CLOUD OPERATIONS / Microsoft
Azure Enterprise Infra Planner
Pins Microsoft's enterprise Azure infrastructure skill, which holds IaC and deployment until the user approves the plan and acknowledges deploy risk.
“Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.”
01 / THE REASONING
Why this made the selection.
- Phase 5 approval is required before IaC, and a plan that is not approved stops both generation and deployment.
- Referenced infrastructure is not recreated, and that path says Phase 7 is incremental and must not modify or destroy the referenced resources.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- .github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md
- .github/plugins/azure-skills/README.md
- README.md
- LICENSE
Our findings
- The file says a referenced workload is inventoried and referenced, never recreated, and that its Phase 7 deploy is incremental and must not modify or destroy those referenced resources.
- Phase 5 requires explicit user approval, and the error table says to stop and prompt when meta.status is not approved, before IaC generation or deployment.
- Phase 6 does not advance unless local validation returns zero errors and a checkov scan has no unresolved high or critical findings, and the skill says to show that command output.
- Phase 7 requires an explicit risk-acknowledged deploy confirmation. The diagram sends greenfield work to az deployment or terraform apply, and referenced work to an additive deploy with a what-if preview.
Not established by this review
- The resource was not executed and its tools were not called.
- az bicep, terraform, and checkov were not run.
- The linked workflow and referenced-workload notes were not fetched.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin install azure@skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README tells Copilot CLI to add the microsoft/skills marketplace and then run /plugin install azure@skills.
- That command installs the Azure plugin group named in the README table, not this skill file by itself.
- The azure-skills plugin README instead prints /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. This review did not resolve that second marketplace name.
Before you start
- Node.js 22 or later, which the plugin README requires for the Azure MCP server
- Azure authentication by Azure CLI login, service-principal environment variables, or managed identity, as the plugin README lists
- A host that can run the Copilot CLI plugin slash command
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md
Supports: approval gate, validation gate, and no-destroy rule for referenced resources
- Repository README ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md
Supports: MIT licence heading and the azure plugin install line
- Azure plugin README ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md
Supports: Azure authentication options, Node.js 22, and a different plugin install line
- Repository LICENSE ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE
Supports: MIT License, copyright Microsoft Corporation
https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md
Supports: upstreamDescription, bestFor, review.notTested