Azure Deploy

Azure Deploy

> AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE > > PREREQUISITE: The azure-validate skill MUST be invoked and completed with status Validated BEFORE executing this skill.

> ⛔ STOP — PREREQUISITE CHECK REQUIRED > Before proceeding, verify BOTH prerequisites are met: > > 1. azure-prepare was invoked and completed → .azure/deployment-plan.md exists > 2. azure-validate was invoked and passed → plan status = Validated > > If EITHER is missing, STOP IMMEDIATELY: > - No plan? → Invoke azure-prepare skill first > - Status not Validated? → Invoke azure-validate skill first > > ⛔ DO NOT MANUALLY UPDATE THE PLAN STATUS > > You are FORBIDDEN from changing the plan status to Validated yourself. Only the azure-validate skill is authorized to set this status after running actual validation checks. If you update the status without running validation, deployments will fail. > > DO NOT ASSUME the app is ready. DO NOT SKIP validation to save time. Skipping steps causes deployment failures. The complete workflow ensures success: >

Triggers

Activate this skill when user wants to:

• Execute deployment of an already-prepared application (azure.yaml and infra/ exist)
• Push updates to an existing Azure deployment
• Run azd up, azd deploy, or az deployment on a prepared project
• Ship already-built code to production
• Deploy an application that already includes API Management (APIM) gateway infrastructure

> Scope: This skill executes deployments. It does not create applications, generate infrastructure code, or scaffold projects. For those tasks, use azure-prepare.

> APIM / AI Gateway: Use this skill to deploy applications whose APIM/AI gateway infrastructure was already created during azure-prepare. For creating or changing APIM resources, see APIM deployment guide. For AI governance policies, invoke azure-aigateway skill.

Rules

1. Run after azure-prepare and azure-validate
2. .azure/deployment-plan.md must exist with status Validated
3. Pre-deploy checklist required — Pre-Deploy Checklist
4. ⛔ Destructive actions require ask_user — global-rules
5. Scope: deployment execution only — This skill owns execution of azd up, azd deploy, terraform apply, and az deployment commands. These commands are run through this skill's error recovery and verification pipeline.

---

Steps

#	Action	Reference
1	Check Plan — Read .azure/deployment-plan.md, verify status = Validated AND Validation Proof section is populated	.azure/deployment-plan.md
2	Pre-Deploy Checklist — MUST complete ALL steps	Pre-Deploy Checklist
3	Load Recipe — Based on recipe.type in .azure/deployment-plan.md	recipes/README.md
4	RBAC Health Check — For Container Apps + ACR with managed identity: run azd provision --no-prompt, then verify AcrPull role has propagated before proceeding (see checklist)	Pre-Deploy Checklist — Container Apps RBAC
5	Execute Deploy — Follow recipe steps	Recipe README
6	Post-Deploy — Configure SQL managed identity and apply EF migrations if applicable	Post-Deployment
7	Handle Errors — See recipe's errors.md	—
8	Verify Success — Confirm deployment completed and endpoints are accessible	Verification
9	Live Role Verification — Query Azure to confirm provisioned RBAC roles are correct and sufficient	live-role-verification.md
10	Report Results — Present deployed endpoint URLs to the user as fully-qualified https:// links	Verification

> ⛔ URL FORMAT RULE > > When presenting endpoint URLs to the user, you MUST always use fully-qualified URLs with the https:// scheme (e.g. https://myapp.azurewebsites.net, not myapp.azurewebsites.net). Many Azure CLI commands return bare hostnames without a scheme — always prepend https:// before presenting them.

> ⛔ VALIDATION PROOF CHECK > > When checking the plan, verify the Validation Proof section (Section 7) contains actual validation results with commands run and timestamps. If this section is empty, validation was bypassed — invoke azure-validate skill first.

SDK Quick References

• Azure Developer CLI: azd
• Azure Identity: Python | .NET | TypeScript | Java

MCP Tools

Tool	Purpose
mcp_azure_mcp_subscription_list	List available subscriptions
mcp_azure_mcp_group_list	List resource groups in subscription
mcp_azure_mcp_azd	Execute AZD commands
azure__role	List role assignments for live RBAC verification (step 9)

References

• Troubleshooting - Common issues and solutions
• Post-Deployment Steps - SQL + EF Core setup