Search skills/

Azure Deploy (Azure Skills) skill

Microsoft's skill that runs azd up, azd deploy, terraform apply and az deployment on projects already prepared and validated, with error recovery.

in microsoft/azure-skills Cloud & DevOps
Our verdict Recommended

A well-structured, officially maintained deploy runbook; use it as part of the prepare-validate-deploy chain rather than on its own.

4/5 Depth expertise shipped Note Security Review before installing 0d Maintenance Updated today 571K Adoption installs OK License MIT, commercial OK

What the azure-deploy skill does

azure-deploy is the execution step in Microsoft's prepare, validate, deploy chain. It refuses to start unless .azure/deployment-plan.md exists with status Validated and a populated Validation Proof section, and it forbids the agent from editing that status itself. Once the checks pass it follows a ten-step table: read the plan, complete a pre-deploy checklist, load the recipe for the plan's tooling (azd, Azure CLI, Bicep, Terraform or CI/CD), check role assignments for Container Apps pulling from ACR, run the deployment, apply post-deploy SQL managed-identity setup and EF Core migrations if relevant, handle errors, verify endpoints, and re-check roles against live Azure. Each recipe has its own errors.md and verify.md. The folder holds about 40 files, including shell and PowerShell scripts for granting SQL access and running migrations, GitHub Actions and Azure DevOps pipeline examples, a region-availability note and auth guidance. Destructive actions must be confirmed with the user, and results must be reported as full https URLs.

Good for

  • Shipping an app to Azure after azure-prepare and azure-validate have run
  • Teams that want a checklist, RBAC verification and error playbooks around azd or Terraform deploys
  • Setting up GitHub Actions or Azure DevOps pipelines for azd

Not for

  • Creating a new app or infrastructure from scratch (use azure-prepare)
  • Deploying outside Azure or without the plan file workflow

Depth 4/5

6.6 KB SKILL.md plus about 40 files: per-tool recipes with error and verify notes, four helper scripts, CI/CD pipeline examples; no evals.

Dependencies and costs

  • Azure account or subscription
  • Azure CLI signed in with az login
  • Azure MCP Server (installed with the plugin; needs Node.js 18+ for npx)
  • Azure Developer CLI (azd)
  • Terraform or Bicep tooling, depending on the recipe
  • Output of azure-prepare and azure-validate (.azure/deployment-plan.md)
  • Telemetry: The skill files contain no telemetry code. The Azure MCP Server that the plugin wires in has its own telemetry; the repo README says to disable it with AZURE_MCP_COLLECT_TELEMETRY=false.

Security review

Review before installing

Skill that runs azd up, azd deploy, terraform apply or az deployment for an already-prepared Azure app. It creates and updates cloud resources, grants SQL roles to the app's managed identity and applies EF Core migrations; the docs require prior validation and a user prompt for destructive actions, and use --no-prompt for azd commands after that.

Worth knowing

  • Relies on a CLI or package we could not reviewDepends on azd, az and dotnet, plus terraform for the Terraform recipes; the skill runs 'azd up', 'azd deploy' and 'terraform apply'..github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/scripts/grant-and-migrate.sh:1
  • Installs packages or toolsInstalls the az rdbms-connect extension (line 56) and 'dotnet tool install --global dotnet-ef' (apply-migrations.sh line 45)..github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/scripts/grant-and-migrate.sh:56
  • Installs with curl | shReference doc gives 'curl -fsSL https://aka.ms/install-azd.sh | bash' as the azd install command..github/plugins/azure-skills/skills/azure-deploy/references/sdk/azd-deployment.md:8

What we checked

The skill folder (41 files) on Oct 29, 2026. Not a full review: we read 2 of 4 code files; it relies on code outside the repository: Azure CLI (az) and the az extensions it installs on demand; not part of the files we have; Azure Developer CLI (azd), terraform and the dotnet-ef tool; Azure MCP Server, started by the plugin through npx; its configuration sits outside this skill folder.

NVIDIA SkillSpector static scan: 32 pattern hits (Privilege Escalation 20, Excessive Agency 6, analysis-evasion 2, Rogue Agent 1, Supply Chain 1, Tool Misuse 1). Hits are documentation or scanner noise: '.azure/' paths, a 'Replace existing file' rule, the azd install one-liner and .env mentions. grant-and-migrate.sh also grants db_datareader, db_datawriter and db_ddladmin to the app's managed identity, which is its stated purpose.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT (declared in the SKILL.md frontmatter); the repo is a mirror synced from microsoft/GitHub-Copilot-for-Azure and has no top-level LICENSE file in our copy. Commercial use allowed under MIT.

Can it run unattended?

Not really. It is gated on an approved, validated plan and asks the user before destructive actions, so it is designed for supervised runs.

Alternatives

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

Recommended Check first Depth 4/5

Vercel Agent Skills

vercel-labs/agent-skills

Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.

Recommended Broad access Depth 3/5

Google Agent Skills

google/skills

Google's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.

Recommended Broad access Depth 3/5

FAQ

What is the azure-deploy skill?

It is the deployment step of Microsoft's Azure plugin. It executes azd, Terraform or az deployment commands for an application that already has a validated .azure/deployment-plan.md, then verifies endpoints and RBAC.

Why does azure-deploy refuse to run?

It requires a plan file with status Validated and recorded validation proof. Run azure-prepare and then azure-validate first; the skill explicitly forbids the agent from setting that status itself.

Is azure-deploy safe to use?

It makes real changes to your Azure subscription, so treat it like running azd up yourself. The skill requires confirmation for destructive actions and uses your az and azd logins, but test on a dev subscription first.

azure-deploy vs azure-prepare?

azure-prepare writes the plan, azure.yaml and infrastructure code. azure-deploy only executes deployments of that prepared output.

Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.