/azure-enterprise-infra-planner

by microsoftmicrosoft/github-copilot-for-azure253 stars

206

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

42 files
142.4 KB
MIT
Updated last month
GitHub
No alerts

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

This session only. Nothing lands on disk.

referencesconstraintsai-ml.md

3.3 KB raw

≈832 tokens on demand. Your agent reads this file only when SKILL.md points to it.

AI & ML Pairing Constraints

AI Search

Paired With	Constraint
Cognitive Services (AI Enrichment)	For AI enrichment pipelines (skillsets), attach a Cognitive Services account. Must be `kind: 'CognitiveServices'` or `kind: 'AIServices'` and in the same region as the search service.
Storage Account (Indexers)	Indexer data sources support Blob, Table, and File storage. Storage must be accessible (same VNet or public). For managed identity access, assign `Storage Blob Data Reader` role.
Cosmos DB (Indexers)	Indexer data source for Cosmos DB. Requires connection string or managed identity with `Cosmos DB Account Reader Role`.
SQL Database (Indexers)	Indexer data source. Requires change tracking enabled on the source table.
Private Endpoints	When `publicNetworkAccess: 'Disabled'`, create shared private link resources for outbound connections to data sources.
Managed Identity	Assign system or user-assigned identity for secure connections to data sources. Use RBAC instead of connection strings.
Semantic Search	Requires `semanticSearch` property set to `free` or `standard`. Available on `basic` and above SKUs.

Cognitive Services

Paired With	Constraint
Azure OpenAI Deployments	When `kind: 'OpenAI'` or `kind: 'AIServices'`, create model deployments as child resource `accounts/deployments`.
Microsoft Entra ID Auth	Requires `customSubDomainName` to be set. Without it, only API key auth works.
Private Endpoint	Requires `customSubDomainName`. Set `publicNetworkAccess: 'Disabled'` and configure private DNS zone.
Key Vault (CMK)	When using customer-managed keys, Key Vault must have soft-delete and purge protection enabled. Set `encryption.keySource: 'Microsoft.KeyVault'`.
Storage Account	When using `userOwnedStorage`, the storage account must be in the same region. Required for certain features (e.g., batch translation).
AI Foundry Hub	When `kind: 'AIServices'` with `allowProjectManagement: true`, can manage Foundry projects as child resources (`accounts/projects`).
VNet Integration	Configure `networkAcls` with `defaultAction: 'Deny'` and add virtual network rules. Set `bypass: 'AzureServices'` to allow trusted Azure services.

ML Workspace

Paired With	Constraint
Storage Account	Must be linked via `properties.storageAccount`. Cannot change after creation. Use `StorageV2` kind with standard SKU.
Key Vault	Must be linked via `properties.keyVault`. Cannot change after creation. Requires soft-delete enabled.
Application Insights	Linked via `properties.applicationInsights`. Should use workspace-based App Insights (backed by Log Analytics).
Container Registry	Optional but recommended for custom environments. Linked via `properties.containerRegistry`.
Hub workspace (kind=Project)	Must set `properties.hubResourceId` to the parent Hub's ARM resource ID. The Project inherits the Hub's linked resources.
VNet Integration	When `managedNetwork.isolationMode` is `AllowOnlyApprovedOutbound`, must configure outbound rules for all dependent services.

Source: SKILL.md on GitHub

Third-party checks

No alerts5mo4 checks · Risk SAFE

Gen Agent Trust Hub5mo
This skill provides a comprehensive framework for planning and deploying Azure infrastructure using Bicep and Terraform. It leverages official Microsoft documentation and Azure CLI tools to ensure architectural alignment with the Well-Architected Framework. The skill includes built-in security practices such as managed identity usage, RBAC enforcement, and secure parameter handling.
Socket5mo
No alerts
Snyk5mo
Risk: LOW · No issues
ZeroLeaks5mo
Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 5f24d7e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated last month

Capability

metadata: { "author": "Microsoft", "version": "0.0.0-placeholder" }

Topics

Infrastructure
azure
bicep
terraform
networking
landing-zone
hub-spoke
identity
disaster-recovery
compliance

What it does

Generates Bicep or Terraform code for enterprise Azure infrastructure from workload descriptions, covering networking, identity, security, and multi-region topologies aligned with Azure Well-Architected Framework. Targets cloud architects and platform engineers planning landing zones, hub-spoke networks, and subscription-scope deployments.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate Terraform or Bicep?

It generates both Bicep and Terraform directly. The skill targets subscription-scope and multi-resource-group deployments without using Azure Developer CLI (azd).

What Azure infrastructure patterns does this skill handle?

It covers enterprise patterns including landing zones, hub-spoke networks, multi-region disaster recovery, VNets, firewalls, private endpoints, VPN gateways, identity, RBAC, and compliance-driven topologies.

Should I use this skill for application-centric workflows?

No. The skill description explicitly recommends using azure-prepare instead for app-centric workflows. This skill is optimized for infrastructure and platform engineering.

Does this skill validate generated infrastructure code?

Yes. It includes validation for both Bicep (az bicep build) and Terraform (terraform validate) and checks for pairing constraint violations before deployment.

What MCP tools does this skill rely on?

It uses insights_get, get_azure_bestpractices_get, wellarchitectedframework_serviceguide_get, microsoft_docs_search, microsoft_docs_fetch, and bicepschema_get to fetch best practices, WAF guidance, and schema definitions.

Generated from the current SKILL.md. These answers refresh after source changes.

/azure-enterprise-infra-planner