Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: "setup AI Runway", "onboard AKS cluster", "install AI Runway", "airunway setup", "deploy model to AKS", "GPU inference on AKS", "KAITO setup on AKS", "run LLM on AKS", "vLLM on AKS", "set up model serving on AKS", "AI Runway controller".

Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first…

Guidance and reference material for instrumenting webapps with Azure Application Insights. Covers SDK setup, telemetry patterns, and configuration for ASP.NET Core and Node.js applications hosted in Azure Distinguishes between this skill (reference and guidance) and azure-prepare (actual implementation); invoke azure-prepare when the user wants to add instrumentation to their project Provides auto-instrumentation guidance for C# ASP.NET Core apps in Azure App Service, plus manual...

Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

Access Azure AI Search, Speech, OpenAI, and Document Intelligence services through unified MCP tools. AI Search supports full-text, vector, hybrid, and semantic search with built-in AI enrichment for entity extraction and OCR Speech service handles real-time and batch speech-to-text transcription, text-to-speech synthesis with neural voices, and speaker diarization MCP tools provide direct access: azure__search for index queries and azure__speech for transcription and synthesis SDK...

Configure Azure API Management as an AI Gateway for models, MCP tools, and agents with built-in governance policies. Supports semantic caching (60-80% cost savings), token rate limiting, content safety filtering, and jailbreak detection across AI backends Add Azure OpenAI, AI Foundry models, or convert existing APIs to MCP tools as managed backends with load balancing Includes five core policy categories: authentication, semantic cache lookup, token limits, content safety, and token metrics...

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.

Assess and migrate cloud workloads from AWS, GCP, and other providers to Azure services. Supports Lambda-to-Azure Functions migration with dedicated scenario reference and best practices Generates assessment reports mapping source services to Azure equivalents before any code conversion Converts source code to target Azure runtime models, with output isolated in a separate <source-folder>-azure/ directory Requires sequential phase execution: assessment first, then migration, with user...

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Azure compliance scanning, Key Vault expiration auditing, and resource configuration validation. Runs azqr (Azure Quick Review) for comprehensive compliance assessment against best practices across subscriptions and resource groups Monitors Key Vault keys, secrets, and certificates for expiration dates and identifies items without expiration policies Detects orphaned, misconfigured, and non-compliant resources using Resource Graph queries Classifies findings by priority (Critical, High,...

Recommend Azure VM sizes, scale sets, and configurations based on workload requirements and budget. Analyzes workload type, performance needs, scaling requirements, and cost to suggest 2–3 VM or VMSS options with trade-offs Verifies recommendations against live Microsoft documentation; falls back to reference files if fetch fails Queries the unauthenticated Azure Retail Prices API for current pricing without requiring an Azure subscription Guides VM vs VMSS decision through a decision tree...

Azure VM and VMSS router for recommendations, pricing, autoscale, orchestration, connectivity troubleshooting, capacity reservations, and Essential Machine Management. WHEN: Azure VM, VMSS, scale set, recommend, compare, server, website, burstable, lightweight, VM family, workload, GPU, learning, simulation, dev/test, backend, autoscale, load balancer, Flexible orchestration, Uniform orchestration, cost estimate, connect, refused, Linux, black screen, reset password, reach VM, port 3389,...

Unified Azure cost management: query historical costs, forecast future spending, and optimize to reduce waste. WHEN: \"Azure costs\", \"Azure spending\",…

Unified Azure cost management: query historical costs, forecast future spending, and optimize to reduce waste. WHEN: "Azure costs", "Azure spending", "Azure bill", "cost breakdown", "cost by service", "cost by resource", "how much am I spending", "show my bill", "monthly cost summary", "cost trends", "top cost drivers", "actual cost", "amortized cost", "forecast spending", "projected costs", "estimate bill", "future costs", "budget forecast", "end of month costs", "how much will I spend",...

Execute Azure deployments for prepared applications with built-in error recovery and validation. Requires .azure/plan.md with Validated status from azure-validate and azure-prepare skills; will not proceed without both prerequisites Executes azd up , azd deploy , terraform apply , and az deployment commands with error handling and post-deployment verification Includes pre-deploy checklist, recipe-based deployment workflows, and post-deploy configuration for SQL managed identity and Entity...

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment",...

Systematic diagnosis and remediation for Azure production issues using AppLens, Monitor, and resource health. Covers Container Apps, Function Apps, and AKS troubleshooting with service-specific guides for image pulls, cold starts, health probes, invocation failures, and node/pod issues Integrates AppLens (MCP) for AI-powered root cause analysis and Azure Monitor (MCP) for KQL-based log and metric queries Provides a five-step diagnostic flow: identify symptoms, check resource health, review...

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, troubleshoot functions, troubleshoot AKS, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures,...

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity,…

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment',...

Build, deploy, and modify GitHub Copilot SDK apps on Azure. MANDATORY when codebase contains @github/copilot-sdk or CopilotClient in package.json. PREFER OVER azure-prepare when copilot-sdk markers detected. WHEN: copilot SDK, @github/copilot-sdk, copilot-powered app, build copilot app, prepare copilot app, add feature to copilot app, modify copilot app, BYOM, bring your own model, CopilotClient, createSession, sendAndWait, azd init copilot. DO NOT USE FOR: deploying already-prepared...

Build and deploy GitHub Copilot SDK applications to Azure with flexible model configuration. Three scaffolding paths: create new greenfield projects, add SDK services to existing repos, or deploy existing SDK apps with Azure infrastructure Supports three model configurations: GitHub's default models, specific GitHub models via discovery, or bring-your-own-model (BYOM) on Azure with DefaultAzureCredential authentication Includes complete templates with Express/TypeScript API, React/Vite...

Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking…

Execute KQL queries and analyze data in Azure Data Explorer for log analytics, telemetry, and time series insights. Execute KQL queries against massive datasets with sub-second performance, including filtering, aggregation, time series analysis, and cross-table joins Discover and explore cluster resources, databases, and table schemas to understand your data model before querying Supports five core query patterns: basic retrieval, aggregation analysis, time series analytics, join-based...

Diagnose and resolve Azure Event Hubs and Service Bus SDK issues with structured troubleshooting workflows. Covers connection failures, authentication errors, AMQP link issues, message lock timeouts, and event processor stalls across Python, Java, JavaScript, and .NET SDKs Includes language-specific troubleshooting guides for Event Hubs and Service Bus, plus connectivity diagnostics for ports, WebSocket fallback, IP firewalls, and private endpoints Provides MCP tools to query resource...

Prepare Azure applications for deployment with infrastructure-as-code, configuration, and containerization. Generates Bicep or Terraform infrastructure code, azure.yaml configuration, and Dockerfiles based on application type and deployment target Requires mandatory plan-first workflow: analyze workspace, gather requirements, select recipe (AZD, AZCLI, Bicep, or Terraform), design architecture, then execute only after user approval Covers new app creation, modernization, and updates; routes...

Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). DO NOT USE FOR: copilot-sdk apps (use azure-hosted-copilot-sdk). WHEN: "create app", "build web app", "create API", "create serverless HTTP API", "create frontend", "create back end", "build a service", "modernize application", "update application", "add authentication", "add caching", "host on Azure", "create and...

Check/manage Azure quotas and usage across providers. For deployment planning, capacity validation, region selection. WHEN: "check quotas", "service limits", "current usage", "request quota increase", "quota exceeded", "validate capacity", "regional availability", "provisioning limits", "vCPU limit", "how many vCPUs available in my subscription".

Check and manage Azure quotas and usage across regions for deployment planning and capacity validation. Azure CLI ( az quota ) is the only reliable method for checking quotas; REST API and Portal are unreliable and may show misleading "No Limit" values that do not indicate unlimited capacity Supports four core workflows: checking specific resource quotas, comparing capacity across regions, requesting quota increases, and listing all quotas for a provider Quota resource names do not map 1:1...

Find minimal Azure RBAC roles, generate assignment commands, and provide Bicep infrastructure code. Identifies built-in roles matching desired permissions using Azure documentation, or creates custom role definitions when no built-in role fits Generates Azure CLI commands and Bicep code snippets for assigning roles to identities, service principals, and managed identities Clarifies prerequisites for granting roles, including which permissions ( Microsoft.Authorization/roleAssignments/write )...

Assess and improve the reliability posture of Azure Functions: zone redundancy, ZRS storage, health probes, multi-region failover. Scans deployed resources, presents a feature-pivoted checklist, then drives staged remediation (CLI or IaC patches) end-to-end with user confirmation. WHEN: "assess reliability", "check reliability", "zone redundant", "multi-region failover", "high availability", "disaster recovery", "single points of failure", "reliability posture".

List, find, and show Azure resources across subscriptions or resource groups. Handles prompts like "list the websites in my subscription", "list my web apps", "show my app services", "list virtual machines", "list my VMs", "show storage accounts", "find container apps", and "what resources do I have". USE FOR: list websites, list web apps, list app services, show websites in subscription, resource inventory, find resources by tag, tag analysis, orphaned resource discovery (not for cost...

Fast discovery and inventory of Azure resources across subscriptions using Resource Graph queries. Queries any Azure resource type (VMs, storage accounts, web apps, container apps, Key Vaults, etc.) across subscriptions and resource groups in a single command Supports cross-cutting searches for orphaned resources, missing tags, unhealthy states, and resource inventory counts Routes single-resource-type queries to dedicated MCP tools when available; falls back to Azure Resource Graph for...

Transform Azure resource groups into detailed architecture diagrams showing resource relationships and configurations. Discovers all resources within a resource group and analyzes their configurations, dependencies, and interconnections Generates Mermaid diagrams organized by logical layers (Network, Compute, Data, Security, Monitoring) with SKU details and connection labels Maps relationships including network connections, data flows, identity bindings, and configuration dependencies across...

Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. WHEN: create architecture diagram, visualize Azure resources, show resource relationships, generate Mermaid diagram, analyze resource group, diagram my resources, architecture visualization, resource topology, map Azure infrastructure.

Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue storage, table storage, data lake, upload files, download blobs, storage accounts, access tiers,...

Unified access to Azure blob storage, file shares, queues, tables, and data lake services. Supports five storage service types: Blob Storage for objects and backups, File Shares for SMB access, Queue Storage for async messaging, Table Storage for NoSQL key-value data, and Data Lake for big data analytics MCP server tools enable listing storage accounts, containers, and blobs, plus downloading and uploading blob content directly Configurable access tiers (hot, cool, cold, archive) and...

Assess and upgrade Azure workloads between plans, tiers, or SKUs, or modernize Azure SDK dependencies in source code. WHEN: upgrade Consumption to Flex Consumption, upgrade Azure Functions plan, change hosting plan, function app SKU, migrate App Service to Container Apps, modernize legacy Azure Java SDKs (com.microsoft.azure to com.azure), migrate Azure Cache for Redis (ACR/ACRE) to Azure Managed Redis (AMR).

Assess and automate upgrades of Azure workloads across plans, tiers, and SKUs. Handles plan migrations (Consumption to Flex Consumption), tier upgrades, and cross-service moves (App Service to Container Apps) with sequential assessment before any changes Generates pre-upgrade readiness reports, collects existing app settings and configurations, then executes automated upgrade steps with idempotent scripts Requires explicit user confirmation for destructive actions and target plan/SKU...

Pre-deployment validation for Azure infrastructure, configuration, and permissions before deployment. Requires .azure/plan.md from a prior azure-prepare run; stops immediately if the plan is missing Executes recipe-specific validation commands (azd provision, bicep build, terraform validate) and records proof in the plan document Performs build verification, configuration checks, and permission validation; blocks deployment if any check fails Only authorized method to set plan status to...

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless...

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app...

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token…

Microsoft Entra ID app registration, OAuth 2.0 configuration, and MSAL integration for secure application authentication. Covers app registration setup, authentication configuration, API permissions, and client credential management across web apps, SPAs, mobile apps, and daemon services Includes step-by-step workflows for first-time registration, console application authentication, and service-to-service credential flows Provides Azure CLI commands, MSAL library examples for .NET,...

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Azure RBAC or role assignments (use azure-rbac), Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

Deploy, evaluate, and manage Foundry agents end-to-end: Docker build, ACR push, hosted/prompt agent create, container start, batch eval, continuous eval, prompt optimizer workflows, agent.yaml, dataset curation from traces. USE FOR: deploy agent to Foundry, hosted agent, create agent, invoke agent, evaluate agent, run batch eval, continuous eval, continuous monitoring, continuous eval status, optimize prompt, improve prompt, prompt optimizer, optimize agent instructions, improve agent...

End-to-end deployment, evaluation, and management of AI agents on Microsoft Foundry. Covers the complete agent lifecycle: creation from starter samples, containerization and ACR push, hosted or prompt agent deployment, invocation, batch evaluation, and prompt optimization Includes specialized sub-skills for deploy, invoke, observe (evaluation and prompt optimization), trace analysis, troubleshooting, and dataset curation from production traces Supports project and resource provisioning, RBAC...

Deploy Python (Flask/Django/FastAPI) code to Azure App Service Linux. WHEN: "Flask App Service", "Django App Service", "FastAPI App Service", "deploy Python to App Service". DO NOT USE FOR: Container Apps, Functions, non-Python, Terraform/Bicep/IaC, full infra — use azure-prepare.