Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 26 October 2026
What is the Azure deploy skill?
The Azure deploy skill lets a coding agent run the actual deployment of an Azure project, azd up, azd deploy, terraform apply or az deployment, after the project has been prepared and validated. It is for developers who want an agent to ship to Azure and handle common failures, but only through a checked path.
Its description starts: "Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files." It adds that the skill "runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery," and lists triggers such as "ship it," "go live," "terraform apply" and "publish to Azure." Requests like "create and deploy" go to azure-prepare instead.
It ships in microsoft/azure-skills, the Azure Skills Plugin, which the README groups under "Build, deploy, and evolve." The README says the repo is synced automatically from microsoft/GitHub-Copilot-for-Azure. The SKILL.md frontmatter lists version 1.2.2 and author Microsoft.
As of 26 October 2026, its skills.sh page listed about 567,400 installs (snapshot, 26 October 2026).
What does it do?
The SKILL.md is the last step of Microsoft's three-skill chain: azure-prepare, then azure-validate, then azure-deploy.
Prerequisite check. Before anything runs, the agent must confirm .azure/deployment-plan.md exists and its status is Validated, and that the plan's Validation Proof section holds real commands and timestamps. The skill says the agent is "FORBIDDEN from changing the plan status to Validated yourself."
Ten steps:
| Step | What happens |
|---|---|
| 1 | Check the plan status and proof |
| 2 | Work through the pre-deploy checklist |
| 3 | Load the recipe named in the plan |
| 4 | For Container Apps pulling from ACR with managed identity: provision, then confirm the AcrPull role has propagated |
| 5 | Execute the deployment |
| 6 | Post-deploy: SQL managed identity setup and EF Core migrations if needed |
| 7 | Handle errors from the recipe's error guide |
| 8 | Verify endpoints respond |
| 9 | Query Azure to confirm the provisioned role assignments |
| 10 | Report endpoint URLs as full https:// links |
Pre-deploy checklist. Confirm the subscription with you, create the azd environment first, check whether the resource group already exists, look for azd-service-name tag conflicts, check for existing Container Apps environments, confirm the region, and only then deploy. For azd with Terraform it also checks that no Go-style {{ .Env.* }} template variables are left in the Terraform files.
Recipes. AZD, AZCLI, Bicep, Terraform and CI/CD. The azd recipe runs azd provision --no-prompt then azd deploy --no-prompt, and says to keep them as separate steps for Container Apps with ACR managed identity so the role can propagate. It also lists common mistakes, for example that --location is not a valid flag for azd up. The CI/CD recipe includes example GitHub Actions workflows for azd and Bicep and Azure DevOps pipelines, one of them multi-stage with approvals.
Live role verification. azure-validate checks roles in your Bicep or Terraform. This skill queries Azure after deployment to confirm the provisioned identities really have the roles they need, since provisioning can fail quietly or policy can change assignments.
The MCP tools it names include subscription and resource group listing, an azd tool and a role tool, which map to the Azure MCP Server tool list.
How do you install the Azure deploy skill?
The repo README documents these routes. Install the whole plugin if you can, since this skill will not run without the other two.
Claude Code: the Azure Skills Plugin. Run inside Claude Code:
/plugin install azure@claude-plugins-official
Or run /plugin and search for "azure". The plugin bundles all the Azure skills with the Azure MCP Server. Update with /plugin update azure@claude-plugins-official. See Claude Code plugins and Claude Code MCP.
GitHub Copilot CLI:
/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills
Codex and Cursor. The README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins; for Cursor, use the Cursor Marketplace or Settings, then Plugins. See Codex skills and Cursor skills.
APM. The README also documents apm install microsoft/azure-skills for installing across several agents at once.
Skill only. The command on skills.sh:
npx skills add https://github.com/microsoft/azure-skills --skill azure-deploy
Prerequisites, per the README: an Azure subscription, Node.js 18 or later, the Azure CLI signed in with az login, and the Azure Developer CLI signed in with azd auth login. Terraform recipes also need Terraform.
How do you use it?
In the usual flow, azure-validate hands off to this skill when you asked to deploy. You can also call it on a project that already passed validation.
Example prompts (suggestions; the first is from the README's prompt list):
Deploy this project to Azure Container Apps.Validation passed. Run azd up and give me the endpoint.Push my latest changes to the existing Azure deployment with azd deploy.Run terraform apply for this validated plan and verify the app responds.Set up a GitHub Actions workflow that deploys this azd project on push to main.
If you ask to deploy a project that has no plan, expect the agent to go back to azure-prepare first.
Tips and limits
From the repo and skills.sh, not from testing:
- It creates real resources and costs. It provisions with your credentials. Destructive actions such as
azd downor deleting a resource group need your explicit confirmation under the shared global rules, but provisioning itself is the point, so check the plan's services and SKUs first. Claude Code permissions can make commands ask before they run. - Deploys take time. The azd recipe says
azd uptakes 5 to 15 minutes and that output should stream visibly. - It runs scripts. The azd recipe includes Bash and PowerShell scripts for SQL access grants and EF Core migrations.
- The plugin adds telemetry hooks. The Azure plugin's Claude Code hooks run a telemetry script on session start and after tool use. The README says to set
AZURE_MCP_COLLECT_TELEMETRY=falseto opt out. - Security audits. On skills.sh, Gen Agent Trust Hub and Snyk rated it Pass on 3 October 2026. Socket rated it Warn on 3 October 2026 with one low-severity alert on the SQL managed identity guide. Socket called it "legitimate Azure SQL managed-identity provisioning documentation" with no sign of malware, and flagged
evaluse and unvalidated environment values placed into SQL. Its advice is to validate names, escape SQL and avoideval.
The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.
Save it in your Kipt library
If you want your own edited copy, for example with your team's required approval step or pipeline template, Kipt can hold it. Open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. A copy carries the skill files and scripts only, not the plugin's MCP configuration or hooks. Skills in your private GitHub repo install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Microsoft.
Similar skills
- Azure prepare skill: plans and generates the infrastructure this skill deploys.
- Azure validate skill: the required check before deployment.
- Azure diagnostics skill: troubleshooting after the app is live.
- Deploy to Vercel skill: the equivalent for Vercel projects.
- GitHub Actions templates skill: writing CI/CD workflows.