/azure-app-onboard

by microsoftmicrosoft/github-copilot-for-azure253 stars

206

End-to-end orchestrator: from a business idea, app idea, or existing app to running Azure deployment with cost estimates and pre-deploy approval. Analyzes your app, auto-detects the right Azure services, scaffolds infrastructure code, and deploys — tailored to your app, not a template. Handles moving existing apps to Azure without rewriting or with minimal changes. WHEN: bring your app to Azure, plan my app, cost to run, is my code ready to deploy, deploy my app to the cloud, deploy all my services, what Azure services do I need, plan my Azure deployment, deploy my new app to Azure, one-click deploy, I have an app and want it on Azure, migrate my app to Azure, help me get started, build an app, no code yet, starter project. DO NOT USE FOR: use azd for deployment(use azure-deploy), optimizing existing costs (use cost-optimization), code readiness checks only (use azure-app-onboard-prereq).

69 files
373.1 KB
MIT
Updated last week
GitHub
No alerts

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-app-onboard

This session only. Nothing lands on disk.

scaffoldreferenceswaf-checklist.md

2.3 KB raw

≈583 tokens on demand. Your agent reads this file only when SKILL.md points to it.

WAF Checklist

Per-pillar Well-Architected Framework alignment for AppOnboard-generated infrastructure. Use during scaffold self-review (Layer 4) and prepare validation (WAF Alignment dimension).

Reference: Azure Well-Architected Framework — link, don't duplicate. See WAF Service Guides for per-service checklists.

Reliability

Zone redundancy enabled for production SKUs (App Service P1v3+, SQL Premium, Redis Premium)
Health probes configured (Container Apps liveness/readiness, App Service /health)
GRS storage for production data (Standard_GRS or RA-GRS)
Retry policies in application code for transient failures
Min replicas ≥ 1 for production Container Apps (no cold-start)

Security

System-assigned managed identity on all services
Key Vault for all secrets (no inline connection strings)
HTTPS-only + TLS 1.2+ on all endpoints
No public blob access on storage accounts
Private endpoints where budget allows (balanced/performance tiers)
No administratorLogin for SQL (Entra-only auth)

Cost Optimization

SKU matches prepare-plan.json budget tier — no over-provisioning
Scale-to-zero enabled for dev/test Container Apps
Free tier grants applied in cost estimate (see pricing-guide.md § Free Grants Summary)
Reserved instances noted as option for production (don't auto-apply)

Operational Excellence

diagnostic-settings is not scaffolded; if the generator added one it MUST be gated behind enableDiagnostics (default false) or absent — never wired unconditionally (that blocks the first deploy).
Application Insights connected for APM
Resource tagging: app-onboard-skill, app-onboard-session-id, created-at (see bicep-patterns.md § Service Tagging or terraform-patterns.md § Resource Tags)
All configurable values parameterized (no hardcoded regions, names, SKUs)

Performance Efficiency

Autoscale rules for production SKUs (Container Apps max replicas, App Service auto-scale)
CDN for static assets when SPA frontend detected
Connection pooling for database access
Appropriate cache tier (Redis) when session/cache pattern detected

Source: SKILL.md on GitHub

Third-party checks

No alerts22d3 checks · Risk SAFE

Gen Agent Trust Hub22d
This skill includes some security considerations such as the processing of untrusted project files to generate deployment scripts and the dynamic generation of infrastructure code. While these warrant review, they are used within the skill's intended functionality to automate Azure onboarding. See detailed analysis for context.
Socket22d
No alerts
Snyk22d
Risk: LOW · No issues

Provenance

Signed by skilld at cda1f27. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 20 hours ago.

Activeupdated last week

Capability

metadata: { "author": "Microsoft", "version": "0.0.0-placeholder" }

/azure-app-onboard