# Plan Enterprise Azure Infrastructure

Complex Azure environments require coordinated decisions across networking, identity, security, reliability, and cost. This skill creates an approved plan and validated infrastructure code.

## Install

```bash
npx skillstore add microsoft/azure-enterprise-infra-planner
```

## Metadata

- Status: approved
- Slug: microsoft-azure-enterprise-infra-planner
- Version: 1.2.3
- Author version: 1.2.3
- Skillstore revision: r2
- Version status: valid
- Tree hash: ce0685b67bdbcfe5960186dbc229cd83f3969a8ec1bb2f916a52253edf68a020
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: filesystem, external\_commands
- Quality score: 71
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-enterprise-infra-planner
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-enterprise-infra-planner/manifest

## Capabilities

- Clarifies workload, scale, availability, networking, security, compliance, environment, and budget requirements.
- Uses Azure best-practice, service-guide, documentation, and Bicep schema tools when available.
- Maps resources to ARM types, API versions, naming rules, dependencies, SKUs, and pairing constraints.
- Creates a traceable infrastructure plan with alternatives, tradeoffs, references, validation, and approval status.
- Generates modular Bicep or Terraform files only after explicit plan approval and format selection.
- Validates infrastructure code and can deploy after active Azure context checks and explicit risk acknowledgment.

## Use Cases

- Design a Governed Landing Zone: Plan subscriptions, hub-spoke networking, private connectivity, identity, policy, monitoring, and shared security services with documented tradeoffs.
- Generate Platform Infrastructure Code: Convert an approved multi-resource design into modular Bicep or Terraform, then validate dependencies, schemas, names, and deployment scope.
- Plan Resilient Regulated Workloads: Compare regional, recovery, encryption, private-access, logging, and managed-identity options while preserving compliance and approval gates.

## Prompt Templates

### Beginner: Plan a Workload

```
Plan Azure infrastructure for [workload] in [region] with [budget]. Ask focused questions before recommending services. Stop after presenting the draft plan.
```

### Intermediate: Design Hub-Spoke Networking

```
Design a hub-spoke topology for [environments] and [regions]. Include firewall, private endpoints, DNS, routing, identity, monitoring, and cost tradeoffs.
```

### Advanced: Plan Multi-Region Recovery

```
Plan recovery for [workload] with [RTO] and [RPO]. Compare active-active and active-passive options, dependencies, failover, data replication, and operational testing.
```

### Expert: Generate Reviewed Infrastructure Code

```
Create an approved plan for [requirements], then generate [Bicep or Terraform]. Validate schemas, naming, pairings, scope, and security. Do not deploy.
```

## Limitations

- Current Azure guidance depends on configured MCP tools and their availability.
- The skill does not use Azure Developer CLI and is not intended for app-centric preparation workflows.
- Regional availability, quotas, permissions, and existing policies still require validation against the target subscription.
- Deployment changes live resources and requires authenticated tooling, correct privileges, reviewed code, and explicit confirmation.

## Best Practices

- Provide workload goals, environments, compliance needs, traffic, data requirements, availability targets, budget, and preferred regions.
- Review resource alternatives, dependencies, security posture, naming, costs, and recovery assumptions before approving the plan.
- Inspect generated infrastructure code and preview changes in the intended Azure context before authorizing deployment.

## Anti Patterns

- Do not request deployment before reviewing and approving the architecture plan and generated infrastructure code.
- Do not place secrets, connection strings, or sensitive identifiers in prompts, planning artifacts, parameter files, or version control.
- Do not treat reference catalogs as proof of current regional availability, quota, policy compliance, or subscription permissions.

## Security Audit

- Audited at: 2026-07-23T18:39:54.737\+00:00
- Summary: All 72 static alerts are false positives caused by documentation syntax, project-local planning artifacts, Azure service names, and relative Markdown links. The documented deployment commands are intentional and protected by plan approval, validation, active-context checks, and explicit confirmation. Two semantic concerns remain around trusting cached insight text and protecting persisted Azure environment observations.

## Stats

- Views: 108
- Downloads: 9
- Favorites: 0
- Popularity score: 0