cloud▌

Pre-deployment validation for Azure infrastructure, configuration, and permissions before deploying. \n \n Runs recipe-specific validation commands (azd provision, bicep build, terraform validate) and records proof in .azure/plan.md \n Requires .azure/plan.md from azure-prepare skill as input; blocks deployment if plan is missing or status is not Approved \n Validates azure.yaml, Bicep templates, Terraform configurations, Azure Functions, and app readiness across multiple deployment scenarios \n

Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS environment, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS.

This skill handles assessment and automated upgrades of existing Azure workloads from one Azure service, hosting plan, or SKU to another — all within Azure. This includes plan/tier upgrades (e.g. Consumption → Flex Consumption), cross-service migrations (e.g. App Service → Container Apps), and SKU changes. This is NOT for cross-cloud migration — use azure-cloud-migrate for that.

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment'. PREFER

Govern AI models, MCP tools, and agents through Azure API Management with semantic caching, token limits, and content safety. \n \n Supports five core policy categories: semantic caching (60-80% cost savings), token rate limiting, content safety filtering, jailbreak detection, and request rate limiting for MCP tool protection \n Enables backend configuration for Azure OpenAI, AI Foundry models, and custom APIs with load balancing and managed identity authentication \n Includes token metrics and

Unified Azure cost management: query historical costs, forecast future spending, and optimize to reduce waste. WHEN: \"Azure costs\", \"Azure spending\", \"Azure bill\", \"cost breakdown\", \"cost by service\", \"cost by resource\", \"how much am I spending\", \"show my bill\", \"monthly cost summary\", \"cost trends\", \"top cost drivers\", \"actual cost\", \"amortized cost\", \"forecast spending\", \"projected costs\", \"estimate bill\", \"future costs\", \"budget forecast\", \"end of month co

Microsoft Entra ID app registration, OAuth 2.0 configuration, and MSAL integration for secure application authentication. \n \n Covers app registration setup, authentication configuration, API permissions, and client credential management across web apps, SPAs, mobile, and daemon services \n Provides step-by-step workflows for first-time registration, console app authentication, and service-to-service flows using Client Credentials \n Includes Azure CLI commands, MSAL library examples for .NET,

$22

Decision framework and service comparison patterns for architecting across AWS, Azure, GCP, and OCI. \n \n Includes detailed service mapping tables across compute, storage, and database categories to identify equivalent offerings and best-of-breed selections \n Four core multi-cloud patterns: single provider with disaster recovery, best-of-breed service selection, geographic distribution, and cloud-agnostic abstraction layers \n Cloud-agnostic alternatives using Kubernetes, PostgreSQL, Apache Ka

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE