--- title: "Azure Enterprise Infra Planner: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-enterprise-infra-planner/ description: "Pins Microsoft's enterprise Azure infrastructure skill, which holds IaC and deployment until the user approves the plan and acknowledges deploy risk." --- # Azure Enterprise Infra Planner: review, setup & limitations · Undominated.ai > Pins Microsoft's enterprise Azure infrastructure skill, which holds IaC and deployment until the user approves the plan and acknowledges deploy risk. [← Explore all skills](/skills/) CLOUD OPERATIONS / Microsoft # Azure Enterprise Infra Planner Pins Microsoft's enterprise Azure infrastructure skill, which holds IaC and deployment until the user approves the plan and acknowledges deploy risk. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Phase 5 approval is required before IaC, and a plan that is not approved stops both generation and deployment. - Referenced infrastructure is not recreated, and that path says Phase 7 is incremental and must not modify or destroy the referenced resources. ### A good fit for - Planning a multi-resource Azure topology in Bicep or Terraform when deployment should wait for an explicit risk acknowledgement - Plan an additive deployment around inventoried existing resources without recreating, modifying or destroying those referenced resources. ### Weigh up before choosing - The resource was not executed, and no Azure API, CLI, or MCP tool was called. - /plugin install azure@skills installs the Azure plugin group, not this one skill file. - The plugin README warns that the plugin uses npx to download and run the Azure MCP server and that a compromised .npmrc could make that npx step execute untrusted code. This review did not install the plugin. - The plugin README says usage telemetry is collected unless AZURE_MCP_COLLECT_TELEMETRY=false. That switch was not tested. - references/workflow.md, referenced-workload.md, and the plan schema were not fetched. The gates below are only what SKILL.md itself states. - The command table lists terraform plan, while the written Phase 6 gate is az bicep build or terraform validate plus checkov. The diagram sends greenfield Phase 7 to terraform apply after confirmation, not to a required plan step. - The file says checkov must have no unresolved high or critical findings. Checkov was not run, and the severity labels were not compared with a Checkov report. - The source review is pinned to revision fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb, but the unversioned plugin install command selects the marketplace release available when installed; its code and dependencies may differ from this reviewed snapshot. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md - .github/plugins/azure-skills/README.md - README.md - LICENSE ### Our findings - The file says a referenced workload is inventoried and referenced, never recreated, and that its Phase 7 deploy is incremental and must not modify or destroy those referenced resources. - Phase 5 requires explicit user approval, and the error table says to stop and prompt when meta.status is not approved, before IaC generation or deployment. - Phase 6 does not advance unless local validation returns zero errors and a checkov scan has no unresolved high or critical findings, and the skill says to show that command output. - Phase 7 requires an explicit risk-acknowledged deploy confirmation. The diagram sends greenfield work to az deployment or terraform apply, and referenced work to an additive deploy with a what-if preview. ### Not established by this review - The resource was not executed and its tools were not called. - az bicep, terraform, and checkov were not run. - The linked workflow and referenced-workload notes were not fetched. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) DOCUMENTED COMMAND /plugin install azure@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The repository README tells Copilot CLI to add the microsoft/skills marketplace and then run /plugin install azure@skills. - That command installs the Azure plugin group named in the README table, not this skill file by itself. - The azure-skills plugin README instead prints /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. This review did not resolve that second marketplace name. ### Before you start - Node.js 22 or later, which the plugin README requires for the Azure MCP server - Azure authentication by Azure CLI login, service-principal environment variables, or managed identity, as the plugin README lists - A host that can run the Copilot CLI plugin slash command ### Compatibility Claude Code · GitHub Copilot CLI · GitHub Copilot in VS Code ### Implementation bicep · terraform · shell ### Azure infrastructure planning with a gated deploy - Read existing Azure inventory when the user points at resources that already exist - Write plan and IaC files under the project after the stated gates - Deploy only after an explicit risk acknowledgement, and not by destroying referenced resources - Installing the full plugin can download and execute Azure MCP/npm hook code and send usage telemetry; review local npm configuration and the telemetry setting before enabling that plugin path. ### Cost model MIT licence. No Azure call was made, and Azure prices were not checked. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-enterprise-infra-planner SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md Supports: approval gate, validation gate, and no-destroy rule for referenced resources - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: MIT licence heading and the azure plugin install line - [Azure plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md Supports: Azure authentication options, Node.js 22, and a different plugin install line - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License, copyright Microsoft Corporation - [Pinned source sections reviewed in continuation W14 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-enterprise-infra-planner/SKILL.md Supports: upstreamDescription, bestFor, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Azure Deploy ↗ Pins Microsoft's Azure deploy skill, which stops unless a separate validation skill has already marked the deployment plan validated.](/skills/microsoft-azure-deploy/)[### Terraform AzureRM Set Diff Analyzer ↗ Separates false-positive Terraform plan diffs — order-only changes in Set-type attributes — from real resource changes, using a stdlib-only Python analyzer over terraform show -json output with CI-ready exit codes.](/skills/github-terraform-azurerm-set-diff-analyzer/)[### AKS Automatic Readiness ↗ Pins Microsoft's AKS Automatic readiness skill, which assesses a cluster or local manifests without changing the cluster and writes files only after an accepted diff.](/skills/microsoft-azure-kubernetes-automatic-readiness/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)