microsoft/azure-skills▌

Microsoft Entra ID app registration, OAuth 2.0 configuration, and MSAL integration for secure application authentication. \n \n Covers app registration setup, authentication configuration, API permissions, and client credential management across web apps, SPAs, mobile apps, and daemon services \n Includes step-by-step workflows for first-time registration, console application authentication, and service-to-service credential flows \n Provides Azure CLI commands, MSAL library examples for .NET, J

Identify cost savings across Azure subscriptions through resource analysis, utilization metrics, and actionable optimization recommendations. \n \n Discovers orphaned resources (unattached disks, unused NICs, idle gateways) and over-provisioned services using Azure Quick Review \n Queries actual costs from Azure Cost Management API and utilization data from Azure Monitor to support rightsizing recommendations \n Generates prioritized optimization reports with estimated savings, implementation co

End-to-end deployment, evaluation, and management of AI agents on Microsoft Foundry. \n \n Covers the complete agent lifecycle: creation from starter samples, containerization and ACR push, hosted or prompt agent deployment, invocation, batch evaluation, and prompt optimization \n Includes specialized sub-skills for deploy, invoke, observe (evaluation and prompt optimization), trace analysis, troubleshooting, and dataset curation from production traces \n Supports project and resource provisioni

Assess and migrate cloud workloads from AWS, GCP, and other providers to Azure services. \n \n Supports Lambda-to-Azure Functions migration with dedicated scenario reference and best practices \n Generates assessment reports mapping source services to Azure equivalents before any code conversion \n Converts source code to target Azure runtime models, with output isolated in a separate <source-folder>-azure/ directory \n Requires sequential phase execution: assessment first, then migration,

Recommend Azure VM sizes, scale sets, and configurations based on workload requirements and budget. \n \n Analyzes workload type, performance needs, scaling requirements, and cost to suggest 2–3 VM or VMSS options with trade-offs \n Verifies recommendations against live Microsoft documentation; falls back to reference files if fetch fails \n Queries the unauthenticated Azure Retail Prices API for current pricing without requiring an Azure subscription \n Guides VM vs VMSS decision through a deci

Execute KQL queries and analyze data in Azure Data Explorer for log analytics, telemetry, and time series insights. \n \n Execute KQL queries against massive datasets with sub-second performance, including filtering, aggregation, time series analysis, and cross-table joins \n Discover and explore cluster resources, databases, and table schemas to understand your data model before querying \n Supports five core query patterns: basic retrieval, aggregation analysis, time series analytics, join-bas

Unified access to Azure blob storage, file shares, queues, tables, and data lake services. \n \n Supports five storage service types: Blob Storage for objects and backups, File Shares for SMB access, Queue Storage for async messaging, Table Storage for NoSQL key-value data, and Data Lake for big data analytics \n MCP server tools enable listing storage accounts, containers, and blobs, plus downloading and uploading blob content directly \n Configurable access tiers (hot, cool, cold, archive) and

Assess and automate upgrades of Azure workloads across plans, tiers, and SKUs. \n \n Handles plan migrations (Consumption to Flex Consumption), tier upgrades, and cross-service moves (App Service to Container Apps) with sequential assessment before any changes \n Generates pre-upgrade readiness reports, collects existing app settings and configurations, then executes automated upgrade steps with idempotent scripts \n Requires explicit user confirmation for destructive actions and target plan/SKU

Azure compliance scanning, Key Vault expiration auditing, and resource configuration validation. \n \n Runs azqr (Azure Quick Review) for comprehensive compliance assessment against best practices across subscriptions and resource groups \n Monitors Key Vault keys, secrets, and certificates for expiration dates and identifies items without expiration policies \n Detects orphaned, misconfigured, and non-compliant resources using Resource Graph queries \n Classifies findings by priority (Critical,

Configure Azure API Management as an AI Gateway for models, MCP tools, and agents with built-in governance policies. \n \n Supports semantic caching (60-80% cost savings), token rate limiting, content safety filtering, and jailbreak detection across AI backends \n Add Azure OpenAI, AI Foundry models, or convert existing APIs to MCP tools as managed backends with load balancing \n Includes five core policy categories: authentication, semantic cache lookup, token limits, content safety, and token

Build and deploy GitHub Copilot SDK applications to Azure with flexible model configuration. \n \n Three scaffolding paths: create new greenfield projects, add SDK services to existing repos, or deploy existing SDK apps with Azure infrastructure \n Supports three model configurations: GitHub's default models, specific GitHub models via discovery, or bring-your-own-model (BYOM) on Azure with DefaultAzureCredential authentication \n Includes complete templates with Express/TypeScript API, React/Vi

Fast discovery and inventory of Azure resources across subscriptions using Resource Graph queries. \n \n Queries any Azure resource type (VMs, storage accounts, web apps, container apps, Key Vaults, etc.) across subscriptions and resource groups in a single command \n Supports cross-cutting searches for orphaned resources, missing tags, unhealthy states, and resource inventory counts \n Routes single-resource-type queries to dedicated MCP tools when available; falls back to Azure Resource Graph

Access Azure AI Search, Speech, OpenAI, and Document Intelligence services through unified MCP tools. \n \n AI Search supports full-text, vector, hybrid, and semantic search with built-in AI enrichment for entity extraction and OCR \n Speech service handles real-time and batch speech-to-text transcription, text-to-speech synthesis with neural voices, and speaker diarization \n MCP tools provide direct access: azure__search for index queries and azure__speech for transcription and synthesis \n SD

Find minimal Azure RBAC roles, generate assignment commands, and provide Bicep infrastructure code. \n \n Identifies built-in roles matching desired permissions using Azure documentation, or creates custom role definitions when no built-in role fits \n Generates Azure CLI commands and Bicep code snippets for assigning roles to identities, service principals, and managed identities \n Clarifies prerequisites for granting roles, including which permissions ( Microsoft.Authorization/roleAssignments

Check and manage Azure quotas and usage across regions for deployment planning and capacity validation. \n \n Azure CLI ( az quota ) is the only reliable method for checking quotas; REST API and Portal are unreliable and may show misleading \"No Limit\" values that do not indicate unlimited capacity \n Supports four core workflows: checking specific resource quotas, comparing capacity across regions, requesting quota increases, and listing all quotas for a provider \n Quota resource names do not

Activate this skill when user wants to:

Transform Azure resource groups into detailed architecture diagrams showing resource relationships and configurations. \n \n Discovers all resources within a resource group and analyzes their configurations, dependencies, and interconnections \n Generates Mermaid diagrams organized by logical layers (Network, Compute, Data, Security, Monitoring) with SKU details and connection labels \n Maps relationships including network connections, data flows, identity bindings, and configuration dependencie

Diagnose and resolve Azure Event Hubs and Service Bus SDK issues with structured troubleshooting workflows. \n \n Covers connection failures, authentication errors, AMQP link issues, message lock timeouts, and event processor stalls across Python, Java, JavaScript, and .NET SDKs \n Includes language-specific troubleshooting guides for Event Hubs and Service Bus, plus connectivity diagnostics for ports, WebSocket fallback, IP firewalls, and private endpoints \n Provides MCP tools to query resourc

Query metrics, logs, and traces across Azure Monitor, Application Insights, and Log Analytics. \n \n Access metrics, KQL log queries, and distributed tracing through MCP tools or Azure CLI commands \n Supports Application Insights for APM and performance analysis, Log Analytics for custom KQL queries, and Azure Monitor for infrastructure metrics \n Includes common KQL query patterns for errors, request performance, and resource usage monitoring \n Workbooks integration for building interactive o

Systematic diagnosis and remediation for Azure production issues using AppLens, Monitor, and resource health. \n \n Covers Container Apps, Function Apps, and AKS troubleshooting with service-specific guides for image pulls, cold starts, health probes, invocation failures, and node/pod issues \n Integrates AppLens (MCP) for AI-powered root cause analysis and Azure Monitor (MCP) for KQL-based log and metric queries \n Provides a five-step diagnostic flow: identify symptoms, check resource health,

Guidance and reference material for instrumenting webapps with Azure Application Insights. \n \n Covers SDK setup, telemetry patterns, and configuration for ASP.NET Core and Node.js applications hosted in Azure \n Distinguishes between this skill (reference and guidance) and azure-prepare (actual implementation); invoke azure-prepare when the user wants to add instrumentation to their project \n Provides auto-instrumentation guidance for C# ASP.NET Core apps in Azure App Service, plus manual ins

Execute Azure deployments for prepared applications with built-in error recovery and validation. \n \n Requires .azure/plan.md with Validated status from azure-validate and azure-prepare skills; will not proceed without both prerequisites \n Executes azd up , azd deploy , terraform apply , and az deployment commands with error handling and post-deployment verification \n Includes pre-deploy checklist, recipe-based deployment workflows, and post-deploy configuration for SQL managed identity and E

Pre-deployment validation for Azure infrastructure, configuration, and permissions before deployment. \n \n Requires .azure/plan.md from a prior azure-prepare run; stops immediately if the plan is missing \n Executes recipe-specific validation commands (azd provision, bicep build, terraform validate) and records proof in the plan document \n Performs build verification, configuration checks, and permission validation; blocks deployment if any check fails \n Only authorized method to set plan sta

Prepare Azure applications for deployment with infrastructure-as-code, configuration, and containerization. \n \n Generates Bicep or Terraform infrastructure code, azure.yaml configuration, and Dockerfiles based on application type and deployment target \n Requires mandatory plan-first workflow: analyze workspace, gather requirements, select recipe (AZD, AZCLI, Bicep, or Terraform), design architecture, then execute only after user approval \n Covers new app creation, modernization, and updates;

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE