Generated banner for Azure Prepare
Generated logo for Azure Prepare

Azure Prepare

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Workflow
  • Cloud and DevOps
  • MIT
  • Medium risk
  • Has scripts

From the author

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-prepare skill provides a mandatory, structured workflow for setting up applications for deployment to Azure via the Azure Developer CLI (azd). It enforces a plan-first approach, requiring the creation of a deployment plan file before any infrastructure generation or configuration occurs. The skill guides users through analyzing their workspace, selecting appropriate deployment recipes (Bicep or Terraform), and configuring necessary Azure services, while ensuring security best practices are followed. It acts as the initial phase in a three-part deployment pipeline: prepare, validate, and deploy.

What it does

  • Generates azure.yaml configuration files for azd-based projects.
  • Creates infrastructure-as-code templates using Bicep or Terraform.
  • Enforces a mandatory .azure/deployment-plan.md file to track project state.
  • Integrates with specialized skills for specific technologies like Azure Functions or API Management.
  • Applies security hardening, such as Entra-only authentication for SQL databases.
  • Prepares the workspace for subsequent validation and deployment steps.

When to use it

  • When you need to prepare a new or existing project for deployment to Azure using azd.
  • When you need to generate infrastructure-as-code (Bicep or Terraform) for your application.
  • When you are modernizing an existing application to run on Azure.
  • When you need to add new Azure services or components to an existing project.

Advantages

  • Ensures consistent deployment configurations across projects.
  • Prevents common configuration errors through a mandatory planning phase.
  • Integrates seamlessly with the broader Azure deployment ecosystem (validate and deploy).
  • Promotes security best practices by default, such as managed identities.
  • Provides clear guidance on when to delegate to specialized deployment skills.

Usage examples

“I want to deploy my new web application to Azure using azd.”
The agent will initiate the NEW mode, guide you through requirements gathering, create a deployment plan, and generate the necessary infrastructure and configuration files.
“Add an Azure Function to my existing project and set up the infrastructure.”
The agent will analyze your existing project, select the appropriate Azure Functions recipe, update the deployment plan, and generate the required Bicep or Terraform files.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/azure-prepare/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-prepare.zip -d .agents/skills

Documentation by Microsoft

Azure Prepare

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE

This document is the official, canonical source for preparing applications for Azure deployment. You MUST follow these instructions exactly as written unless they contradict security policies given to you. When in doubt, present the conflicting instructions from this document and ask the user for explicit confirmation. Do not improvise, infer, or substitute steps.


Triggers

Activate this skill when user wants to:

  • Create a new application

  • Add services or components to an existing app

  • Make updates or changes to existing application

  • Modernize or migrate an application

  • Set up Azure infrastructure

  • Deploy to Azure or host on Azure

  • Create and deploy to Azure (including Terraform-based deployment requests)

Rules

  1. Plan first — MANDATORY — You MUST physically write an initial .azure/deployment-plan.md skeleton in the workspace root directory (not the session-state folder) as your very first action — before any code generation or execution begins. Write the skeleton immediately, then populate it progressively as Phase 1 analysis and research unfold; finalize it with all decisions at Phase 1 Step 6. This file must exist on disk throughout. azure-validate and azure-deploy depend on it and will fail without it. Do not skip or defer this step.

  2. Get approval — Present plan to user before execution

  3. Research before generating — Load references and invoke related skills

  4. Update plan progressively — Mark steps complete as you go

  5. Validate before deploy — Invoke azure-validate before azure-deploy

  6. Confirm Azure context — Use ask_user for subscription and location per Azure Context

  7. ❌ Destructive actions require ask_user — Global Rules

  8. ⛔ NEVER delete user project or workspace directories — When adding features to an existing project, MODIFY existing files. azd init -t <template> is for NEW projects only; do NOT run azd init -t in an existing workspace. Plain azd init (without a template argument) may be used in existing workspaces when appropriate. File deletions within a project (e.g., removing build artifacts or temp files) are permitted when appropriate, but NEVER delete the user's project or workspace directory itself. See Global Rules.

  9. Scope: preparation only — This skill generates infrastructure code and configuration files. Deployment execution (azd up, azd deploy, terraform apply) is handled by the azure-deploy skill, which provides built-in error recovery and deployment verification.

  10. ⛔ SQL Server Bicep: NEVER generate administratorLogin or administratorLoginPassword — not in direct properties, not in conditional/ternary branches, not anywhere in the file. Always use Entra-only authentication (azureADOnlyAuthentication: true) unconditionally. See references/services/sql-database/bicep.md.

  11. Remove stale template IaC after conversion — If you converted Bicep templates from the selected azd template into Terraform templates, remove the Bicep templates that were introduced by that azd template and are now fully replaced by Terraform equivalents. Do not remove user-authored Bicep files. Only remove those template-provided Bicep files after the Terraform IaC is complete and Terraform has been selected as the deployment path. Before handing off to azure-validate skill, keep only the IaC templates required by the chosen deployment path.


❌ PLAN-FIRST WORKFLOW — MANDATORY

YOU MUST CREATE A PLAN BEFORE DOING ANY WORK

  1. STOP — Do not generate any code, infrastructure, or configuration yet

  2. CREATE SKELETON - Write an initial .azure/deployment-plan.md skeleton to disk immediately (before any code generation or execution begins), then populate it progressively as Phase 1 steps 1-5 reveal details; finalize it at Step 6

  3. CONFIRM — Present the completed plan to the user and get approval

  4. EXECUTE — Only after approval, execute the plan step by step

The .azure/deployment-plan.md file is the source of truth for this workflow and for azure-validate and azure-deploy skills. Without it, those skills will fail.

⚠️ CRITICAL: .azure/deployment-plan.md must be WRITTEN TO DISK inside the workspace root (e.g., <workspace-root>/.azure/deployment-plan.md), not in the session-state folder. Use a file-write tool to create this file. This is the deployment plan artifact read by azure-validate and azure-deploy. You MUST create this file — do not proceed without it. ⚠️ CRITICAL: You must create the file with the name .azure/deployment-plan.md as is. You must not use other names such as .azure/plan.md.

⛔ Critical: Skipping the plan file creation will cause azure-validate and azure-deploy to fail. This requirement has no exceptions.


❌ STEP 0: Specialized Technology Check — MANDATORY FIRST ACTION

BEFORE starting Phase 1, check if the user's prompt OR workspace codebase matches a specialized technology that has a dedicated skill with tested templates. If matched, invoke that skill FIRST — then resume azure-prepare for validation and deployment.

Check 1: Prompt keywords
Prompt keywordsInvoke FIRST
Python + App Service (e.g., "deploy Python to App Service", "Flask on Azure App Service", "publish Python web app to App Service")python-appservice-deploy
Lambda, AWS Lambda, migrate AWS, migrate GCP, Lambda to Functions, migrate from AWS, migrate from GCPazure-cloud-migrate
Azure Functions, function app, serverless function, timer trigger, HTTP trigger, func newStay in azure-prepare — prefer Azure Functions templates in Step 4; for plan choice/cold starts see hosting-plans.md and cold-start.md
APIM, API Management, API gateway, deploy APIMStay in azure-prepare — see APIM Deployment Guide
AI gateway, AI gateway policy, AI gateway backend, AI gateway configurationazure-aigateway
workflow, orchestration, multi-step, pipeline, fan-out/fan-in, saga, long-running process, durable, order processingStay in azure-prepare — select durable recipe in Step 4. MUST load durable.md, DTS reference, and DTS Bicep patterns.

⚠️ Check the user's prompt text — not just existing code. Critical for greenfield projects with no codebase to scan. See full routing table.

After the specialized skill completes, resume azure-prepare at Phase 1 Step 4 (Select Recipe) for remaining infrastructure, validation, and deployment.


Phase 1: Planning (BLOCKING — Complete Before Any Execution)

Create .azure/deployment-plan.md by completing these steps. Do NOT generate any artifacts until the plan is approved.

#ActionReference
0If the prompt matches a specialized technology with a dedicated skill, invoke that skill firstspecialized-routing.md
1Analyze Workspace — Determine mode: NEW, MODIFY, or MODERNIZEanalyze.md
2Gather Requirements — Classification, scale, budgetrequirements.md
3Scan Codebase — Identify components, technologies, dependenciesscan.md
4Select Recipe — Choose AZD (default), AZCLI, Bicep, or Terraformrecipe-selection.md
5Plan Architecture — Select stack + map components to Azure servicesarchitecture.md
6Finalize Plan (MANDATORY) - Use a file-write tool to finalize .azure/deployment-plan.md with all decisions from steps 1-5. Update the skeleton written at the start of Phase 1 with the complete content. The file must be fully populated before you present the plan to the user.plan-template.md
7Present Plan — Show plan to user and ask for approval.azure/deployment-plan.md
8Destructive actions require ask_userGlobal Rules

❌ STOP HERE — Do NOT proceed to Phase 2 until the user approves the plan.


Phase 2: Execution (Only After Plan Approval)

Execute the approved plan. Update .azure/deployment-plan.md status after each step.

#ActionReference
1Research Components — Load service references + invoke related skillsresearch.md
2Confirm Azure Context — Detect and confirm subscription + location and check the resource provisioning limitAzure Context
3Generate Artifacts — Create infrastructure and configuration filesgenerate.md
4Harden Security — Apply security best practicessecurity.md
5Functional Verification — Verify the app works (UI + backend), locally if possiblefunctional-verification.md
6⛔ Update Plan (MANDATORY before hand-off) — Use the edit tool to change the Status in .azure/deployment-plan.md to Ready for Validation. You MUST complete this edit BEFORE invoking azure-validate. Do NOT skip this step..azure/deployment-plan.md
7⛔ MANDATORY Hand Off — Invoke azure-validate skill. Your preparation work is done. Do NOT run azd up, azd deploy, or any deployment command directly — all deployment execution is handled by azure-deploy after azure-validate completes. PREREQUISITE: Step 6 must be completed first — .azure/deployment-plan.md status must say Ready for Validation.—

Outputs

ArtifactLocation
Plan.azure/deployment-plan.md
Infrastructure./infra/
AZD Configazure.yaml (AZD only)
Dockerfilessrc/<component>/Dockerfile

SDK Quick References


Next

⛔ MANDATORY NEXT STEP — DO NOT SKIP

After completing preparation, you MUST invoke azure-validate before any deployment attempt. Do NOT skip validation. Do NOT go directly to azure-deploy. Do NOT run azd up or any deployment command directly. The workflow is:

azure-prepare → azure-validate → azure-deploy

⛔ BEFORE invoking azure-validate, you MUST use the edit tool to update .azure/deployment-plan.md status to Ready for Validation. If the plan status has not been updated, the validation will fail.

This applies to ALL deployment scenarios including containerized apps, Container Apps, App Service, Azure Functions, static sites, and any other Azure target. No exceptions.

Skipping validation leads to deployment failures. Be patient and follow the complete workflow for the highest success outcome.

→ Update plan status to Ready for Validation, then invoke azure-validate

Files

references/resources-limits-quotas.md

Azure Resource Limits and Quotas

Check Azure resource availability during azure-prepare workflow. Validate after customer selects region.

Types

  1. Hard Limits - Fixed constraints that cannot be changed

  2. Quotas - Subscription limits that can be increased via support request

CLI First: Always use az quota CLI for quota checks. Provides better error handling and consistent output. "No Limit" in REST/Portal doesn't mean unlimited - verify with service docs.

Hard Limits

Fixed service constraints (cannot be changed).

Check via: azure__documentation tool or azure-provisioning-limit skill

Examples: Cosmos DB item size (2 MB), Container Apps HTTP timeout (240s), App Service Free tier deployment slots (0)

Process:

  1. Identify services and resource sizes needed

  2. Look up limits in documentation

  3. Compare plan vs limits

  4. If exceeded: redesign or change tier

Quotas

Subscription/regional limits that can be increased via support request.

Check via: az quota CLI (install: az extension add --name quota)

Examples: AKS clusters (5,000/region), Storage accounts (250/region), Container Apps environments (50/region)

Key Concept: No 1:1 mapping between ARM resource types and quota names.

  • ARM: Microsoft.App/managedEnvironments → Quota: ManagedEnvironmentCount

  • ARM: Microsoft.Compute/virtualMachines → Quota: standardDSv3Family, cores, virtualMachines

Process:

  1. Install extension: az extension add --name quota

  2. Discover quota names: az quota list --scope /subscriptions/{id}/providers/{Provider}/locations/{region}

  3. Check usage: az quota usage show --resource-name {name} --scope ...

  4. Check limit: az quota show --resource-name {name} --scope ...

  5. Calculate: Available = Limit - Current Usage

  6. If exceeded: Request increase via az quota update

Unsupported Providers (BadRequest error):

Not all providers support quota API. If az quota list fails with BadRequest, use fallback:

  1. Get current usage:

    # Option A: Azure Resource Graph (recommended)
    az extension add --name resource-graph
    az graph query -q "resources | where type == '{type}' and location == '{loc}' | count"
    
    # Option B: Resource list
    az resource list --subscription "{id}" --resource-type "{Type}" --location "{loc}" | jq 'length'
  2. Get limit from service documentation

  3. Calculate: Available = Documented Limit - Current Usage

Known Support Status:

  • ❌ Microsoft.DocumentDB (Cosmos DB)

  • ✅ Microsoft.Compute, Microsoft.Network, Microsoft.App, Microsoft.Storage, Microsoft.MachineLearningServices

Workflow

Phase 1: Identify & Check Hard Limits

  1. Analyze app requirements and select Azure services

  2. Determine resource counts, sizes, tiers, throughput

  3. Check hard limits via azure-provisioning-limit skill or documentation

  4. Validate plan against limits; redesign if needed

Phase 2: Check Quotas After Region Selection

  1. Get customer subscription and region preference

  2. For each service/region, check quota:

    • Use az quota usage list and az quota show

    • Calculate available capacity

  3. If quota exceeded: request increase or choose different region

Phase 3: Validate Region

  • Confirm sufficient quota in selected region

  • Request increases if needed

  • Only proceed after validation complete

Limit Scopes

ScopeExample
Subscription50 Cosmos DB accounts (any region)
Regional250 storage accounts per region
Resource500 apps per Container Apps environment

Service Patterns

ServiceHard Limits (examples)Quota CheckNotes
Cosmos DBItem: 2MB, Partition key: 2KB, Serverless storage: 50GB❌ Not supported. Use Resource Graph + docs. Default: 50 accounts/regionQuery: az graph query -q "resources | where type == 'microsoft.documentdb/databaseaccounts' and location == 'eastus' | count"
AKSPods/node (Azure CNI): 250, Node pools/cluster: 100✅ az quota supportedProvider: Microsoft.ContainerService
StorageBlock blob: 190.7 TiB, Page blob: 8 TiB✅ Quota: StorageAccounts (limit: 250/region)Provider: Microsoft.Storage
Container AppsRevisions/app: 100, HTTP timeout: 240s✅ Quota: ManagedEnvironmentCount (limit: 50/region)Provider: Microsoft.App
FunctionsTimeout (Consumption): 10 min, Queue msg: 64KB✅ Check function apps quotaProvider: Microsoft.Web

CLI Reference

Prerequisites: az extension add --name quota

Discovery: List quotas to find resource names

az quota list --scope /subscriptions/{id}/providers/{provider}/locations/{location}

Check Usage:

az quota usage show --resource-name {quota-name} --scope /subscriptions/{id}/providers/{provider}/locations/{location}

Check Limit:

az quota show --resource-name {quota-name} --scope /subscriptions/{id}/providers/{provider}/locations/{location}

Request Increase:

az quota update --resource-name {quota-name} --scope /subscriptions/{id}/providers/{provider}/locations/{location} --limit-object value={new-limit} --resource-type {type}

azure-prepare Integration

When to Check:

  1. After selecting services - Check hard limits

  2. After customer selects region - Check quotas

  3. Before generating infrastructure code - Validate availability

Required Steps:

Phase 1 - Planning:

  • Select Azure services

  • Check hard limits (service documentation)

  • Create provisioning limit checklist (leave quota columns as "TBD")

Phase 2 - Execution:

  • Get subscription and region preference

  • Must invoke azure-quotas skill - Process ONE resource type at a time: a. Try az quota list first (required) b. If supported: Use az quota usage show and az quota show c. If NOT supported (BadRequest): Use Resource Graph + service docs d. Calculate available capacity e. Document in checklist (no "TBD" entries allowed) f. If insufficient: Request increase or change region

Phase 3 - Generate Artifacts:

  • Only proceed after Phase 2 complete (all quotas validated)

Error Messages

ErrorTypeAction
"Quota exceeded"QuotaUse azure-quotas to request increase
"(BadRequest) Bad request"Unsupported providerUse service limits docs
"Limit exceeded"Hard LimitRedesign or change tier
"Maximum size exceeded"Hard LimitSplit data or use alternative storage
"Too many requests"Rate LimitImplement retry logic or increase tier
"Cannot exceed X"Hard LimitStay within limit or use multiple resources
"Subscription limit reached"QuotaRequest quota increase using azure-quotas skill
"Regional capacity"QuotaChoose different region or request increase

Best Practices

  1. MUST use Azure CLI quota API first: az quota commands are MANDATORY as the primary method for checking quotas - only use fallback methods (REST API, Portal, docs) when quota API returns BadRequest

  2. Don't trust "No Limit" values: If REST API or Portal shows "No Limit" or unlimited, verify with official service documentation - it likely means the quota API doesn't support that resource type, not that capacity is unlimited

  3. Always check after customer selects region: Validates availability and allows time for quota requests

  4. Use the discovery workflow: Never assume quota resource names - always run az quota list first to discover correct names

  5. Check both usage and limit: Run az quota usage show AND az quota show to calculate available capacity

  6. Handle unsupported providers gracefully: If you get BadRequest error, fall back to official documentation (Azure Resource Graph + docs)

  7. Request quota increases proactively: If selected region lacks capacity, submit request before deployment

  8. Have alternative regions ready: If quota increase denied, suggest backup regions

  9. Document capacity assumptions: Note quota availability and source in .azure/deployment-plan.md

  10. Design for limits: Architecture should account for both hard limits and quotas

  11. Monitor usage trends: Regular quota checks help predict future needs

  12. Use lower environments wisely: Dev/test environments count against quotas

Quick Reference Limits

For complete quota checking workflow and commands, invoke the azure-quotas skill.

Note: These are typical default limits. Always verify actual quotas using az quota show for your specific subscription and region.

Common quotas to check:

Subscription Level
  • Cosmos DB accounts: 50 per region (check via docs - quota API not supported)

  • SQL logical servers: 250 per region

  • Service Bus namespaces: 100-1,000 (tier dependent)

Regional Level
  • Storage accounts: 250 per region (quota resource name: StorageAccounts)

  • AKS clusters: 5,000 per region (quota resource name: varies by configuration)

  • Container Apps environments: 50 per region (quota resource name: ManagedEnvironmentCount)

  • Function apps: 200 per region (Consumption)

Resource Level
  • Cosmos DB containers per account: Unlimited (subject to storage)

  • Apps per Container Apps environment: 500

  • Databases per SQL server: 500

  • Queues/topics per Service Bus namespace: 10,000

Example: Complete Check Workflow

# Scenario: Deploying app with Cosmos DB, Storage, and Container Apps
# Customer selected region: East US

# 1. Check Hard Limits (from azure-provisioning-limit skill)
# Cosmos DB: Item size max 2 MB ✓
# Storage: Blob size max 190.7 TiB ✓
# Container Apps: Timeout 240 sec ✓

# 2. Get Customer's Region Preference
# Customer: "I prefer East US"

# 3. Check Quotas for Customer's Selected Region (East US)

# 3a. Cosmos DB - NOT SUPPORTED by quota API
az quota list \
  --scope /subscriptions/abc-123/providers/Microsoft.DocumentDB/locations/eastus
# Error: (BadRequest) Bad request

# Fallback: Get current usage with Azure Resource Graph
# Install extension first (if needed)
az extension add --name resource-graph

az graph query -q "resources | where type == 'microsoft.documentdb/databaseaccounts' and location == 'eastus' | count"
# Result: 3 database accounts currently deployed

# Or use Azure CLI resource list
az resource list \
  --subscription "abc-123" \
  --resource-type "Microsoft.DocumentDB/databaseAccounts" \
  --location "eastus" | jq 'length'
# Result: 3

# Get limit from documentation: 50 database accounts per region
# Calculate: Available = 50 - 3 = 47 ✓
# Document as: "Fetched from: Azure Resource Graph + Official docs"

# 3b. Storage Accounts
# Step 1: Discover resource name
az quota list \
  --scope /subscriptions/abc-123/providers/Microsoft.Storage/locations/eastus

# Step 2: Check usage (use discovered name "StorageAccounts")
az quota usage show \
  --resource-name StorageAccounts \
  --scope /subscriptions/abc-123/providers/Microsoft.Storage/locations/eastus
# Current: 180

# Step 3: Check limit
az quota show \
  --resource-name StorageAccounts \
  --scope /subscriptions/abc-123/providers/Microsoft.Storage/locations/eastus
# Limit: 250
# Available: 250 - 180 = 70 ✓

# 3c. Container Apps
# Step 1: Discover resource name
az quota list \
  --scope /subscriptions/abc-123/providers/Microsoft.App/locations/eastus
# Shows: "ManagedEnvironmentCount"

# Step 2: Check usage
az quota usage show \
  --resource-name ManagedEnvironmentCount \
  --scope /subscriptions/abc-123/providers/Microsoft.App/locations/eastus
# Current: 8

# Step 3: Check limit
az quota show \
  --resource-name ManagedEnvironmentCount \
  --scope /subscriptions/abc-123/providers/Microsoft.App/locations/eastus
# Limit: 50
# Available: 50 - 8 = 42 ✓

# 4. Validate Availability
# ✅ All services have sufficient quota in East US
# ✅ Proceed with deployment

# Alternative: If quotas were insufficient
# ❌ Container Apps: 49/50 (only 1 available, need 3)
# Action: Request quota increase
# 
# az quota update \
#   --resource-name ManagedEnvironmentCount \
#   --scope /subscriptions/abc-123/providers/Microsoft.App/locations/eastus \
#   --limit-object value=100 \
#   --resource-type Microsoft.App/managedEnvironments

Remember: Checking limits and quotas early prevents deployment failures and ensures smooth infrastructure provisioning.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

What our scanner noticed· Medium risk

  • Instructions that use the network
  • Downloads piped into a shell
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-skills/skills/azure-prepare · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-prepare.zip