Kipt

Your prompts and skills, one keystroke away.

Explore

Azure validate skill: preflight checks before an Azure deployment

The Azure validate skill runs preflight checks on azure.yaml, Bicep or Terraform, RBAC roles and policy before a coding agent deploys to Azure. How to install it.

By the Kipt team · Updated 26 October 2026

Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 26 October 2026

What is the Azure validate skill?

The Azure validate skill makes a coding agent run preflight checks on an Azure project before anything is deployed: the azd configuration, Bicep or Terraform, a build, RBAC role assignments in the infrastructure code, and Azure Policy. It is for developers who let an agent generate infrastructure and want proof it will work before real resources are created.

Its description reads: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying." Its triggers include "validate my app," "run preflight checks," "verify RBAC roles," "what-if analysis" and "troubleshoot deployment errors."

It ships in microsoft/azure-skills, the Azure Skills Plugin, which the README groups under "Build, deploy, and evolve." The README says the repo is synced automatically from microsoft/GitHub-Copilot-for-Azure. The SKILL.md frontmatter lists version 1.2.3 and author Microsoft.

As of 26 October 2026, its skills.sh page listed about 566,700 installs (snapshot, 26 October 2026).

What does it do?

The SKILL.md is short. Most of the work is driven by a workflow script that tells the agent one step at a time what to do next.

Prerequisite. azure-prepare must have run, and .azure/deployment-plan.md must exist with status Approved or later. If the plan is missing, the skill says to stop and invoke azure-prepare.

Three rules: run after azure-prepare and before azure-deploy; all checks must pass, so do not deploy with failures; destructive actions need your confirmation.

The workflow script. The agent runs workflow.sh (or workflow.ps1 on Windows), performs the action it prints, then re-runs it with the step it finished. Progress is saved in .azure/validate-status.json. The steps, in order:

Step Action the script prints
LoadPlan Read the plan for recipe and configuration
AddValidationSteps Copy the recipe's validation steps into the plan
RunValidation Run the recipe-specific validation commands
BuildVerification Build the project and fix errors
StaticRoleVerification Review Bicep or Terraform for correct RBAC role assignments
RecordProof Write commands and results into the plan's Validation Proof section
ResolveErrors Fix any failures
UpdateStatus Only after all checks pass, set status to Validated

Recipe checks. The validation recipes match the deployment recipes:

  • AZD: twelve steps including azure.yaml schema validation, environment setup, auth and subscription checks, azd provision --preview --no-prompt, build, Docker build context, package and policy checks, plus Aspire checks.
  • AZCLI and Bicep: a shared validate-deployment script that runs az bicep build, az deployment ... validate and a what-if preview, then prints PASS or FAIL per step.
  • Terraform: a validate-terraform script that runs terraform init, fmt -check, validate, plan and state list, scans for unresolved Go-style {{ .Env.* }} template variables and checks main.tfvars.json syntax. It runs every check even after a failure.

Role verification. The role guide checks that every managed identity has a role, that data access uses data-plane roles, and that scope is least privilege. Its mapping table flags common mistakes, for example using generic Reader where reading blobs needs Storage Blob Data Reader, or Key Vault Reader where reading secrets needs Key Vault Secrets User.

Policy. It gets your subscription ID and lists assigned policies through the Azure MCP policy tool, then looks for disallowed SKUs, missing tags, location limits and network rules.

How do you install the Azure validate skill?

The repo README documents these routes. Install the whole plugin if you can, since this skill sits between azure-prepare and azure-deploy.

Claude Code: the Azure Skills Plugin. Run inside Claude Code:

/plugin install azure@claude-plugins-official

Or run /plugin and search for "azure". The plugin bundles all the Azure skills with the Azure MCP Server. Update with /plugin update azure@claude-plugins-official. See Claude Code plugins and Claude Code MCP.

GitHub Copilot CLI:

/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills

Codex and Cursor. The README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins; for Cursor, use the Cursor Marketplace or Settings, then Plugins. See Codex skills and Cursor skills.

APM. The README also documents apm install microsoft/azure-skills for installing across several agents at once.

Skill only. The command on skills.sh:

npx skills add https://github.com/microsoft/azure-skills --skill azure-validate

Without the plugin, the policy step has no Azure MCP tool to call, so you would need the Azure MCP Server set up yourself.

Prerequisites, per the README: an Azure subscription, Node.js 18 or later, the Azure CLI signed in with az login, and the Azure Developer CLI signed in with azd auth login for deployment workflows. The Terraform recipe also needs Terraform installed.

How do you use it?

Usually you don't call it directly: azure-prepare hands off to it when preparation is done. You can also ask for validation on a project that already has a plan file.

Example prompts (suggestions; the first is from the README's prompt list):

  • Validate my Azure deployment files before I run azd up.
  • Run preflight checks on this project. Validate only, don't deploy.
  • Check the Bicep in infra/ for missing role assignments for the app's managed identity.
  • Run a what-if on this template against rg-staging and summarize what would change.
  • azd provision failed on the last run. Re-validate and fix the errors.

The second prompt matters: the skill only hands off to azure-deploy if you explicitly asked to deploy.

Tips and limits

From the repo and skills.sh, not from testing:

  • It runs commands against your subscription. What-if, azd provision --preview and terraform plan read live Azure state with your credentials. They preview changes rather than apply them, but review any script before allowing it if your policy requires that.
  • It edits the plan file. It adds validation steps and a proof section to .azure/deployment-plan.md and sets status to Validated. azure-deploy checks that proof exists.
  • It only validates code, not live roles. Its role check reads Bicep or Terraform. Checking roles on provisioned resources happens in azure-deploy.
  • The plugin adds telemetry hooks. The Azure plugin's Claude Code hooks run a telemetry script on session start and after tool use. The README says to set AZURE_MCP_COLLECT_TELEMETRY=false to opt out.
  • Security audits. On skills.sh, Gen Agent Trust Hub, Socket and Snyk all rated it Pass as of 3 October 2026. Gen Agent Trust Hub's notes flag two surfaces: workspace files such as azure.yaml and .tf files are read without sanitization, and the helper scripts run az, azd, terraform, docker and npm.

The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.

Save it in your Kipt library

If you want your own copy with extra checks, for example your organization's required tags or allowed regions, Kipt can hold it. Open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. The copy includes the workflow and validation scripts but not the plugin's MCP configuration. Skills in your private GitHub repo install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Microsoft.

Similar skills

Questions

What is the Azure validate skill?

azure-validate is an Agent Skill in Microsoft's microsoft/azure-skills repo. Its description calls it pre-deployment validation for Azure readiness: checks on configuration, Bicep or Terraform, RBAC role assignments, managed identity permissions and prerequisites. It is the middle step between azure-prepare and azure-deploy.

Does the Azure validate skill deploy anything?

No. It checks and records results. If you asked only to validate, it stops after setting the plan status to Validated and reports the results; it hands off to azure-deploy only when you explicitly asked for deployment.

What does the Azure validate skill check for Bicep?

Its shared validate-deployment script checks that the Azure CLI is installed and signed in, builds the template with az bicep build, validates it against the target scope, and runs a what-if preview that summarizes creates, modifies and deletes.

Do I need azure-prepare before azure-validate?

Yes. The skill stops if .azure/deployment-plan.md is missing and tells the agent to run azure-prepare first. The plan supplies the recipe, and validation results are written back into it as proof.

How do I install the Azure validate skill?

In Claude Code, run /plugin install azure@claude-plugins-official to get the full Azure Skills Plugin. For this skill alone, run npx skills add https://github.com/microsoft/azure-skills --skill azure-validate, and add azure-prepare too, since it depends on that skill's plan file.

More in Skill directory

All guides

Keep your prompts and skills in one place, in your own GitHub. Install every skill with one command.

Get started

Kipt is an independent product, not affiliated with or endorsed by Anthropic, OpenAI, Cursor or GitHub. Claude, ChatGPT, Codex, Cursor and GitHub are trademarks of their owners.