-agent to call microsoft_docs_fetch and return only the min/max length, allowed characters, and uniqueness scope. The resource file's CAF prefix is a style convention only — it does not capture these ARM-enforced constraints, so this step cannot be skipped.

Important Tip: Only load the category files you need. For a plan with AKS + Cosmos DB + VNet + Key Vault, you'd load 4 constraint files and 4 resource files (~5.5K tokens total) instead of the full catalog (~22K tokens).

After completing the steps above, verify from the tool results:

Type — Correct Microsoft.* resource type and API version
SKU — Available in target region, appropriate for workload
Region — Service available, data residency met
Name — CAF-compliant naming constraints
Dependencies — All prerequisites identified and ordered
Properties — Required properties per resource schema
Alternatives — At least one alternative with tradeoff documented

Gate

Every resource has an ARM type, naming rules, and pairing constraints checked.
Present the preliminary resource list to the user with brief justifications and wait for approval before proceeding.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-enterprise-infra-planner · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-enterprise-infra-planner.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Enterprise Infra Planner

When to Use This Skill

Quick Reference

Workflow (Start Here)

Architecture

MCP Tools

Error Handling

Files

references/phases/3-research-resources.md

Phase 3: Research Resources

Step 1 - Resource Refinement

Cross reference WAF

Insights Integration

Step 2 - Resource Lookup

Gate

Requirements and compatibility

Security

Attribution and licence

Related skills

Deployment Strategies Terraform Specialist

Terraform Module Library

Cloud Infrastructure Terraform Specialist

Cicd Automation Terraform Specialist

Terraform Azure Planning

Terratest Module Testing

Download ZIP