Skills azure-enterprise-infra-planner

📦

azure-enterprise-infra-planner

Name: azure-enterprise-infra-planner
Author: microsoft

v1.2.3 Content revision r2 Medium Risk 📁 Filesystem access⚙️ External commands

Plan Enterprise Azure Infrastructure

Complex Azure environments require coordinated decisions across networking, identity, security, reliability, and cost. This skill creates an approved plan and validated infrastructure code.

Supports: Claude Codex Code(CC)

📊 71 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-enterprise-infra-planner" from https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-enterprise-infra-planner/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-enterprise-infra-planner.md Signed manifest GET /api/skills/microsoft-azure-enterprise-infra-planner/manifest Signed lockfile GET /api/skills/microsoft-azure-enterprise-infra-planner/lockfile

Test it

Using "azure-enterprise-infra-planner". Plan a secure production API with private data access and zone resilience in one Azure region.

Expected outcome:

Recommended topology: private application ingress, zone-redundant compute, managed database, private endpoints, Key Vault, and centralized monitoring.
Key decision: use managed identities and disable public data-plane access where supported.
Gate: confirm workload scale, compliance needs, and recovery objectives before finalizing resources.

Using "azure-enterprise-infra-planner". Design hub-spoke networking for production and development subscriptions.

Expected outcome:

Shared hub: firewall, gateway, private DNS, monitoring, and controlled outbound routing.
Spokes: separate production and development networks with explicit peering, route tables, and network security controls.
Tradeoff: centralized inspection improves governance but adds cost and routing complexity.

Using "azure-enterprise-infra-planner". Generate Terraform for an approved multi-region recovery plan.

Expected outcome:

Creates provider, variable, output, backend, root, and resource-module files under the infrastructure directory.
Runs initialization, validation, and planning before any apply operation.
Stops before deployment until the user confirms the active context and acknowledges live-environment risks.

Security Audit

Medium Risk

v6 • 7/23/2026 Open versioned report

All 72 static alerts are false positives caused by documentation syntax, project-local planning artifacts, Azure service names, and relative Markdown links. The documented deployment commands are intentional and protected by plan approval, validation, active-context checks, and explicit confirmation. Two semantic concerns remain around trusting cached insight text and protecting persisted Azure environment observations.

Files scanned

1,582

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

references/phases/1-extract-insights.md:5 references/phases/3-research-resources.md:15-21

Cached Azure Insights Cross an Untrusted Data Boundary

The workflow reuses repository-local insight text and prefers applicable recommendations without a rule to reject embedded instructions or verify the file's provenance.

The reuse and preference instructions are explicit, while schema checks validate structure rather than provenance or instruction content. Approval gates reduce the final deployment impact.

Low

references/phases/1-extract-insights.md:19 references/workflow.md:37

Azure Environment Observations Lack Storage Guidance

The skill persists Azure environment insights under the project without guidance for version-control exclusion, identifier redaction, access control, retention, or deletion.

The persistence location and Azure-environment purpose are explicit, and the reviewed workflow provides no handling guidance. The schema limits content to observations and implications.

Risk Factors

📁 Filesystem access (20)

⚙️ External commands (21)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-enterprise-infra-planner/security.svg)](https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-enterprise-infra-planner/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-enterprise-infra-planner.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-enterprise-infra-planner security audit report (audit version 6) [Author version 1.2.3]. Skillstore. https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner/audits/6

BibTeX citation

@techreport{microsoft-microsoft-azure-enterprise-infra-planner-2026,
  author = {microsoft},
  title = {azure-enterprise-infra-planner security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner/audits/6},
  note = {Author version 1.2.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-enterprise-infra-planner security audit report (audit version 6)"
version: "1.2.3"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-enterprise-infra-planner/audits/6"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-enterprise-infra-planner:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design a Governed Landing Zone

Plan subscriptions, hub-spoke networking, private connectivity, identity, policy, monitoring, and shared security services with documented tradeoffs.

Generate Platform Infrastructure Code

Convert an approved multi-resource design into modular Bicep or Terraform, then validate dependencies, schemas, names, and deployment scope.

Plan Resilient Regulated Workloads

Compare regional, recovery, encryption, private-access, logging, and managed-identity options while preserving compliance and approval gates.

Try These Prompts

Beginner: Plan a Workload

Plan Azure infrastructure for [workload] in [region] with [budget]. Ask focused questions before recommending services. Stop after presenting the draft plan.

Intermediate: Design Hub-Spoke Networking

Design a hub-spoke topology for [environments] and [regions]. Include firewall, private endpoints, DNS, routing, identity, monitoring, and cost tradeoffs.

Advanced: Plan Multi-Region Recovery

Plan recovery for [workload] with [RTO] and [RPO]. Compare active-active and active-passive options, dependencies, failover, data replication, and operational testing.

Expert: Generate Reviewed Infrastructure Code

Create an approved plan for [requirements], then generate [Bicep or Terraform]. Validate schemas, naming, pairings, scope, and security. Do not deploy.

Best Practices

Provide workload goals, environments, compliance needs, traffic, data requirements, availability targets, budget, and preferred regions.
Review resource alternatives, dependencies, security posture, naming, costs, and recovery assumptions before approving the plan.
Inspect generated infrastructure code and preview changes in the intended Azure context before authorizing deployment.

Avoid

Do not request deployment before reviewing and approving the architecture plan and generated infrastructure code.
Do not place secrets, connection strings, or sensitive identifiers in prompts, planning artifacts, parameter files, or version control.
Do not treat reference catalogs as proof of current regional availability, quota, policy compliance, or subscription permissions.