Azure Deploy

> AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE > > PREREQUISITE: The azure-validate skill MUST be invoked and completed with status Validated BEFORE executing this skill.

> ⛔ STOP — PREREQUISITE CHECK REQUIRED > Before proceeding, verify BOTH prerequisites are met: > > 1. azure-prepare was invoked and completed → .azure/deployment-plan.md exists > 2. azure-validate was invoked and passed → plan status = Validated > > If EITHER is missing, STOP IMMEDIATELY: > - No plan? → Invoke azure-prepare skill first > - Status not Validated? → Invoke azure-validate skill first > > ⛔ DO NOT MANUALLY UPDATE THE PLAN STATUS > > You are FORBIDDEN from changing the plan status to Validated yourself. Only the azure-validate skill is authorized to set this status after running actual validation checks. If you update the status without running validation, deployments will fail. > > DO NOT ASSUME the app is ready. DO NOT SKIP validation to save time. Skipping steps causes deployment failures. The complete workflow ensures success: > > azure-prepare → azure-validate → azure-deploy

Triggers

Activate this skill when user wants to:

• Execute deployment of an already-prepared application (azure.yaml and infra/ exist)
• Push updates to an existing Azure deployment
• Run azd up, azd deploy, or az deployment on a prepared project
• Ship already-built code to production
• Deploy an application that already includes API Management (APIM) gateway infrastructure

> Scope: This skill executes deployments. It does not create applications, generate infrastructure code, or scaffold projects. For those tasks, use azure-prepare.

> APIM / AI Gateway: Use this skill to deploy applications whose APIM/AI gateway infrastructure was already created during azure-prepare. For creating or changing APIM resources, see APIM deployment guide. For AI governance policies, invoke azure-aigateway skill.

Rules

1. Run after azure-prepare and azure-validate
2. .azure/deployment-plan.md must exist with status Validated
3. Pre-deploy checklist required — Pre-Deploy Checklist
4. ⛔ Destructive actions require ask_user — global-rules
5. Scope: deployment execution only — This skill owns execution of azd up, azd deploy, terraform apply, and az deployment commands. These commands are run through this skill's error recovery and verification pipeline.

Steps

| # | Action | Reference | |---|--------|-----------| | 1 | Check Plan — Read .azure/deployment-plan.md, verify status = Validated AND Validation Proof section is populated | .azure/deployment-plan.md | | 2 | Pre-Deploy Checklist — MUST complete ALL steps | Pre-Deploy Checklist | | 3 | Load Recipe — Based on recipe.type in .azure/deployment-plan.md | recipes/README.md | | 4 | RBAC Health Check — For Container Apps + ACR with managed identity: run azd provision --no-prompt, then verify AcrPull role has propagated before proceeding (see checklist) | Pre-Deploy Checklist — Container Apps RBAC | | 5 | Execute Deploy — Follow recipe steps | Recipe README | | 6 | Post-Deploy — Configure SQL managed identity and apply EF migrations if applicable | Post-Deployment | | 7 | Handle Errors — See recipe's errors.md | — | | 8 | Verify Success — Confirm deployment completed and endpoints are accessible | Verification | | 9 | Live Role Verification — Query Azure to confirm provisioned RBAC roles are correct and sufficient | live-role-verification.md | | 10 | Report Results — Present deployed endpoint URLs to the user as fully-qualified https:// links | Verification |

> ⛔ URL FORMAT RULE > > When presenting endpoint URLs to the user, you MUST always use fully-qualified URLs with the https:// scheme (e.g. https://myapp.azurewebsites.net, not myapp.azurewebsites.net). Many Azure CLI commands return bare hostnames without a scheme — always prepend https:// before presenting them.

> ⛔ VALIDATION PROOF CHECK > > When checking the plan, verify the Validation Proof section (Section 7) contains actual validation results with commands run and timestamps. If this section is empty, validation was bypassed — invoke azure-validate skill first.

SDK Quick References

• Azure Developer CLI: azd
• Azure Identity: Python | .NET | TypeScript | Java

MCP Tools

| Tool | Purpose | |------|---------| | mcp_azure_mcp_subscription_list | List available subscriptions | | mcp_azure_mcp_group_list | List resource groups in subscription | | mcp_azure_mcp_azd | Execute AZD commands | | azure__role | List role assignments for live RBAC verification (step 9) |

References

• Troubleshooting - Common issues and solutions
• Post-Deployment Steps - SQL + EF Core setup