azure-enterprise-infra-planner

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

Safety Notice

This listing is imported from skills.sh public index metadata. Review upstream SKILL.md and repository scripts before running.

Copy this and send it to your AI assistant to learn

Install skill "azure-enterprise-infra-planner" with this command: npx skills add microsoft/azure-skills/microsoft-azure-skills-azure-enterprise-infra-planner

Azure Enterprise Infra Planner

When to Use This Skill

Activate this skill when user wants to:

Plan enterprise Azure infrastructure from a workload or architecture description
Architect a landing zone, hub-spoke network, or multi-region topology
Design networking infrastructure: VNets, subnets, firewalls, private endpoints, VPN gateways
Plan identity, RBAC, and compliance-driven infrastructure
Generate Bicep or Terraform for subscription-scope or multi-resource-group deployments
Plan disaster recovery, failover, or cross-region high-availability topologies

Quick Reference

Property	Details
MCP tools	`get_azure_bestpractices_get`, `wellarchitectedframework_serviceguide_get`, `microsoft_docs_fetch`, `microsoft_docs_search`, `bicepschema_get`
CLI commands	`az deployment group create`, `az bicep build`, `az resource list`, `terraform init`, `terraform plan`, `terraform validate`, `terraform apply`
Output schema	plan-schema.md
Key references	research.md, resources/, waf-checklist.md, constraints/

Workflow

Read workflow.md for detailed step-by-step instructions, including MCP tool usage, CLI commands, and decision points. Follow the phases in order, ensuring all key gates are passed before proceeding to the next phase.

Phase	Action	Key Gate
1	Research — WAF Tools	All MCP tool calls complete
2	Research — Refine & Lookup	Resource list approved by user
3	Plan Generation	Plan JSON written to disk
4	Verification	All checks pass, user approves
5	IaC Generation	`meta.status` = `approved`
6	Deployment	User confirms destructive actions

MCP Tools

Tool	Purpose
`get_azure_bestpractices_get`	Azure best practices for code generation, operations, and deployment
`wellarchitectedframework_serviceguide_get`	WAF service guide for a specific Azure service
`microsoft_docs_search`	Search Microsoft Learn for relevant documentation chunks
`microsoft_docs_fetch`	Fetch full content of a Microsoft Learn page by URL
`bicepschema_get`	Bicep schema definition for any Azure resource type (latest API version)

Error Handling

Error	Cause	Fix
MCP tool error or not available	Tool call timeout, connection error, or tool doesn't exist	Retry once; fall back to reference files and notify user if unresolved
Plan approval missing	`meta.status` is not `approved`	Stop and prompt user for approval before IaC generation or deployment
IaC validation failure	`az bicep build` or `terraform validate` returns errors	Fix the generated code and re-validate; notify user if unresolved
Pairing constraint violation	Incompatible SKU or resource combination	Fix in plan before proceeding to IaC generation
Infra plan or IaC files not found	Files written to wrong location or not created	Verify files exist at `<project-root>/.azure/` and `<project-root>/infra/`; if missing, re-create the files by following workflow.md exactly

Source Transparency

This detail page is rendered from real SKILL.md content. Trust labels are metadata-based hints, not a safety guarantee.

Open in GitHub Open in ClawHub

Related Skills

Related by shared tags or category signals.

Security

entra-app-registration

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Azure RBAC or role assignments (use azure-rbac), Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

Repository Source

298.7K880Microsoft

Security

azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Repository Source

298.6K880Microsoft

Security

azure-kubernetes

Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS environment, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, rightsize AKS pod, AKS spot nodes, AKS cluster-autoscaler.

Repository Source

129.9K880Microsoft

Security

azure-cost

Unified Azure cost management: query historical costs, forecast future spending, and optimize to reduce waste. WHEN: "Azure costs", "Azure spending", "Azure bill", "cost breakdown", "cost by service", "cost by resource", "how much am I spending", "show my bill", "monthly cost summary", "cost trends", "top cost drivers", "actual cost", "amortized cost", "forecast spending", "projected costs", "estimate bill", "future costs", "budget forecast", "end of month costs", "how much will I spend", "optimize costs", "reduce spending", "find cost savings", "orphaned resources", "rightsize VMs", "cost analysis", "reduce waste", "unused resources", "optimize Redis costs", "cost by tag", "cost by resource group", "AKS cost analysis add-on", "namespace cost", "cost spike", "anomaly", "budget alert", "AKS cost visibility". DO NOT USE FOR: deploying resources, provisioning infrastructure, diagnostics, security audits, or estimating costs for new resources not yet deployed.

Repository Source

105.9K880Microsoft