skilld
All skills
microsoft avatar

/azure-enterprise-infra-planner

@5f24d7e official
by microsoftmicrosoft/github-copilot-for-azure253 stars
206

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

This session only. Nothing lands on disk.

referencesconstraintsmonitoring.md

≈450 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Monitoring Pairing Constraints

Application Insights

Paired With Constraint
Log Analytics Workspace-based App Insights (recommended) requires WorkspaceResourceId. Classic (standalone) is being phased out.
Function App Set APPLICATIONINSIGHTS_CONNECTION_STRING or APPINSIGHTS_INSTRUMENTATIONKEY in function app settings.
App Service Set APPLICATIONINSIGHTS_CONNECTION_STRING in app settings. Enable auto-instrumentation for supported runtimes.
AKS Use Container Insights (different from App Insights) for cluster-level monitoring. App Insights used for application-level telemetry.
Private Link Use Azure Monitor Private Link Scope (AMPLS) to restrict ingestion/query to private networks.
Retention If workspace-based, retention is governed by the Log Analytics workspace. Component-level retention acts as an override.

Log Analytics

Paired With Constraint
Application Insights App Insights WorkspaceResourceId must reference this workspace. Both should be in the same region for optimal performance.
AKS (Container Insights) AKS omsagent addon references workspace via logAnalyticsWorkspaceResourceID.
Diagnostic Settings Multiple resources can send diagnostics to the same workspace. Configure via Microsoft.Insights/diagnosticSettings on each resource.
Retention Free tier is limited to 7-day retention. PerGB2018 supports 30–730 days. Archive tier available for longer retention.
Private Link Use Azure Monitor Private Link Scope (AMPLS) for private ingestion/query. A workspace can be linked to up to 100 AMPLS resources (a VNet can connect to only one AMPLS).

Source: SKILL.md on GitHub

Third-party checks

No alerts5mo4 checks · Risk SAFE
  • Gen Agent Trust Hub5mo

    This skill provides a comprehensive framework for planning and deploying Azure infrastructure using Bicep and Terraform. It leverages official Microsoft documentation and Azure CLI tools to ensure architectural alignment with the Well-Architected Framework. The skill includes built-in security practices such as managed identity usage, RBAC enforcement, and secure parameter handling.

  • Socket5mo

    No alerts

  • Snyk5mo

    Risk: LOW · No issues

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 5f24d7e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated last month

Capability

metadata
{
  "author": "Microsoft",
  "version": "0.0.0-placeholder"
}

Topics

  • Infrastructure
  • azure
  • bicep
  • terraform
  • networking
  • landing-zone
  • hub-spoke
  • identity
  • disaster-recovery
  • compliance

README badge

README badge for microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

What it does

Generates Bicep or Terraform code for enterprise Azure infrastructure from workload descriptions, covering networking, identity, security, and multi-region topologies aligned with Azure Well-Architected Framework. Targets cloud architects and platform engineers planning landing zones, hub-spoke networks, and subscription-scope deployments.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate Terraform or Bicep?
It generates both Bicep and Terraform directly. The skill targets subscription-scope and multi-resource-group deployments without using Azure Developer CLI (azd).
What Azure infrastructure patterns does this skill handle?
It covers enterprise patterns including landing zones, hub-spoke networks, multi-region disaster recovery, VNets, firewalls, private endpoints, VPN gateways, identity, RBAC, and compliance-driven topologies.
Should I use this skill for application-centric workflows?
No. The skill description explicitly recommends using azure-prepare instead for app-centric workflows. This skill is optimized for infrastructure and platform engineering.
Does this skill validate generated infrastructure code?
Yes. It includes validation for both Bicep (az bicep build) and Terraform (terraform validate) and checks for pairing constraint violations before deployment.
What MCP tools does this skill rely on?
It uses insights_get, get_azure_bestpractices_get, wellarchitectedframework_serviceguide_get, microsoft_docs_search, microsoft_docs_fetch, and bicepschema_get to fetch best practices, WAF guidance, and schema definitions.

Generated from the current SKILL.md. These answers refresh after source changes.