# Prepare Azure Projects for azd Deployment

Preparing an application for Azure requires coordinated configuration, infrastructure, security, and service choices. This skill creates an approved azd plan and generates deployment artifacts.

## Install

```bash
npx skillstore add microsoft/azure-prepare
```

## Metadata

- Status: approved
- Slug: microsoft-azure-prepare
- Version: 0.0.0-placeholder
- Author version: 0.0.0-placeholder
- Skillstore revision: r2
- Version status: valid
- Tree hash: b8ae13e56291207cd339ac50978fedc02e9d08a57ceb45a0f8e82ed1d6cc9e87
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-prepare/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access, network, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-prepare
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-prepare/manifest

## Capabilities

- Classifies a workspace as a new, modified, or modernized Azure project.
- Creates a project-local deployment plan before generating infrastructure.
- Selects azd recipes and maps application components to Azure services.
- Generates azure.yaml, Bicep or Terraform infrastructure, and Dockerfiles.
- Applies managed identity, RBAC, Key Vault, and network security guidance.
- Routes completed preparation artifacts to Azure validation and deployment workflows.

## Use Cases

- Prepare a New Azure Application: Create an approved azd plan, service mapping, infrastructure, and application configuration for a new project.
- Modernize an Existing Service: Preserve existing code while adding managed Azure services, containers, identity, networking, and deployment configuration.
- Design Multi-Service Infrastructure: Plan Bicep or Terraform resources, RBAC, quotas, and service dependencies for a coordinated Azure architecture.

## Prompt Templates

### Prepare an Existing Application

```
Prepare this application for Azure with azd. Inspect the workspace and create the required deployment plan. Do not execute the plan until I approve it.
```

### Generate Bicep for a Web API

```
Create azd configuration and Bicep infrastructure for this Node.js API. Use managed identity and document every resource choice before generating files.
```

### Modernize with Terraform

```
Modernize this multi-service application for Azure Container Apps with azd and Terraform. Preserve existing code and propose a phased plan for approval.
```

### Plan an Event-Driven Platform

```
Design Azure Functions with Service Bus and Durable Task Scheduler. Include RBAC, networking, quota checks, and validation handoff. Do not deploy.
```

## Limitations

- The skill is intended for azd workflows, not general cloud migration or code-only deployment.
- It requires user approval and confirmed Azure subscription and region choices.
- Its primary workflow stops before deployment, but some bundled references contain direct azd deployment commands.
- Generated infrastructure still requires review for current quotas, policies, service versions, and production security requirements.

## Best Practices

- Review and approve the deployment plan before any file generation or cloud action.
- Use managed identity and narrowly scoped RBAC instead of keys, passwords, or broad roles.
- Validate generated infrastructure, network boundaries, quotas, and cost assumptions before deployment.

## Anti Patterns

- Do not run remote installers or templates without pinning and verification.
- Do not deploy from the preparation workflow or bypass the validation handoff.
- Do not expose public endpoints, shared keys, or plaintext secrets by default.

## Security Audit

- Audited at: 2026-07-23T18:56:46.859\+00:00
- Summary: Most static matches are documentation false positives, including Markdown links, SDK environment lookups, and Azure resource identifiers. Confirmed risks include a pipe-to-shell installer, broad network rules, embedded storage keys, and an unsafe session-secret fallback. Semantic review found prompt injection, unverified remote templates, and approval bypasses; 279 capped static matches still require manual review. Static review was capped at 400/679 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

## Stats

- Views: 566
- Downloads: 11
- Favorites: 0
- Popularity score: 0