--- title: "Azure app onboard deploy: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-deploy/ description: "Pins the app-onboard deploy phase, which requires a what-if preview and an approval gate before it changes Azure, then says to stop." --- # Azure app onboard deploy: review, setup & limitations · Undominated.ai > Pins the app-onboard deploy phase, which requires a what-if preview and an approval gate before it changes Azure, then says to stop. [← Explore all skills](/skills/) AZURE DEPLOYMENT / Microsoft # Azure app onboard deploy Pins the app-onboard deploy phase, which requires a what-if preview and an approval gate before it changes Azure, then says to stop. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Invoked by the `azure-app-onboard` orchestrator at Phase 4 when `scaffold-manifest.json` exists with `files[]` and `validationResult`. Not directly user-routable.” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Preflight requires authentication, a mandatory what-if preview, RBAC, and the resource group before the deploy approval gate. - A location change on retry requires that gate again, and the file says to stop further CLI commands after the result is finalized. ### A good fit for - Deploying an already scaffolded app-onboard plan only after the what-if preview and the approval gate - Inspect response bodies for dependency failures and unresolved deployment placeholders during multi-service health checks. ### Weigh up before choosing - This review did not execute the resource. - /plugin install azure@skills installs the azure plugin group, not this file alone. The root README also shows npx skills add microsoft/skills for a prompted selection. - The azure plugin README documents /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. The root README and that plugin README do not name the same marketplace. - The root README licence line is MIT and the LICENSE file is the MIT License. The plugin README does not state a licence. - The file says this phase is not directly user-routable. It is invoked by azure-app-onboard when scaffold-manifest.json already exists, and it returns to that orchestrator. - Step 5b says the result skeleton must exist before the first az command, while step 3 already requires a what-if preview. deploy-checklist.md was not opened, so this review did not treat that preview as an az command. - deploy-safety.md, error-classification.md, deploy-schemas.ts, and the code-deployment references were not opened. - Secure-parameter generation and the SCM publishing-credentials change were not run. - The source review is pinned to revision fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb, but the unversioned plugin install command selects the marketplace release available when installed; its code and dependencies may differ from this reviewed snapshot. - The plugin README says Azure MCP and its telemetry hook download and execute npm code using local .npmrc settings. Telemetry is enabled unless AZURE_MCP_COLLECT_TELEMETRY=false is set for the agent process. Neither the plugin nor hook was executed in this review. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md - .github/plugins/azure-skills/README.md - README.md - LICENSE ### Our findings - Preflight lists authentication, a mandatory what-if preview, RBAC, and the resource group before the deploy approval gate. - Before a deployment retry, a location that no longer matches the plan requires the approval gate again. - Secure parameters are generated instead of asking the user for passwords, and a retry must reuse the stored values rather than generate new ones. - After health checks, every App Service or Functions app must have SCM basic publishing credentials denied, and the following read must show that allow is false. - The healing loop asks the user after three attempts and then every five, and the file says to stop with no further CLI commands once the result is finalized. ### Not established by this review - The resource was not executed and its tools were not called. - No Azure deployment, what-if, or health check was run. - No publishing-credentials policy was changed. - This was source reading only and is not a runtime or security certification. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) DOCUMENTED COMMAND /plugin install azure@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The root README Copilot CLI section shows /plugin marketplace add microsoft/skills and then the command above. - That command installs the azure plugin group. It does not install this one file by itself. - The same README quick start, npx skills add microsoft/skills, asks the operator to select skills and can install more than this file. - The azure plugin README at this pin instead shows /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. ### Before you start - Copilot CLI if the plugin command is used - Node.js 22 or later for the Azure MCP server named by the plugin README, which this review did not install - An Azure login if the workflow is followed, which this review did not use ### Compatibility GitHub Copilot CLI · Claude Code · GitHub Copilot ### Implementation shell ### Local skill text plus optional Azure deployment permissions - Read the skill - Run a what-if preview or deployment only if the operator uses Azure credentials - Generate deployment secrets and change SCM publishing credentials only if the operator follows the deploy steps, which this review did not do - Installing the full plugin can download and execute Azure MCP/npm hook code and send usage telemetry; review local npm configuration and the telemetry setting before enabling that plugin path. ### Cost model MIT; no Azure call was made 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-app-onboard deploy SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md Supports: what-if preview, re-approval on location change, and stop after the result - [Azure plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md Supports: Copilot CLI or Claude Code, and a different azure plugin install line - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: azure plugin install line and MIT statement - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License - [Pinned source sections reviewed in continuation W43 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md Supports: upstreamDescription, bestFor, review.reviewedAt, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Python App Service deploy ↗ Pins Microsoft's Python App Service deploy skill, which forbids health probes after deploy and forbids az webapp up.](/skills/microsoft-python-appservice-deploy/)[### Azure Deploy ↗ Pins Microsoft's Azure deploy skill, which stops unless a separate validation skill has already marked the deployment plan validated.](/skills/microsoft-azure-deploy/)[### Azure validate ↗ Pins Microsoft's pre-deploy Azure check, which stops without an approved plan and will not run azd deploy itself.](/skills/microsoft-azure-validate/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)