--- title: "Azure Deploy: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-deploy/ description: "Pins Microsoft's Azure deploy skill, which stops unless a separate validation skill has already marked the deployment plan validated." --- # Azure Deploy: review, setup & limitations · Undominated.ai > Pins Microsoft's Azure deploy skill, which stops unless a separate validation skill has already marked the deployment plan validated. [← Explore all skills](/skills/) CLOUD OPERATIONS / Microsoft # Azure Deploy Pins Microsoft's Azure deploy skill, which stops unless a separate validation skill has already marked the deployment plan validated. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The file forbids the agent from marking a plan Validated and says to stop when that status or the Validation Proof section is missing. - It limits itself to executing deployment commands and says destructive actions require ask_user, rather than creating the application. ### A good fit for - Running azd, Bicep, or Terraform deployment commands only after azure-prepare and azure-validate have left a validated plan ### Weigh up before choosing - The resource was not executed, and no Azure API, CLI, or MCP tool was called. - /plugin install azure@skills installs the Azure plugin group, not this one skill file. - The plugin README warns that the plugin uses npx to download and run the Azure MCP server and that a compromised .npmrc could make that npx step execute untrusted code. This review did not install the plugin. - The plugin README says usage telemetry is collected unless AZURE_MCP_COLLECT_TELEMETRY=false. That switch was not tested. - The definition of a destructive action is delegated to references/global-rules.md, which was not fetched. - The pre-deploy checklist, recipe READMEs, and live role verification note were not fetched. - For Container Apps with ACR, the checklist step says to run azd provision --no-prompt before checking AcrPull. The file does not say whether that provision step is one of the destructive actions that require ask_user. - The source review is pinned to revision fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb, but the unversioned plugin install command selects the marketplace release available when installed; its code and dependencies may differ from this reviewed snapshot. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-skills/skills/azure-deploy/SKILL.md - .github/plugins/azure-skills/README.md - README.md - LICENSE ### Our findings - The skill says to stop immediately unless azure-prepare has written .azure/deployment-plan.md and azure-validate has set the plan status to Validated. - It forbids the agent from setting that Validated status itself, and it says an empty Validation Proof section means validation was bypassed. - It says the skill executes deployments and does not create applications, generate infrastructure, or scaffold projects, and that destructive actions require ask_user. - Its command scope names azd up, azd deploy, terraform apply, and az deployment, and a Container Apps plus ACR step names azd provision --no-prompt before an AcrPull check. - The validation proof check requires recorded commands and timestamps in the plan, beyond a status value of Validated; an empty section routes back to azure-validate. ### Not established by this review - The resource was not executed and its tools were not called. - azd, az, terraform, and the Azure MCP tools named in the file were not run. - references/global-rules.md and the pre-deploy checklist were not fetched. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) DOCUMENTED COMMAND /plugin install azure@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The repository README tells Copilot CLI to add the microsoft/skills marketplace and then run /plugin install azure@skills. - That command installs the Azure plugin group named in the README table, not this skill file by itself. - The azure-skills plugin README instead prints /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. This review did not resolve that second marketplace name. ### Before you start - Node.js 22 or later, which the plugin README requires for the Azure MCP server - Azure authentication by Azure CLI login, service-principal environment variables, or managed identity, as the plugin README lists - A host that can run the Copilot CLI plugin slash command ### Compatibility Claude Code · GitHub Copilot CLI · GitHub Copilot in VS Code ### Implementation shell ### Azure deployment commands after a validated plan - Read .azure/deployment-plan.md and require status Validated before deploying - Run the deployment commands the skill names, which can change Azure resources - Ask the user before an action the skill calls destructive - Installing the full plugin can download and execute Azure MCP/npm hook code and send usage telemetry; review local npm configuration and the telemetry setting before enabling that plugin path. ### Cost model MIT licence. No Azure call was made, and Azure prices were not checked. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-deploy SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy/SKILL.md Supports: validated-plan stop rule, forbidden status edit, and destructive-action ask - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: MIT licence heading and the azure plugin install line - [Azure plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md Supports: Azure authentication options, Node.js 22, and a different plugin install line - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License, copyright Microsoft Corporation - [Pinned source sections reviewed in continuation W12 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-deploy/SKILL.md Supports: upstreamDescription, review.findings, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Azure Enterprise Infra Planner ↗ Pins Microsoft's enterprise Azure infrastructure skill, which holds IaC and deployment until the user approves the plan and acknowledges deploy risk.](/skills/microsoft-azure-enterprise-infra-planner/)[### Deploy to AKS ↗ Pins Microsoft's skill for deploying an existing web app to a running AKS cluster, which requires az login and refuses to provision the cluster.](/skills/microsoft-azure-kubernetes-app-deploy/)[### Terraform AzureRM Set Diff Analyzer ↗ Separates false-positive Terraform plan diffs — order-only changes in Set-type attributes — from real resource changes, using a stdlib-only Python analyzer over terraform show -json output with CI-ready exit codes.](/skills/github-terraform-azurerm-set-diff-analyzer/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)