Azure deployments can fail when prerequisites, identities, or environment settings are incomplete. This skill executes validated deployments with checks, recovery guidance, and verification.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "azure-deploy" from https://skillstore.io/skills/microsoft-azure-deploy.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-deploy/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.
Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "azure-deploy". Deploy the validated staging environment with AZD and verify the API.
Expected outcome:
Deployment target: confirmed subscription and region.
Execution: infrastructure and application deployment completed.
Verification: the API health endpoint returned a successful response.
Result: service URLs and live role-check status were reported.
Using "azure-deploy". Apply the reviewed Terraform plan and check Container Apps registry access.
Expected outcome:
The reviewed plan was applied to the confirmed environment. AcrPull propagation completed, the image revision became active, and the HTTPS endpoint was verified.
Most findings are false positives from Markdown formatting, relative links, project .azure paths, read-only Azure queries, and documented environment identifiers. Confirmed risks include unsafe shell evaluation, command-line registry password exposure, and a remote installer piped to Bash. Additional concerns include mutable dependencies, broad SQL schema privileges, and unvalidated health-check targets.
The command downloads a remote script and pipes it directly to Bash without pinning or verification. A compromised response would execute arbitrary code.
CI workflows use mutable action tags with OIDC permission, and migration scripts install unpinned global tools. Upstream changes could execute during deployment.
The workflow uses version tags instead of commit SHAs, while scripts install current package versions without integrity or version constraints.
Health checks request endpoints loaded from project-controlled AZD values without validating the host. A crafted project can direct the agent toward internal services.
The endpoint comes from local AZD environment state and is passed directly to curl or Invoke-WebRequest without a scheme or hostname allowlist.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
microsoft. (2026). azure-deploy security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-deploy/audits/5
BibTeX citation
@techreport{microsoft-microsoft-azure-deploy-2026,
author = {microsoft},
title = {azure-deploy security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/microsoft-azure-deploy/audits/5},
note = {Author version 0.0.0-placeholder}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-deploy security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
- name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-deploy/audits/5"
identifiers:
- type: other
value: "skillstore:microsoft-azure-deploy:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this scoreEvidence Confidence: Medium
50
Architecture
90
Maintainability
87
Content
73
Community
91
Spec Compliance
What You Can Build
Release a validated application
Execute a prepared AZD deployment and report verified service endpoints.
Operate controlled infrastructure changes
Apply a reviewed Bicep or Terraform plan after confirming subscription and region.
Build an approved deployment pipeline
Adapt the CI/CD recipes with identity, environment, and approval controls.
Try These Prompts
Deploy a validated application
Deploy this prepared application to Azure staging. Confirm the subscription and region, complete the checklist, run the matching recipe, and report endpoint URLs.
Recover a failed AZD deployment
Review the failed AZD deployment output. Identify the documented failure pattern, apply the safest recovery, rerun verification, and summarize every change.
Run a two-phase Container Apps release
Deploy this validated Container Apps project in two phases. Verify AcrPull propagation before pushing the image, then confirm the active revision and endpoint.
Execute a production Terraform release
Apply the reviewed Terraform plan to production. Confirm approvals, inspect planned changes, verify role scope, test endpoints, and produce an operational deployment summary.
Best Practices
Run preparation and validation before this skill, then verify the recorded proof.
Confirm the Azure subscription, region, costs, and destructive changes with the user.
Use managed identity, narrow role scopes, reviewed plans, and production database backups.
Avoid
Do not deploy a new or unvalidated project through this execution skill.
Do not use plaintext registry passwords, shell eval, or unverified remote installers.
Do not auto-approve production changes without reviewed plans and required approval gates.
Frequently Asked Questions
Can this skill create a new Azure application?
No. Prepare the application and infrastructure first, then validate the deployment plan.
Which deployment tools are supported?
The references cover Azure Developer CLI, Azure CLI, Bicep, Terraform, GitHub Actions, and Azure DevOps.
Does the skill require Azure authentication?
Yes. Azure CLI, AZD, or pipeline authentication must already be configured with appropriate permissions.
Will it ask before destructive operations?
The skill requires confirmation before deletion, overwrite, irreversible, costly, or security-sensitive actions.
Does it verify deployment success?
Yes. It checks resources, endpoints, application health, database access when applicable, and live Azure role assignments.
Is every included command suitable for production?
No. Replace unsafe eval, password, installer, dependency, and broad database-role patterns before production use.