# Validate Azure Deployments Before Release

Azure deployment failures often begin with missed configuration, policy, identity, or infrastructure issues. This skill runs structured readiness checks and records evidence before resources are deployed.

## Install

```bash
npx skillstore add microsoft/azure-validate
```

## Metadata

- Status: approved
- Slug: microsoft-azure-validate
- Version: 0.0.0-placeholder
- Author version: 0.0.0-placeholder
- Skillstore revision: r2
- Version status: valid
- Tree hash: b571f2d585f480ebe8b3e090b57741fcee30b98b1d9fdb4e6d419656b2c799b9
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-validate/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-validate
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-validate/manifest

## Capabilities

- Selects an Azure CLI, Azure Developer CLI, Bicep, or Terraform validation recipe from project files.
- Validates azure.yaml structure, authentication, subscription, region, package readiness, and Azure policy compatibility.
- Compiles Bicep templates and runs Azure validation and what-if previews.
- Initializes, formats, validates, and plans Terraform infrastructure, including AZD variable checks.
- Reviews managed identity role assignments for data-plane access and least-privilege scope.
- Checks .NET Aspire secret storage and Container Apps environment values before deployment.

## Use Cases

- Standardize Release Gates: Apply repeatable validation checklists across Azure projects before approving a deployment.
- Diagnose Deployment Blockers: Find schema, build, infrastructure, environment, and packaging problems before a release attempt.
- Review Identity and Policy: Check infrastructure code for least-privilege roles and organizational policy conflicts.

## Prompt Templates

### Check Project Readiness

```
Inspect this Azure project for deployment readiness. Identify its deployment method, run only non-mutating checks, and summarize blockers before proposing any changes.
```

### Validate a Bicep Deployment

```
Validate ./infra/main.bicep and its parameters. Compile the template, run the correct scope validation and what-if preview, then explain every failure.
```

### Audit Terraform and RBAC

```
Review the Terraform deployment in ./infra. Check initialization, formatting, validation, plan output, backend access, variables, policies, and least-privilege RBAC assignments.
```

### Run an AZD Aspire Preflight

```
Audit this AZD and .NET Aspire project end to end. Inspect azure.yaml, build prerequisites, Functions secret storage, Container Apps values, policies, and RBAC. Do not deploy. Ask before any mutating or repository-defined command.
```

## Limitations

- Requires an approved project-local deployment plan created by the separate azure-prepare workflow.
- Depends on installed Azure, AZD, Bicep, Terraform, Docker, and MCP tools appropriate to the project.
- Some checks execute repository-defined builds or packaging, so untrusted projects require isolation and approval.
- Live role assignments and application behavior require separate postdeployment verification.

## Best Practices

- Review proposed commands and confirm subscription and region before running Azure checks.
- Use least-privilege credentials and isolate builds when reviewing untrusted repositories.
- Record each command, result, failure, and approved fix in the deployment plan.

## Anti Patterns

- Do not treat a successful syntax check as proof that runtime permissions are correct.
- Do not run deployment, provisioning, package, or build commands without user approval and repository review.
- Do not use wildcard CORS or broad RBAC roles as temporary production fixes.

## Security Audit

- Audited at: 2026-07-23T19:43:24.637\+00:00
- Summary: All 56 static findings are false positives caused by Markdown formatting, relative documentation links, expected Azure checks, or project-local plan paths. Semantic review found a critical authority injection, high-risk execution of repository-defined builds, and a medium-risk wildcard CORS workaround.

## Stats

- Views: 157
- Downloads: 11
- Favorites: 0
- Popularity score: 0