Skills azure-deploy
๐Ÿ“ฆ

azure-deploy

v0.0.0-placeholder Content revision r2 Critical โš™๏ธ External commands๐Ÿ”‘ Env variables๐Ÿ“ Filesystem access๐ŸŒ Network access

Deploy Prepared Applications to Azure

Azure deployments can fail when prerequisites, identities, or environment settings are incomplete. This skill executes validated deployments with checks, recovery guidance, and verification.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "azure-deploy" from https://skillstore.io/skills/microsoft-azure-deploy.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-deploy/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "azure-deploy". Deploy the validated staging environment with AZD and verify the API.

Expected outcome:

  • Deployment target: confirmed subscription and region.
  • Execution: infrastructure and application deployment completed.
  • Verification: the API health endpoint returned a successful response.
  • Result: service URLs and live role-check status were reported.

Using "azure-deploy". Apply the reviewed Terraform plan and check Container Apps registry access.

Expected outcome:

The reviewed plan was applied to the confirmed environment. AcrPull propagation completed, the image revision became active, and the HTTPS endpoint was verified.

Security Audit

Critical
v5 โ€ข 7/23/2026 Open versioned report

Most findings are false positives from Markdown formatting, relative links, project .azure paths, read-only Azure queries, and documented environment identifiers. Confirmed risks include unsafe shell evaluation, command-line registry password exposure, and a remote installer piped to Bash. Additional concerns include mutable dependencies, broad SQL schema privileges, and unvalidated health-check targets.

42
Files scanned
3,650
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (5)

Critical
Pipe to shell pattern
curl -fsSL https://aka.ms/install-azd.sh | bash
The command downloads a remote script and pipes it directly to Bash without pinning or verification. A compromised response would execute arbitrary code.
High
Registry Password Exposed in Command Arguments
The fallback retrieves an ACR administrator password and passes it with docker login -p. Other local processes and logs can expose the credential.
The commands directly retrieve a live password and place it in a process argument in both shell variants.
High
Application Identity Receives Schema Administration
Deployment guidance grants the runtime identity db_ddladmin with read and write roles. A compromised application could alter or drop database schema.
The SQL explicitly adds the application identity to db_ddladmin, db_datareader, and db_datawriter in every documented variant.
High
Mutable Deployment Dependencies
CI workflows use mutable action tags with OIDC permission, and migration scripts install unpinned global tools. Upstream changes could execute during deployment.
The workflow uses version tags instead of commit SHAs, while scripts install current package versions without integrity or version constraints.
High
Project-Controlled Health Check Targets
Health checks request endpoints loaded from project-controlled AZD values without validating the host. A crafted project can direct the agent toward internal services.
The endpoint comes from local AZD environment state and is passed directly to curl or Invoke-WebRequest without a scheme or hostname allowlist.
Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Shell command substitution
ACR_PASS=$(az acr credential show --name <acr-name> --query "passwords[0].value" -o tsv)
This captures a live registry password, and the next command passes it through docker login -p. Process inspection and logs can expose it.
High
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
High
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
High
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
High
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
High
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.

Risk Factors

โš™๏ธ External commands (50)
references/auth-best-practices.md:16 references/auth-best-practices.md:81 references/auth-best-practices.md:87 references/live-role-verification.md:97-102 references/pre-deploy-checklist.md:121-122 references/pre-deploy-checklist.md:181-182 references/pre-deploy-checklist.md:322-323 references/pre-deploy-checklist.md:324-326 references/pre-deploy-checklist.md:327-328 references/pre-deploy-checklist.md:348-349 references/pre-deploy-checklist.md:365-366 references/pre-deploy-checklist.md:399-400 references/pre-deploy-checklist.md:401-417 references/pre-deploy-checklist.md:339-342 references/pre-deploy-checklist.md:356-359 references/pre-deploy-checklist.md:374-378 references/pre-deploy-checklist.md:439 references/pre-deploy-checklist.md:118 references/pre-deploy-checklist.md:119 references/pre-deploy-checklist.md:178 references/pre-deploy-checklist.md:179 references/pre-deploy-checklist.md:318 references/pre-deploy-checklist.md:319 references/pre-deploy-checklist.md:345 references/pre-deploy-checklist.md:346 references/pre-deploy-checklist.md:362 references/pre-deploy-checklist.md:363 references/pre-deploy-checklist.md:395 references/pre-deploy-checklist.md:396 references/pre-deploy-checklist.md:443 references/pre-deploy-checklist.md:444 references/pre-deploy-checklist.md:457 references/pre-deploy-checklist.md:458 references/recipes/azcli/verify.md:40 references/recipes/azcli/verify.md:44 references/recipes/azcli/verify.md:48 references/recipes/azcli/verify.md:52 references/recipes/azcli/verify.md:53 references/recipes/azd/ef-migrations.md:56 references/recipes/azd/ef-migrations.md:14 references/recipes/azd/ef-migrations.md:15 references/recipes/azd/ef-migrations.md:33 references/recipes/azd/ef-migrations.md:59 references/recipes/azd/ef-migrations.md:60 references/recipes/azd/ef-migrations.md:90 references/recipes/azd/errors.md:72-73 references/recipes/azd/errors.md:74-76 references/recipes/azd/errors.md:47 references/recipes/azd/errors.md:48 references/recipes/azd/errors.md:65
๐Ÿ”‘ Env variables (19)
๐Ÿ“ Filesystem access (34)
๐ŸŒ Network access (23)

Detected Patterns

Pipe to shell pattern
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/microsoft-azure-deploy/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-deploy/security.svg)](https://skillstore.io/skills/microsoft-azure-deploy?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

microsoft. (2026). azure-deploy security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-deploy/audits/5

BibTeX citation

@techreport{microsoft-microsoft-azure-deploy-2026, author = {microsoft}, title = {azure-deploy security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/microsoft-azure-deploy/audits/5}, note = {Author version 0.0.0-placeholder} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "azure-deploy security audit report (audit version 5)" version: "0.0.0-placeholder" type: report authors: - name: "microsoft" date-released: "2026-07-23" url: "https://skillstore.io/skills/microsoft-azure-deploy/audits/5" identifiers: - type: other value: "skillstore:microsoft-azure-deploy:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
50
Architecture
90
Maintainability
87
Content
73
Community
91
Spec Compliance

What You Can Build

Release a validated application

Execute a prepared AZD deployment and report verified service endpoints.

Operate controlled infrastructure changes

Apply a reviewed Bicep or Terraform plan after confirming subscription and region.

Build an approved deployment pipeline

Adapt the CI/CD recipes with identity, environment, and approval controls.

Try These Prompts

Deploy a validated application
Deploy this prepared application to Azure staging. Confirm the subscription and region, complete the checklist, run the matching recipe, and report endpoint URLs.
Recover a failed AZD deployment
Review the failed AZD deployment output. Identify the documented failure pattern, apply the safest recovery, rerun verification, and summarize every change.
Run a two-phase Container Apps release
Deploy this validated Container Apps project in two phases. Verify AcrPull propagation before pushing the image, then confirm the active revision and endpoint.
Execute a production Terraform release
Apply the reviewed Terraform plan to production. Confirm approvals, inspect planned changes, verify role scope, test endpoints, and produce an operational deployment summary.

Best Practices

  • Run preparation and validation before this skill, then verify the recorded proof.
  • Confirm the Azure subscription, region, costs, and destructive changes with the user.
  • Use managed identity, narrow role scopes, reviewed plans, and production database backups.

Avoid

  • Do not deploy a new or unvalidated project through this execution skill.
  • Do not use plaintext registry passwords, shell eval, or unverified remote installers.
  • Do not auto-approve production changes without reviewed plans and required approval gates.

Frequently Asked Questions

Can this skill create a new Azure application?
No. Prepare the application and infrastructure first, then validate the deployment plan.
Which deployment tools are supported?
The references cover Azure Developer CLI, Azure CLI, Bicep, Terraform, GitHub Actions, and Azure DevOps.
Does the skill require Azure authentication?
Yes. Azure CLI, AZD, or pipeline authentication must already be configured with appropriate permissions.
Will it ask before destructive operations?
The skill requires confirmation before deletion, overwrite, irreversible, costly, or security-sensitive actions.
Does it verify deployment success?
Yes. It checks resources, endpoints, application health, database access when applicable, and live Azure role assignments.
Is every included command suitable for production?
No. Replace unsafe eval, password, installer, dependency, and broad database-role patterns before production use.

Developer Details

Author

microsoft

License

MIT

Author version

v0.0.0-placeholder

Skillstore revision

r2

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/25/2026

Usage

8 downloads ยท 372 views

File structure

๐Ÿ“ references/

๐Ÿ“„ auth-best-practices.md

๐Ÿ“„ global-rules.md

๐Ÿ“„ live-role-verification.md

๐Ÿ“„ pre-deploy-checklist.md

๐Ÿ“ recipes/

๐Ÿ“ azcli/

๐Ÿ“„ errors.md

๐Ÿ“„ README.md

๐Ÿ“„ verify.md

๐Ÿ“ azd/

๐Ÿ“„ ef-migrations.md

๐Ÿ“„ errors.md

๐Ÿ“„ functions-deploy.md

๐Ÿ“„ post-deployment.md

๐Ÿ“„ README.md

๐Ÿ“ scripts/

๐Ÿ“„ apply-migrations.ps1

๐Ÿ“„ apply-migrations.sh

๐Ÿ“„ grant-and-migrate.ps1

๐Ÿ“„ grant-and-migrate.sh

๐Ÿ“„ sql-entra-auth.md

๐Ÿ“„ sql-managed-identity.md

๐Ÿ“„ verify.md

๐Ÿ“ bicep/

๐Ÿ“„ errors.md

๐Ÿ“„ README.md

๐Ÿ“„ verify.md

๐Ÿ“ cicd/

๐Ÿ“„ errors.md

๐Ÿ“ examples/

๐Ÿ“„ azdo-azd.yml

๐Ÿ“„ azdo-multistage.yml

๐Ÿ“„ github-azd.yml

๐Ÿ“„ github-bicep.yml

๐Ÿ“„ README.md

๐Ÿ“„ verify.md

๐Ÿ“„ README.md

๐Ÿ“ terraform/

๐Ÿ“„ errors.md

๐Ÿ“„ README.md

๐Ÿ“„ verify.md

๐Ÿ“„ region-availability.md

๐Ÿ“ sdk/

๐Ÿ“„ azd-deployment.md

๐Ÿ“„ azure-identity-dotnet.md

๐Ÿ“„ azure-identity-java.md

๐Ÿ“„ azure-identity-py.md

๐Ÿ“„ azure-identity-ts.md

๐Ÿ“„ troubleshooting.md

๐Ÿ“„ SKILL.md

๐Ÿ“„ version.json

More from microsoft

View all
View all