Search skills/

Azure Prepare (Azure Skills) skill

Microsoft's skill that plans and generates azure.yaml, Bicep or Terraform and Dockerfiles for azd-based Azure deployments, plan-first.

in microsoft/azure-skills Planning, TDD & debuggingCloud & DevOps
Our verdict Recommended

The most thorough Azure setup workflow in the plugin, with sensible security defaults; expect a long, gated process.

4/5 Depth expertise shipped Note Security Review before installing 0d Maintenance Updated today 572K Adoption installs OK License MIT, commercial OK

What the azure-prepare skill does

azure-prepare is the entry point of Microsoft's prepare, validate, deploy chain. Its 13 KB SKILL.md forces a plan-first workflow: before generating any code the agent must write .azure/deployment-plan.md into the workspace root, fill it in while analyzing the project, show it to the user and wait for approval. Only then does it generate azure.yaml, infrastructure as code (Bicep or Terraform) and Dockerfiles for the Azure Developer CLI. Rules include confirming subscription and region with the user, never deleting the user's project directory, never creating SQL admin logins or passwords in Bicep (Entra-only auth is required), and removing leftover template Bicep after a Terraform conversion. The folder has about 120 files: analysis, architecture and security references, recipes for azd, Azure CLI, Bicep and Terraform, per-service notes for AKS, App Service (including SKU, scaling, slots and networking), App Insights and more, and condensed identity and App Configuration SDK guides. Deployment itself is handed to azure-validate and azure-deploy.

Good for

  • Taking an existing app or idea to an azd-ready Azure setup with a reviewable plan
  • Generating Bicep or Terraform that follows Microsoft's identity and networking defaults
  • Teams that want an approval gate before any infrastructure code is written

Not for

  • Non-azd deployments or quick one-off az commands
  • Cross-cloud migration (use azure-cloud-migrate)

Depth 4/5

12.9 KB SKILL.md plus about 120 reference files covering recipes, services and templates, but only two scripts and no evals.

Dependencies and costs

  • Azure account or subscription
  • Azure CLI signed in with az login
  • Azure MCP Server (installed with the plugin; needs Node.js 18+ for npx)
  • Azure Developer CLI (azd)
  • Bicep or Terraform, depending on the chosen recipe
  • Telemetry: The skill files contain no telemetry code. The Azure MCP Server that the plugin wires in has its own telemetry; the repo README says to disable it with AZURE_MCP_COLLECT_TELEMETRY=false.

Security review

Review before installing

Skill that generates azure.yaml, Bicep or Terraform and Dockerfiles for azd-based Azure projects, writing files into your repository and creating a deployment plan. It uses Azure MCP tools to fetch Functions templates and has one script that grants SQL roles to a managed identity.

Worth knowing

  • Relies on a CLI or package we could not reviewGenerates and runs azd, az, Bicep and Terraform commands; needs sqlcmd for the SQL script..github/plugins/azure-skills/skills/azure-prepare/references/apim.md:26
  • Installs with curl | shReference doc gives 'curl -fsSL https://aka.ms/install-azd.sh | bash' as the azd install command..github/plugins/azure-skills/skills/azure-prepare/references/sdk/azd-deployment.md:8
  • Runs remote code at an unpinned versionSuggests running 'npx @upstash/context7-mcp@latest', a third-party MCP server at an unpinned version, as an optional documentation source (iac-rules.md line 25 says the same)..github/plugins/azure-skills/skills/azure-prepare/references/recipes/azd/terraform.md:328
  • Installs packages or toolsTells you to run 'az extension add --name quota' and 'az extension add --name resource-graph'..github/plugins/azure-skills/skills/azure-prepare/references/resources-limits-quotas.md:30

What we checked

The skill folder (166 files) on Oct 29, 2026. Not a full review: 46 of 166 files were not downloaded (large repository; we reviewed the skill folders); we read 1 of 2 code files; it relies on code outside the repository: Azure CLI (az) and the az extensions it installs on demand; not part of the files we have; Azure Developer CLI (azd), terraform, sqlcmd; npm package @upstash/context7-mcp (optional).

NVIDIA SkillSpector static scan: 64 pattern hits (Privilege Escalation 46, Tool Misuse 9, MCP Rug Pull 4, Data Exfiltration 2, Rogue Agent 1, Supply Chain 1). Hits are documentation: '.azure/' and .env path mentions, a 'Replace existing file' rule, the azd install one-liner and access-token wording in recipes. grant-sql-access.sh validates the app name before building SQL.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT (declared in the SKILL.md frontmatter); the repo is a mirror synced from microsoft/GitHub-Copilot-for-Azure and has no top-level LICENSE file in our copy. Commercial use allowed under MIT.

Can it run unattended?

Not really. It deliberately stops for plan approval and for subscription and region confirmation, so it is interactive.

Alternatives

Vercel Agent Skills

vercel-labs/agent-skills

Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.

Recommended Broad access Depth 3/5

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

Recommended Check first Depth 4/5

Google Agent Skills

google/skills

Google's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.

Recommended Broad access Depth 3/5

FAQ

What does azure-prepare do?

It analyzes your project, writes a deployment plan to .azure/deployment-plan.md, and after you approve it generates azure.yaml, Bicep or Terraform and Dockerfiles for azd. Validation and deployment are handled by azure-validate and azure-deploy.

Why does azure-prepare insist on writing a plan file first?

The file is the contract shared with azure-validate and azure-deploy, which fail without it. The skill says it must exist on disk in the workspace root before any code generation.

Does azure-prepare only work with azd?

Its description says to use it only when you want azd as the deployment tool or the project already has azure.yaml. For non-azd deployments it points elsewhere.

How do I install azure-prepare?

Install Microsoft's Azure plugin: /plugin install azure@claude-plugins-official in Claude Code, or add microsoft/azure-skills as a Codex marketplace; Node.js 18+, az login and azd are needed.

Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.